hxxps://chamsaccess[.]com/admin/

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chamsaccess.com/admin/
Sample260804-r414jacd83

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2700	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303283547654683"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2516	chrome.exe
2516	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3796	2804	chrome.exe	88
PID 2804 wrote to memory of 3840	2804	chrome.exe	89
PID 2804 wrote to memory of 3840	2804	chrome.exe	89
PID 2804 wrote to memory of 2700	2804	chrome.exe	90
PID 2804 wrote to memory of 4208	2804	chrome.exe	92
PID 2804 wrote to memory of 4208	2804	chrome.exe	92
PID 2804 wrote to memory of 4468	2804	chrome.exe	93
PID 2804 wrote to memory of 2416	2804	chrome.exe	94
PID 2804 wrote to memory of 4468	2804	chrome.exe	93
PID 2804 wrote to memory of 2416	2804	chrome.exe	94
PID 2804 wrote to memory of 2600	2804	chrome.exe	95
PID 2804 wrote to memory of 2248	2804	chrome.exe	101
PID 2804 wrote to memory of 816	2804	chrome.exe	102
PID 2804 wrote to memory of 364	2804	chrome.exe	103
PID 2804 wrote to memory of 2304	2804	chrome.exe	104
PID 2804 wrote to memory of 2304	2804	chrome.exe	104
PID 2804 wrote to memory of 4288	2804	chrome.exe	111
PID 2804 wrote to memory of 4288	2804	chrome.exe	111
PID 2804 wrote to memory of 1312	2804	chrome.exe	112
PID 2804 wrote to memory of 1312	2804	chrome.exe	112
PID 2804 wrote to memory of 4844	2804	chrome.exe	113
PID 2804 wrote to memory of 4844	2804	chrome.exe	113
PID 2804 wrote to memory of 4320	2804	chrome.exe	115
PID 2804 wrote to memory of 4320	2804	chrome.exe	115
PID 2804 wrote to memory of 3660	2804	chrome.exe	116
PID 2804 wrote to memory of 3660	2804	chrome.exe	116
PID 2804 wrote to memory of 976	2804	chrome.exe	117
PID 2804 wrote to memory of 976	2804	chrome.exe	117
PID 2804 wrote to memory of 1768	2804	chrome.exe	119
PID 2804 wrote to memory of 1768	2804	chrome.exe	119
PID 2804 wrote to memory of 2516	2804	chrome.exe	120
PID 2804 wrote to memory of 4816	2804	chrome.exe	121
PID 2804 wrote to memory of 4816	2804	chrome.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chamsaccess.com/admin/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xb4,0x104,0x7ffacc17c728,0x7ffacc17c734,0x7ffacc17c740
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,16925017672755407370,16991589662614367671,262144 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,6499053340040612420,1309456514645231221,524288 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,7797369540193856491,8892840578995643291,524288 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13975740788579008187,16245079673627496156,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,1056062631435356805,17810152633065071483,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,7645334035442568221,2078332479625381387,524288 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,7573289924813878557,4550571175687349161,524288 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,7575667436803336256,1075498128089780227,524288 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,14512473658126569648,16310475909214906690,524288 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5424,i,1795637954005952297,8384378111708789698,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,12247450845990082358,2987437422353356837,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3260,i,13486167787372608481,4249618367083309692,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3440,i,2941076051341341037,14057267878633734593,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6132,i,11555324218045144230,2217590536127162656,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3316,i,9775012733260165460,10247596431247928176,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3512,i,4281572105367382059,4020570499539220597,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5412,i,16394834412898147286,3919452788041334167,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5884,i,4840992081475519121,7440973260925193375,262144 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6120,i,14381469231722272167,15650103047584964973,2097152 --field-trial-handle=1992,i,2842007544306392374,3027305089828329280,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b25279d8ccf512f4d643315cfd5b739259a98230fbb245fe76ac4ece57c6b44a
MD5 bb8ec36ce098ed0acf28e4ff3d996e53
SHA1 79af9f59c37b15942ce2f5fa4a0e89fefdb7c25f
SHA512 e24677b1f865e2cc0821aeddd8d48fcffce6ac79850fc5ec761124a561159dbdab4dff8e3ea4a27dff4e855be306495dac6f3053b95bbc3cb29550270e369b03
TLSH
T1CAE0E5EAD931A82718F9476860501B46E641135B3A40895F363D810DCFB4B760546C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 486KB
SHA256 c3dadb05b3db6df7598f4c3e0e6a44e8a34308a8733f312d0d66b0171ab2a50d
MD5 1f935868bfb8b10918ef07dfd0ad765f
SHA1 6419dd3bf50cfdeb8742522e979e9602ae4dc77d
SHA512 5c3a0196a99e3f6335e5343d7cc2fd2c9db4ef7278028da6b3297360b1504e176ab5cedcef24ca4165fc5897eaa54ad625c89718c515e4e31861855586f99e73
SSDEEP 12288:jN410W+BypBShfGrlWtSoZJzsnuGE/sxREYDih5gF:C+BypsmE1iu5ADos
TLSH
T15FB4F1524EC82FE9CF5C5D1C90FE161EA3B10B8A5463608EEB337D96AFAB64142171CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 03981b5115acabc518b596f81700f08e4ac1aadabc139f956a267f50f55dd6f6
MD5 e936b5b2918ea0e4cf33c6ee5279afe3
SHA1 f0927b94f81bd013be2b0062992e9955293001f3
SHA512 3c1ecfc54d6de8dcc04e4fc699f055e846d6e8509f53d9d13b22bca61c51386ba11033f2be4e9726b8746bf241142186294a278e2b73fe5d5c908fec756992ed
TLSH
T1B4419CF793F4957D861196E4EB116E1FCE790524032C386288D4AE2B53F2872E10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dc3c654fc4e686a82fad628cdf2e954ea3845cd2b4ab6d54724de496a968489a
MD5 c61fd65336fe1d01ec8c1a44709e014c
SHA1 dbcf10fbc274180bbaaabcde4687829d23d5048f
SHA512 baf61a38937e72a6938cfcfcc720c354238cff28ac5a3c72449f6f3f2859e886ede506c5396a71c0397a6363c7a5167bbec131c837d36fde3e2dc17b8fef89e9
SSDEEP 192:/RuTa5w58SO0Itl/bXhZRHv78pLPRp7nuj9DHsb+WNnuszVunSYesT4nakwLGVyN:/RXc2Lh49X45wxCe3ayE
TLSH
T1E752C72EA92469379CDBD329F9657F23D3F7106625901EA4EAFC892C00E79CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0008c394098c3e1eb120342c5c47f7dc9e6c07b9395dc2f0746f158f53b4c611
MD5 1493cd228dd817a8ebcaa38704135758
SHA1 c9bd4338638553f4e13103da34277eb6c5315f2c
SHA512 5de2606498881c2328ec93c94c5f3752bec7efd3e6fd6b2f500755ab1a60ea8c7f47ff1696a5aa6ba19e344a7c8a3552ef9c125d63c4b57fb53285074323ce42
SSDEEP 192:/RuTa5QlxbXhZRHv78pAPRp2nuj9DHsb+WNnuszVuJSq2sc4nakwNGVyIsnAUgE:/RXglh4UXj5wxW2yagE
TLSH
T13A42B66EB920693B5CDBD229FD257B53E3F6102675A11E90EAFC892C14D79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3095240c0de1768026883ff6b65f98afe90f2b905a598aba539240ccf2dacae5
MD5 978099a52def1feccd7e41dd6c25f910
SHA1 1bce41cc9f195de6d837215b67ac38d79151ca0f
SHA512 744bd10f55bad5683a6609e4b44ab8b8a4197f69803a7682dad6d213b36bed0e833a7cb5e560373b5c4e37a5687c97051c6c94e0ff9f3c6aae5983bccc9ec92f
SSDEEP 192:/RuTa5QlxbXhZyHv78pAPRp2nuF9DHsb+WNnuszVuJSq2sz4nakwhGVyIsnAUge:/RXgl+4UXF5wxW2Rake
TLSH
T1EB42C62EB920693B5CDBD229FD257B53E3F6102635A11E90EAFC892C14D79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 076c63a500d160305de6ee63df812e02f8150a3e1dc895bc6ed19c1572099d4e
MD5 2c07a2c4b92474f55df5fdc6f17ec86f
SHA1 bcf0feb22714cd9abb2b282a7e6b25fdb1fe47f5
SHA512 e7842f4199e8b3cdaf00c8d658b31574d012b14ed0f10902d9f357f1ebb37947584bbc4417ea905ad436c31968d0992c84d33725521b1d001013e465fa9b51ea
SSDEEP 192:/RuTa5w58SOkI1l/bXhZRHv78pAPRp2nuj9DHsb+WNnuszVunSYesW4nakwNGVyN:/RXcWLh4UXj5wxCecagE
TLSH
T18C52C72E692469379CDBD229FA657F23D3F7106625901EA4EAFC892C00E79DC3223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8fffe7260b3b8b4d4b11dc9489e08a49b3634a971f5b46d881b1feb69ed07497
MD5 9d71f12785b4d27c462c2308d05ba684
SHA1 0769fc22632730cd2609df01aa196170979168bb
SHA512 a438655069ebbb95ecfe33a81e88d3d94f5e2060773e50732498d9ac5515aa02a8bab5c7a0c5e67535c630195ef95c26d7fbc607363059134fbd9cf9f7589be7
SSDEEP 192:/RuTa5w58SO0Itl/bkhGHv78pLPRp7np69DHsb+WNnuszVOAE84nakwLGVyIsnAI:/RXc2ow49XQ5wxJEHayE
TLSH
T1D062C62EA9246A379CDBD329F9657F23D3F6106725901EA4EAFC892C04E79DC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 8c9fdaa30ad290501407293304834dd18f837373b20979fae50559c1136ca109
MD5 97c62c6df28099ddaeba976ddba61c27
SHA1 1aae687a928cb5543cc6ecf7e5afc91177e1fbab
SHA512 f0917b5b77aa4708c494b73ffbabe3d6e61196e4f55f8dbda9ee9c91218cccce93a878f43b32dcbcda26e685adc2ac9cb3678b3192a73a7dac422907252d4e1e
SSDEEP 3072:y7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:yim7Rkm1tYpBeh2BAoO
TLSH
T189C3023BAD75A8375DB9BB1AF04E0A1F1DF259A7C920DE42C8D45A0433EA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7b8f077984c349afd50f9b558eb90c94c4bdea7155590177c1cc8455c44be11a
MD5 2547b1210e7c1373a131543fc8e60d73
SHA1 ff6e08c0f84f33eaefed7b6fae6124a3b828bc3c
SHA512 7a1bd335a2038054a6a74455180a9bab1bec7151eb12166e782e090983cd8cd7371d7df18bab8a53a295f20027012e2a5319f34131bd7f5201db5d981e538733
SSDEEP 3072:oIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:ojm7Rkm1tYpBeh2BAoO
TLSH
T168C3123B6D75E93759B9BB1AB04E0A1F1DF24DA7C920DE52C8D86B0433EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b5c8536d8e9e9b9a89579303a1632182b3f916fae057aa5f2b8d011a25caf499
MD5 c21d271cfacee23947aeb1c4b1e0906a
SHA1 ea50ea00a4589d8de0968c215bbf483d6bef1bcd
SHA512 dd2fcddb444533eb8ede60a69bf405943f5764fb0c7a975afbc10f1920f205e5c36a17fa2e4efe8ec6812f8f36826e3eeac8cc21ab3c1123601ffa4b4391b1ba
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Em7Rkm1tYpBeh2BAoO
TLSH
T11EC3123B5D75E9375D79A71EB48E0B1E1EF249A6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4c0e27c06be2c64e8fdbdf8149871f39f434fe89f34992e5ad300654172bf400
MD5 039779305d239af6ab78657437b53eec
SHA1 a4a8383c18fa170d229f34d6a462bfaf23befdde
SHA512 6bc116e75b1094d5fba7c5f5268377fcc32e6f5b8eb7c68e913737f21f3f8a821c127c9cb722f4267441365500c02d195431145b553011b583e76c2ae491fd79
SSDEEP 3072:PIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Pjm7Rkm1tYpBeh2BAoO
TLSH
T190C3123BAD75E8375CB9BB1AB04E0A1F1DF25DA7C920DE52C8D85B0423EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 54878ebeab2687362428b55beed692fb06677e12dc8e5bb6969f3da3e2191aaa
MD5 d5e80af45e5053bc67c56888132fd0ea
SHA1 31482cf3e9a41fc17721ce03be7d51aca60a0162
SHA512 38f5b1a34bc34fb191c2a0aa1263288d4b97cd147ff2830c4fdf8d8b22a59c2c50885d405682bc2fe6b8c9ae61c7484830d5ebd1262c9c602bacc241e7be67c8
SSDEEP 3072:j7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:jim7Rkm1tYpBeh2BAoO
TLSH
T18EC3023BAD75A8375DB9BB1AF04E0A1F1DF259A7C920DE42C8D45A0433EA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ce6cbdcef86f7b8612e7c39c6cc80f1528798a7a7cebc0cf41c16bd5218f3370
MD5 d7bb82d56a1cdd34e68602f2a454bf43
SHA1 e065837ef5dcc299f0b39eb4c808dd04df8c20ac
SHA512 97e3936a733c5a461c1e639372cc48d6b5d743787e1da34dd6c3dd976d0c576058a230d0112dbdc4f2b8fbd014c8094c3f091cf0c289843fb153073002d209f6
SSDEEP 3072:lIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:ljm7Rkm1tYpBeh2BAoO
TLSH
T1B6C3123B6D75E93759B9BB1AB04E0A1F1DF24DA7C920DE52C8D86B0433EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download