hxxp://rechnungfilenew[.]info/files/n/9955/

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://rechnungfilenew.info/files/n/9955/
Sample260719-ejezcabs9l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
388	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289070866788491"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe
5000	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4892	5000	chrome.exe	86
PID 5000 wrote to memory of 4220	5000	chrome.exe	87
PID 5000 wrote to memory of 4220	5000	chrome.exe	87
PID 5000 wrote to memory of 388	5000	chrome.exe	88
PID 5000 wrote to memory of 3824	5000	chrome.exe	89
PID 5000 wrote to memory of 3824	5000	chrome.exe	89
PID 5000 wrote to memory of 1516	5000	chrome.exe	91
PID 5000 wrote to memory of 3992	5000	chrome.exe	92
PID 5000 wrote to memory of 1516	5000	chrome.exe	91
PID 5000 wrote to memory of 3992	5000	chrome.exe	92
PID 5000 wrote to memory of 1608	5000	chrome.exe	93
PID 5000 wrote to memory of 1608	5000	chrome.exe	93
PID 5000 wrote to memory of 1016	5000	chrome.exe	94
PID 5000 wrote to memory of 1016	5000	chrome.exe	94
PID 5000 wrote to memory of 628	5000	chrome.exe	96
PID 5000 wrote to memory of 628	5000	chrome.exe	96
PID 5000 wrote to memory of 2144	5000	chrome.exe	97
PID 5000 wrote to memory of 4332	5000	chrome.exe	101
PID 5000 wrote to memory of 4332	5000	chrome.exe	101
PID 5000 wrote to memory of 5076	5000	chrome.exe	102
PID 5000 wrote to memory of 5076	5000	chrome.exe	102
PID 5000 wrote to memory of 1964	5000	chrome.exe	103
PID 5000 wrote to memory of 1964	5000	chrome.exe	103
PID 5000 wrote to memory of 1172	5000	chrome.exe	104
PID 5000 wrote to memory of 1172	5000	chrome.exe	104
PID 5000 wrote to memory of 2616	5000	chrome.exe	112
PID 5000 wrote to memory of 720	5000	chrome.exe	113
PID 5000 wrote to memory of 3244	5000	chrome.exe	114
PID 5000 wrote to memory of 3848	5000	chrome.exe	118
PID 5000 wrote to memory of 3848	5000	chrome.exe	118
PID 5000 wrote to memory of 1788	5000	chrome.exe	120
PID 5000 wrote to memory of 1788	5000	chrome.exe	120
PID 5000 wrote to memory of 2100	5000	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rechnungfilenew.info/files/n/9955/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffa4c0c728,0x7fffa4c0c734,0x7fffa4c0c740
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,16430520474715398200,7081133233601467218,262144 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,3176632087256065207,2082409778130104210,524288 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,7543587854019156641,1288201125399945595,524288 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,9633125270362718421,12147885156392062327,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,9468814561770167045,707469943767642961,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3936,i,18202207255352993366,943164410267478749,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,15154957986534431515,1003946019356538673,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3284,i,8806801262593848786,15222891805265201941,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,5585791131044104011,13374837724935325944,524288 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5520,i,6887487497989503878,10478612198028048645,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4676,i,16418863704308061364,11091814628081378818,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4912,i,8416319245540975581,2530002292066126396,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5680,i,4852048280727898004,7743315078440213253,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,727694141896184713,12220504071411753291,524288 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,6803124699459784196,11792558074406765190,524288 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,870832881958604386,16835895280847127853,524288 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4400,i,7763823388389151872,15629522062419247289,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4892,i,16221817585799994697,6220605347859937001,2097152 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4500,i,13426272576140531891,3148635311444754851,262144 --field-trial-handle=2024,i,6316049255172614262,15459892774754097252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dac2917bc40920024b9ae450d657b5282718cf2b70635f7c9bdd87e5a5e0c996
MD5 7de888c55ebb674e9fbf0e3245889073
SHA1 3f3c6c331a9cc273a2a4a84eadd2717e9c38e555
SHA512 860b74be0f464395881ee6836e14c64b2b545ded2f6930375e39d7f575ca5bd75868cb4cac5182722fbd6306e0728b06dda8f4c9604831681f9189f7ba611221
TLSH
T165E022AACA22AC3B1CFC1718A8658745EE4123572B819C5F373D911C8FB873A4686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 65a80b60c5c1dcee352e1bdf52c1cf1c91aea4d7eeeeea3baaf538055250dfc2
MD5 0b5957e056bdd231c36cfea719df435b
SHA1 6d8276885950a21ab5c953e8563a1adec099150f
SHA512 25c7d673fe5d2e2561fd9df7d521f946cdc37d71212535c051e20e6702ab68b11ecc3e8169d5cfd3b7a7d741b39d1e5657fbae9be2a0d6f4ba617a6ce900f459
TLSH
T13F419FF793B4857E8A1192F4DA15AE1FCE690624032C3CA6C9D46E1B43F2972D10178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 22aa2f1adf0256eb04dc2a4640b424961fdf187e8065b59399efb0591ed90fb7
MD5 d1e9e9caf7011867ba2089fcdd088b83
SHA1 61050f972d8289ed4e5c73d8e7150bacd3f51181
SHA512 0746fcc6cbaa839b4dd3c30b44d59f7d6375c134f815df281a0ab3536cb6d708df3f63450301adc7906e107b9d5fa9038a0ba19cbe629906244b02fad60ef7c2
SSDEEP 192:FRzjuet5iv7MF+pAPRp23lk9HHgVb+WNnU9PKik2Q8v3fay87MVyIsnAUge:FRzjLugoUX914iPKf2Q8vface
TLSH
T17E42B66FAE14697B6CCAC21AFD267763D7F4102221D42E94E7FC8A2C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fda9d445c55a540cf2f332da2677cfd912551441d8dc40fbfcae23d1af269b36
MD5 8abc39d1308fc2c71f813be993fa62a8
SHA1 1f059a86781c946e3c06ff3a3cc64bba6e01ee07
SHA512 bcc99f78cbc5517340991db956c18e3d091677cb06c56af52f63f55e8a3d8d344afaa22e2f910737fb63dd2b5e18d618462340c14669ccae7abd37412f1af4d5
SSDEEP 192:FRzjuet5Tv7MF+paPRpU3lk9HHgRb+WNnU9PIhk2Q8v3fay878VyIsnAUgE:FRzjLrgo2Xz1EiP32Q8vfakE
TLSH
T1E452A56BA914697B6CCAC619F916BB63E7F4103221D02E94E7FCCA2C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3f4f92e74e6bb2d365e0b0c5320ea48678a0d83f16a4193582d6ae086d135e58
MD5 dda83fc70ebcddcf1cbeb4a19753d855
SHA1 0a41b5d1c631e29bfd1f277e6bf21309d938c5c9
SHA512 acff924206ca20f470115f02360093e75544a02c59c75e3384112bc5ba45f3018f821e3952f4f0b50a9d19dd1d4b0ff172a0cebb6d3e360c255d3c4befe386ed
SSDEEP 192:FRzjuet5Nv7MF+pAPRp23lk9HHgRb+WNnU9PjOk2Q8v3fay87mVyIsnAUgE:FRzjLtgoUX91EiPH2Q8vfaqE
TLSH
T1A942A56FAD14697B6CCAC219F9267B63E7F4102221D42E94E7FCCA2C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6986b7404566beb59b2fe4739da33d1f49f6c8d406ea2bf128c45403ceae89c7
MD5 a41510ce7792e31e7533fb6ed5d5c857
SHA1 05aa448e40725ec311d9cfc2e3f70fefd25d0656
SHA512 68c3e68f14f938d7ae4853511e79c5d40195e2a902bf7182492fcc75ca83035953f9936c4b4920aec61e4b0561e34114b29b86d660365aa93f2405479bfbefe4
TLSH
T1D1B0120080016181C04202F021425898F1545F10960A1F0283F47923CC251A98014191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f5c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f5c.TMP
Size 96B
SHA256 18553ff0abb9858bf8e17871dd2fc8a0280cf94823a9a12cd36b5c32e4b7b5ae
MD5 c3d864e3c95340e5100df49088360444
SHA1 678b94f4fb55094794a0b6073ce3d8b76d92312f
SHA512 39733c24a99137824c5825166c9d809c09b8e45b4cf2d8ae6cbde0a32b9fdb667f75050bcf62c28eef863f25eea15ea4bc84ed66d828385f4583259e6abe2977
TLSH
T1C3B002D5D3026212C16203B16995AAD87160DF2DC6071212F3F81E67DC3A7724629360
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b5a3bbfdf128b9f51ee3dc10737ebef61b45f43ca62421e71a8052f0e7ab3518
MD5 d7d53c0701ef5942d47029ee68cb7846
SHA1 806e83324de743e01199228606fe817a7cf19061
SHA512 57fc2bc0e12acf8903d7203e8a2bbc00bcb22c9a8dce779030d8a78992fc2ab8434da370a404c902ea88a7335b4d9a1671ea4f49d26156e46b26be72c8adb8f8
SSDEEP 3072:JQGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Jbm7Rkm1tYpBeh2BAoM
TLSH
T1D1C3123B5D75A93758B9BB0EB08E0A1F1EF14AA7D930DA92C8D85B0423F97CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8e09d5a02f3ceffd7bfba48c2abb107f878ee35ccbc455eee3a859c44f36125c
MD5 62d7195852d7492c6321af2c6eb5e64d
SHA1 003e1143a89b67046766d7c9112e63216bec3e11
SHA512 4f7b49ae81826a7d27179b2babd2cdd82fdba180d49ee85639f7cbe9234a88abd8e8984f0a9ba72b5d766f71a198f9077aadd79d01a30c4c01076f9ff193463c
SSDEEP 3072:/dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/0m7Rkm1tYpBeh2BAoM
TLSH
T11EC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d3bdd7d8efd2ff6b1062baee8d39b50d090727ba1e4ad76103293d303fd64b96
MD5 bcb4d3860d4c5e10bb4e2a9fa0668ca2
SHA1 6379aa46d04ed065e39e6e81afbb14bb992dc5be
SHA512 3742754b52f23b9eef1f4363f2e5f9c5c6df4543b47d66b55ded833b344449d54f5067580f51f622ebf044f4660e07c6ae54d3bc2a25d00708c3dad995ef87bb
SSDEEP 3072:JxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Jgm7Rkm1tYpBeh2BAoM
TLSH
T13FC312275D75E93758B9BB1EB08E0B1F1EF14AA7C820DA91C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d47478a2b1710dac708e7b9b9723a1bfa17e87cf064bd08ad117fa1193fc8d2b
MD5 24c67ce8c7b5dcb7e021a5edccd57569
SHA1 1b4229c53eccd65b6fe46dc0e31324968699b336
SHA512 d9912a253a6e8a4e2319ef7567f1e0c82747b21e574cd38134e125d8f8805199eb02f906ebd9e09564163a8e85a5f19885fe2d39d59fc4683c35c7a21037a156
SSDEEP 3072:SxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Sgm7Rkm1tYpBeh2BAoM
TLSH
T1A3C312375D75E93758B9BB1EB08E0B1F1EF14AA7D820DA91C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download