hxxps://www[.]pvs-rechnung[.]de/pvs/rhein_ruhr/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.pvs-rechnung.de/pvs/rhein_ruhr/
Sample260916-teaamadj5x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5840	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340478797489756"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 4720	5812	chrome.exe	83
PID 5812 wrote to memory of 512	5812	chrome.exe	84
PID 5812 wrote to memory of 512	5812	chrome.exe	84
PID 5812 wrote to memory of 5840	5812	chrome.exe	85
PID 5812 wrote to memory of 4240	5812	chrome.exe	86
PID 5812 wrote to memory of 4240	5812	chrome.exe	86
PID 5812 wrote to memory of 5140	5812	chrome.exe	88
PID 5812 wrote to memory of 5140	5812	chrome.exe	88
PID 5812 wrote to memory of 4012	5812	chrome.exe	89
PID 5812 wrote to memory of 4012	5812	chrome.exe	89
PID 5812 wrote to memory of 5368	5812	chrome.exe	90
PID 5812 wrote to memory of 5368	5812	chrome.exe	90
PID 5812 wrote to memory of 752	5812	chrome.exe	91
PID 5812 wrote to memory of 5876	5812	chrome.exe	99
PID 5812 wrote to memory of 5876	5812	chrome.exe	99
PID 5812 wrote to memory of 2508	5812	chrome.exe	100
PID 5812 wrote to memory of 2508	5812	chrome.exe	100
PID 5812 wrote to memory of 1496	5812	chrome.exe	103
PID 5812 wrote to memory of 2308	5812	chrome.exe	104
PID 5812 wrote to memory of 4948	5812	chrome.exe	105
PID 5812 wrote to memory of 4484	5812	chrome.exe	106
PID 5812 wrote to memory of 4484	5812	chrome.exe	106
PID 5812 wrote to memory of 4712	5812	chrome.exe	107
PID 5812 wrote to memory of 4712	5812	chrome.exe	107
PID 5812 wrote to memory of 4812	5812	chrome.exe	108
PID 5812 wrote to memory of 4812	5812	chrome.exe	108
PID 5812 wrote to memory of 6028	5812	chrome.exe	109
PID 5812 wrote to memory of 6028	5812	chrome.exe	109
PID 5812 wrote to memory of 4252	5812	chrome.exe	110
PID 5812 wrote to memory of 4252	5812	chrome.exe	110
PID 5812 wrote to memory of 2012	5812	chrome.exe	111
PID 5812 wrote to memory of 2012	5812	chrome.exe	111
PID 5812 wrote to memory of 4700	5812	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.pvs-rechnung.de/pvs/rhein_ruhr/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9f760c728,0x7ff9f760c734,0x7ff9f760c740
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,7846312058882876559,861368444779755968,262144 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,14908251418699067244,10401991029965641116,524288 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,8255504000042888055,7276784571625907226,524288 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,9649578741521409255,6728174770633077677,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,2005439358132812792,12531548197438499029,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,10161423464523569186,598943489096486240,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,12002567249799501571,9449781644246323061,524288 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5752,i,4745654464742481952,10363441320139818653,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4640,i,2387212704892203875,3869332303566550032,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,10451625152545198921,7859254149439313665,524288 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3184,i,11026829859792905922,12185634659163774578,524288 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3968,i,15326681692714302601,10957877992438139103,524288 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4580,i,4345396929657617052,2814395754713170487,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4572,i,6446126611590335241,4894186098665605025,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3420,i,10339515496046519360,7842443834590820586,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5676,i,14296818203019570284,7888752565164117936,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5632,i,8187860379199557108,15894451798447852629,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6264,i,17439928540238328254,7117870958747598139,2097152 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5988,i,5964556897279121029,4113160906845827853,262144 --field-trial-handle=2024,i,5215227150642709862,8396660906924877213,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a8b4a2dd309e6f22cacb4523f7af0fb1635392bed62a0d54ebefed1e9c2dbcc5
MD5 85193ffe27e36605dd16472bde162b3c
SHA1 ff9f6a53bf83ee787cbc0218b2fee5908c9265d8
SHA512 173c5dfa8c3ceabb933e8de6e9b052a83dd31529fc00c86589db0638115076c1a8ebbd90ff90a163e9a321e0f215943271e0353cbf5c26f6df6bdfcd2fdc92b8
TLSH
T13EE02BB6C921F83B19FD1B2D50108B87EB4513573681841F3A3D824DCFB8A3646CA81C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 29KB
SHA256 abdff2324b96749b550fcfdef7ab7f9ad3632f599775f8deebf8cf49fc7d00ac
MD5 b92627d5485a975cf1e0c6d64a7519bd
SHA1 8ee15d195bc78fd96ac67479cfdf622a8fc4f7d1
SHA512 d7e5813341d89406f5ca2a5eaef8843b0b081814cebba04291cc749928d34046c1cdfcc75f9b3a46e74d6a6380da4b51f41cb471dba202cd0fb497e39b4cf283
SSDEEP 768:qQehpOEprV18LKAgZb8dv7n0RjUCoJ9zA6CRqqUo1N:qQehptprV7AT7nyYCWqVz
TLSH
T1C2D2E1E188F6836D390AC6316E57C5D083776AD7152ABBF37A016D1D3EC8A2E01E41DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 93f7b3787763f0bdbdf860c86619fac6f17bba797937a63e7078399da6f592db
MD5 5dd66a4eb9255a32e55f8b1f2be0631a
SHA1 ddf71c02e668f1beca4efe6c70144dace880d420
SHA512 a853513dd2933886e4182f7f756273313bdb393d16643b27d8635fcbb84693b1732375c70ea4ddcf7497ee1aaa154ba3e2faf319d7c4e52f3f1b121997ca8a6f
TLSH
T1E8C092209680110ADB7071F2FAE341983E301DAC99632BB1C0F75AAAA4807B184A2082
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 1f4435aa28d142fdd493a5da8fbbdfe2e0186c3b8049034833508eb73a4659c2
MD5 ef1baeff560b4f471d6306e502d0354c
SHA1 9921efc7b4c780c20e939c49af909f3b04530ad6
SHA512 a64b296a92b76c0c7c06b33e8ecc8978bf88309115720d2e65e5be0531d9721276e9d67b443ec2c8c152219bd091e390360b7037e996c2673dd8f23da9fa0ffc
TLSH
T1F2C09270DA440116DB6532F3EFF3029C36302DBC9A676BB1C0F35FA5A9927B28102040
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ee641a255e9d11151d8ad2a79cd33481557012ea62257a492eda3deff9544fa7
MD5 3e3cd6db66266c03f61e9ded2e2e1d63
SHA1 1c99b11e1e37fa2ec0158b7ab5b24779d3ad5b72
SHA512 bf3b9b7183f19ec95799f41647f1ea29f88dbee7d72c766a4bbb275fd2c854686dbd844dc4d2c4d6b9973c94c72ddc154250bfb9966ae7952364ef9c99fd1268
TLSH
T16D518EF3C3E88A7EC90156F4A7156E1BCD290914521D3C56C8E4AF5FA3E29B1D35058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 08bc0e9f60ce2b6128c15c8bd039ef94de711e68199ef33e572d17c301782dd0
MD5 bb63b8bbe0ee9077cf48de1ab9a091ad
SHA1 573fd10bf006291e76a3191e4aa3750987d2a523
SHA512 380fb7b792cff0da1dde2dd6687eb8a0cfda0ce09702fb2e28784df8c0b6146fdbb6c405383d566febc1b05ac812a09aefd50c8a3fcf1809b784652a7114d129
SSDEEP 192:hRV09O2cvvk1Uwv7GpAPRp21E96Hsb+WNnGFUlb2ZdeLVyIsnAUg54:hRV092vk1UsCUXlsw6q2W54
TLSH
T10442B32EBE10793B4CDBD229FA617B67D3F6102624952E40E6FC8A3D11E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7c90a616bed40dc7898812376a606918fea800b00e7e24d19b8586de37a65076
MD5 2a5aa477793e99dc3bb9cab23b5c1dc0
SHA1 3c2a10bd49ff563462077dbb8b3bdecb3adbe236
SHA512 18bdda814f39b54f07349094a256e3d2e49c8bc589d19752f3efef79c44758c7fb432b90c441d6b023fb7ef04847c00208d2c8e11eecf265c578644a32130a6c
SSDEEP 192:hRV09O2cvvkowv7Gp8PRpi1c96Hsb+WNnGFUeE6DdejVyIsnAUgvU:hRV092vkosC8Xtsw6O6ivU
TLSH
T16242A32EBD10697B5CDBD22DFA617B67D3F5102624902E44EAFC8A3D11E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 079b084f056351b553ea92befcf9da1ea06948efe339a19678914eb889322589
MD5 727c0d08a61820ded641c07d0ed29036
SHA1 3f0f92b24e70a19478c3decee7ef668efd4fdc38
SHA512 84c725f22ce1cdf608afe824d010b40c0588ce7fb89660229c5417b6239a65066e086e3f1d0481e4e39a41f11d4b4a61f6ad9c320ed0e2cbb2a6d32bd7ca1e0f
SSDEEP 192:hRV09O2cvvkqwv7Gp8PRpi1c96Hsb+WNnGFUH1smdejVyIsnAUgvj:hRV092vkqsC8Xtsw6GsVvj
TLSH
T10542A22EBD10797B5CDBD229FA617B63D3F5102625902E84EAFC8A3D11E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2a4786568679a1fe922325b84ecae7cb5a505a8a33012b784d8c26768fd8eb34
MD5 803e10cea3198a14359e00bb47d397a3
SHA1 2976488d172ef08ddda0d4d29004582becbfc3d8
SHA512 6bafb5790633cc6d6f5c6b425a2a901e3278304ab8d69845ec385b2797464862f9fb1aae8a489d33af2d3984c0d4bc08bfeea7d836ec54874bb75058c82f1bf4
TLSH
T1DFB022E2C0022303C0C303F02880A0C8B030EF2AC203022282E00A22CCA02302830020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bc31941c55945fea92d9251d11fb5540225b7187ccb0a406ef624518bc00c1cb
MD5 4940180732b9ecf06c969e5ca249c613
SHA1 c281fec70088ae267ff0a47e26a518456487d57b
SHA512 2afd36082c3014d02559f839f7c55b7d7345b3fe8f93404abf938b8f95fac527f9c51cc5c16bc82554b9b6b5036d0eb57099d46453bf222b1ed952903678cbfb
TLSH
T171B01215C1412301C40103F02551905432A08F38D112139589E02D62C8311F04017249
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 16f397d16e3caf69ed03ee0679e3b45e8b17a08c5c626802411d12bd1aebcc1f
MD5 75e3e1833c6179f9aea3e85aa44e2dfb
SHA1 2825cbcfdd225778a404febf6ea52cc0bae9b66b
SHA512 561801ead0af88f88ca05c2bcff0b0e3e093a1979c3e8064f00852a496209065abdae029b6ab8d40d3f1ac1c85b5b0a581e4366422ae80bf05347d5fc42a8857
SSDEEP 3072:T7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:T7+hFD+7t56OD9ZfSApprB
TLSH
T174D31232AA94D87BC9FD6141A187A300CE75ACEE45DE3A09444A5FCED09F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 c53ace0c7810134fd4cb53900227655f6100cb807ecd9416a13e1a27e62ebba4
MD5 af10b1b67667c400a7025c0f86ef0c00
SHA1 85d0145c5b2023278599d375c135437092535730
SHA512 50be2b890e35e157fafb3ae45b380049e31d919217df81bf162029fcc8a6fa58ca410627ddf364795199719f2f8d34680477fab334003a8155980feb0a43cd3c
SSDEEP 3072:Ta+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Ta+hFD+7t56OD9ZfSApprB
TLSH
T1BED31232AA94D87B89FD6141B187A300CE75ACEE45DE3A09444A5FCE909F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 2caf11528218020575cd1c109ce32459d92c9370a345b13c68ef39e44a26c058
MD5 2678c3c0e3adfba008f87e376fa9901f
SHA1 4cd2bf0fb4809e2258d0cac02bd812542a0809bb
SHA512 6874192a6fa206cde920ac859ffa2e956033f828ae68a30a4e36ba6c0ef988f3d05378be13465832c051fb7ad8820bc04eb124fc9ed49947fc7e860aff5b7d07
SSDEEP 3072:Tj+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Tj+hFD+7t56OD9ZfSApprB
TLSH
T137D31232AA95D87BC9FD6141A187A300CE75ACEE45DE3A09444A5FCED09F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 de794413308e9457151ea0edfc7d17da0f3a90e28f27886600c4ad686931a4d3
MD5 956ae102fcd43d85d2d22a53e44c61a5
SHA1 69ce356a7daaace889f7d52e92edcb6a96bffd6b
SHA512 1df4e11177b7984e27d4681274842fd1625ba837fdcc009fe12b3f242e5ba17ed5efc2914d0335d77c5c6e741858e67b61fcc5da0d03445c8decec09ca284ad1
SSDEEP 3072:Tmbr+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Tur+hFD+7t56OD9ZfSApprB
TLSH
T104D30232AA959C77C9FC7541A147A304CE766CED85DE3A09844A9F8E909F94C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b001c948-017d-49eb-8d38-f87dc22111eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b001c948-017d-49eb-8d38-f87dc22111eb.tmp
Size 130KB
SHA256 d014369ca91e8587ee118e4f7438db31e71571f174890a1a151f98e36e3cfcc2
MD5 8fd9edf632008d7f22e6dc0647cddeda
SHA1 f3585c9c90b3f48157605db41353c79f83d2a77c
SHA512 f4b7fa9375d26f9171657d1171facd7ea28679c46d9fa5a709c7009c8f8d00925ab391cba235d351111412c09bcb6f6ee1425c42ee7c0e7d77275301d41f621c
SSDEEP 3072:y0+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:y0+hFD+7t56OD9ZfSApprB
TLSH
T19BD31232AA91D8BBC9BC6141B157A300CE766CED45DE3A09444A5FCEE09F94C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download