hxxp://docs[.]candidateapplyform[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://docs.candidateapplyform.com
Sample260509-eavy7sdx8m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
688	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227718953778280"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
3356	chrome.exe
3356	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4648	4572	chrome.exe	85
PID 4572 wrote to memory of 3968	4572	chrome.exe	86
PID 4572 wrote to memory of 3968	4572	chrome.exe	86
PID 4572 wrote to memory of 688	4572	chrome.exe	87
PID 4572 wrote to memory of 4516	4572	chrome.exe	88
PID 4572 wrote to memory of 4516	4572	chrome.exe	88
PID 4572 wrote to memory of 4488	4572	chrome.exe	90
PID 4572 wrote to memory of 3628	4572	chrome.exe	91
PID 4572 wrote to memory of 4488	4572	chrome.exe	90
PID 4572 wrote to memory of 3628	4572	chrome.exe	91
PID 4572 wrote to memory of 4500	4572	chrome.exe	92
PID 4572 wrote to memory of 4500	4572	chrome.exe	92
PID 4572 wrote to memory of 2360	4572	chrome.exe	93
PID 4572 wrote to memory of 2360	4572	chrome.exe	93
PID 4572 wrote to memory of 1956	4572	chrome.exe	94
PID 4572 wrote to memory of 1956	4572	chrome.exe	94
PID 4572 wrote to memory of 872	4572	chrome.exe	95
PID 4572 wrote to memory of 872	4572	chrome.exe	95
PID 4572 wrote to memory of 2672	4572	chrome.exe	96
PID 4572 wrote to memory of 700	4572	chrome.exe	103
PID 4572 wrote to memory of 700	4572	chrome.exe	103
PID 4572 wrote to memory of 2052	4572	chrome.exe	107
PID 4572 wrote to memory of 2052	4572	chrome.exe	107
PID 4572 wrote to memory of 4756	4572	chrome.exe	108
PID 4572 wrote to memory of 4756	4572	chrome.exe	108
PID 4572 wrote to memory of 1760	4572	chrome.exe	109
PID 4572 wrote to memory of 1760	4572	chrome.exe	109
PID 4572 wrote to memory of 888	4572	chrome.exe	111
PID 4572 wrote to memory of 2408	4572	chrome.exe	112
PID 4572 wrote to memory of 5596	4572	chrome.exe	113
PID 4572 wrote to memory of 3356	4572	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://docs.candidateapplyform.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xb4,0x104,0x7ff9b22cc728,0x7ff9b22cc734,0x7ff9b22cc740
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17301177641455210855,4899539943657567813,262144 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,14230221653222097382,13008334825828500040,524288 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,12099395378160847470,12625276418547784294,524288 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,14448806174315826978,4851625084381161022,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,9633432308374101,9202213463820906469,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4256,i,5247458590832781912,6627433018155313274,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,15257057357673446717,4094826381648420194,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4904,i,16354750322610679697,5910374753968439916,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4832,i,6594770802641325859,17667636181106006695,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,1973223264076089888,5828983903923575843,524288 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4988,i,5923706949548835575,2769867524341573277,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6264,i,14384467340270976230,12795062672424534116,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5104,i,3346501850195346569,9404338524242909158,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5072,i,12668582607377838750,111919549231740902,2097152 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,4641440544090192328,14916419496947869148,524288 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,10520773459687709287,337282287648155185,524288 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,211605226209505820,6173958233867160508,524288 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5624,i,7811307182453576175,11312437805562684276,262144 --field-trial-handle=2004,i,10489318648100962602,2251068607767822086,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85bd9abcda5bbbc5829cdd16409f6b94ea2bc8b8d0234e6fc9e4add68c4a4adc
MD5 d014c5e2d269f79e07675dae081a8267
SHA1 992364ab30dd603676f8d3052a6b648ce790e8ac
SHA512 affade7f2582dc51ed434245a539a43056b438d97528dbb21108019c39e867e9b180f0d502ef943850ae04414dd130985d52bd2a7cdc3f744d80fb4d44d787d8
TLSH
T183E02BBAC821DC2705FD075D10650746E75013572750894F773D830C8FB053B098686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 0bd0e7eae2c853723d579c8851c99e51777254bf0b0e5f6f5fff838d004649dd
MD5 ba663c5287a6ffed627f7325b4beee39
SHA1 4089b6b23e67ed971ce0af7d4552eefaad9ac1fa
SHA512 657994ae860b28cf3a001d566181390b37470efe5fda48a978a782e53d86e399beb7e64b6d63ba54a8d445204e1c78d102b2308cc2f4084b12cd29ee2948f566
TLSH
T18DD0A92BF580644BEB80A232A8C20E8CE024C21244B2932B00E142A9A4827B8E8680E0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4976bc14c714607e5a46faed44f4d1e8cbb7090a92818e29fe0715575ee76e80
MD5 03c4e5d253e83883cdfae4347b65fcee
SHA1 46619ea87e77d01b7d335c8372908595dc2a255c
SHA512 5ca43f5fca595fa5fbf62f1e3291de02b83d2ba4a10edca46ab99ad93e4d21816b44eff5a6edae28c3bf6b31a66d4046f1e302480b35640ca632eea18b50202f
SSDEEP 96:D0z3wmsjMybaIEagdsehFiut/bIkCtlVuTTT:D08vYybaIEagdsehFiuJbIftruTn
TLSH
T139C1BDB3C3E4C67E861156F4EB146E2BCE6C0A54435C3D66C9D4EF4B93E28B2D24168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 52a9b12c9980cd8032346f9038efeb90e06a16971d6fc475faedc0b44139c25b
MD5 85ea5fe22973d5fa8bb7340cb7012c24
SHA1 c88e123d854242b323cf28cbe41b7d816b2d3327
SHA512 7b8a7f445d9b853e895d95fbd40c00dbb0137b72e7e36c50b001aa2c6dab035cdddfd256627fbace2553412c5fa774b721e72d5b15443debf7f17b92ac0979c2
SSDEEP 192:lR2HXnMZzyzWnsv7SpCUPRpdvvbvr9QHMS6b+WNeicraT8mBG2BTm7CLVyIsnAU3:lR2HXMVyu4ekGXdfWXGyjP2FmqE
TLSH
T10552D62AA954297B4DDBC229F952771BD7F4142275D02E88F7FC8E2C24E75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0433f1b795f3ca6e2aaa246126a85b64d7dcb4b83fef8f464d24f2144ef51fbe
MD5 b42333e7b5a76c526d89a3e18b7559e3
SHA1 a377487223a6ca63ffbe23ea1cce83b28aca7020
SHA512 f98cec9aec7af504c504ca8503bef0540ea4db7814b404524c91d46a43a57f1c453f0d8f00d47144b1411220df9344fa2d9e6c2fad8551f0716f738bd7dd712e
SSDEEP 192:lR2HXnMZzyzWnxv7SpAPRp2vbvr9QHMS6b+WNeicraT8mBG2TTm7CdVyIsnAUgE:lR2HXMVyuheUX+WXGyjP2Hm+E
TLSH
T15C52D53EA954297B4CDBC229F952771BD7F1102271D42E88E6FC8E2C24E39CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a64381ec7a98bae3d5b65a4ab62089489372601bf836d5d93e2ee0f4bd85466c
MD5 1185b7228c8421b1b29f596fd0805828
SHA1 4ec2f9cea94cfe13a120865cce4cf23d969e1911
SHA512 7a92e475a59fbd32903e8da19307d79a9a34f839f123437d63522f6aea385795806adbca8c2691ab3c90c228caac35d18a5413008a2c99ddb26e61a6d7b90b96
SSDEEP 192:lR2HXnMZzyzWG0v7SpAPRp2vsr9QHsb+WNncrHBG29Tm7CPVyIsnAUge:lR2HXMVy1weUXRWwow2pm8e
TLSH
T1BD42C62EBA54257B4DCBC229F962775BD7F5102274D41E88E6FC8A2C24E79CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7a85c78f13acfc7355e1eefecad8414e088e5a6c978aaaaacf6d822eda73e97c
MD5 bf34022505a306d8ed4ec4d50c4a2fe8
SHA1 521d6d53c55326a9d576a6f4ff97f5b5c8c0dceb
SHA512 53c29516e34d635dbbfd5c850cef7533102a017666bd67569c83cfc94c95bca82833333ba07a9edab4183d63036a385bf545ea6a113dfe77a684af7bcc1bc562
SSDEEP 192:lR2HXnMZzyzWndv7SpAPRp2vbur9QHMS6b+WNeicraT8mBG2/Tm7CPVyIsnAUge:lR2HXMVyudeUXJWXGyjP2rm8e
TLSH
T1FD52D62EA954297B4CDBC229F962771BD7F5142270D42E88E6FC8E2C24E35CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b45dc9ca25721ce0bdf26a702ccf443bace8bbba27ae0fc7ddf18220bd944461
MD5 18190b59824775a40f978488c295aef4
SHA1 74649e4687edcdc6236d6963b3cd0ab6ccca3b6f
SHA512 c1c6d46a3b033ea83744986d88eb1e3b655eca22aee6473ec0cd06d453a9b7a76dfc23ca366e6d0604410f5db62d6e3c4f07ac5355d47d281cb23f45058c6cdd
SSDEEP 192:lR2HXnMZzyzWnAv7SpAPRp2vbur9QHMS6b+WNeicraT8mBG2TTm7CdVyIsnAUgE:lR2HXMVyuceUXJWXGyjP2Hm+E
TLSH
T1ED52D63EA954297B4CDBC229F952771BD7F1142275D42E88E6FC8E2C24E79CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 64a1ea9b8b99b9c55179f1905dc7cf6c425036e94ef0996985835ab89b84e7ac
MD5 27bcb83a2343ea4115a24ead7d199b0d
SHA1 a4b9797ec66d94c469648ca757db7e0da338144d
SHA512 48cbf26275a5b3222c03fd140a4ee2b6631a59b14b5250d7dc25d2dddafd29c03dc63a3dfc1ab402bb66e50c79603adec78b1eca11566821de7a528e811f00dd
TLSH
T169B01211C0015505D09702F011C2048C32245F108705170553E8ADB1DC261A2C0141D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5844c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5844c4.TMP
Size 96B
SHA256 9d54d5eeb8ea59389103c9495e37fcd29ca8f02a919dc9f35a34ef5af678b072
MD5 872bd0e1b2aa3e79b680fac3828c4bb7
SHA1 d064c47f255e5754e0763952a14ff4d6f69fe134
SHA512 b86fa8ae049a7578e3e7fb7a6538a7ccf29140db419e58e100066af16f3d8931c69ddad092c2ec17bdd296956713fb8557975ec9ba547f46fcb8a26e89da1043
TLSH
T1FDB00296C5166293C25243B42AD599D97160DF39C683129292E02A66DC79A71C5263A0
MD5 SHA1 SHA512 TLSH

Submit Download

c5f9ad47-f88f-44df-a969-905dc1521423.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c5f9ad47-f88f-44df-a969-905dc1521423.tmp
Size 17KB
SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
MD5 1a74105b5ba9c7d42f2e74a8af064544
SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
TLSH
T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ae688723601d4cba5564c3fa9b340e1002eaeab52f95eeebefa5789faabc53d4
MD5 c772be92c1e550432a3c80d738d98de3
SHA1 25342f614058be39397437e2ef720c56239ebe4e
SHA512 c3bdbb199b990d3c8f421b1d462e5e3c3f9e51604cdd3194c51459d113175164d7626f533ba0af75ddbc0fcac2e66df4fe4540a2bff1618ef83cce77140f8f94
SSDEEP 1536:s3j5rhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:S9h3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1D59312BA5E2646E7957D4AC136AE7908CE12130D70AFA9CC726C638C61D41CD2B63F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 f1b8f8d2cf2bc8c820a47634cca291f882410fe64fc07a0274a19cb29790df9f
MD5 548415a1df6f5cddfeafd5b373e71c0c
SHA1 9d106938a367e86b447c1e1fca19bf9baff96b30
SHA512 e6a98a7d1d70adfd3a88eeb512beba4f7d5fa18b3fe607178f754c3ca4542111d0aad586caa631ab1b04967ce746ce71106ae8404383e804112b4417892dfb37
SSDEEP 1536:23nopAcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:MopA3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1369302BA9E2A05F785BE5A81769E7909CE12130E709FA9CC7158534C21D41CD2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 ca92a44dbf20c259574bd41d670eb12b8127c3504924fb9e10245649766e86ac
MD5 b03c75600547504f7d15368e65a3c90c
SHA1 6dfa69aab8c1c4037d4c679f4fdc9fde5387b172
SHA512 8bc6bfdcb93169d72cc430ec753b4a4a2c984e2551aa967fcbd21792c001fffdf679043bc506c8236d767775a90d8f3c499b163bf74d211627d0ced819097f56
SSDEEP 1536:93nMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YO:FM3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1AE9312BA9E1A46F795BA46D1729E790ACE12130E705FA9CC7298134C61C41CD2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1b5c76eab39bfa950dd31a7bab132fb589e11e045155e73f90d10cc2e2dd2487
MD5 cbfc01d03f8bb39f15479f74836b6afa
SHA1 4769dc0b1b7bbaa044b2b59249856224ca44f73d
SHA512 6f3bf087494c136a382296b423f7af8adc1dbdc8e91e7e7d26d43b523e1cc4d7fc5a690c85180e14b62a2cc19d999c24b3f3cd21cca1942aff7740c311075379
SSDEEP 1536:23nMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YO:MM3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1059312BA9E1A46F795BA46D1729E790ACE12130E705FA9CC72A8134C61C41CD2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4476-13-0x0000025B0C600000-0x0000025B0C655000-memory.dmp

Download