hxxps://storage[.]googleapis[.]com/strow/strw-v1-cl1[.]html#?act=cl&pid=26502_md&uid=4&vid=1565127&ofid=484&lid=495&cid=468500

Resubmissions

05/08/2026, 03:07

260805-dmkhkace873

05/08/2026, 02:46

260805-c9f8zscd493

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/strow/strw-v1-cl1.html#?act=cl&pid=26502_md&uid=4&vid=1565127&ofid=484&lid=495&cid=468500
Sample260805-dmkhkace87

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303728754448930"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
2100	chrome.exe
2100	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4236	4208	chrome.exe	85
PID 4208 wrote to memory of 4144	4208	chrome.exe	86
PID 4208 wrote to memory of 3288	4208	chrome.exe	87
PID 4208 wrote to memory of 4144	4208	chrome.exe	86
PID 4208 wrote to memory of 4852	4208	chrome.exe	88
PID 4208 wrote to memory of 4852	4208	chrome.exe	88
PID 4208 wrote to memory of 828	4208	chrome.exe	90
PID 4208 wrote to memory of 828	4208	chrome.exe	90
PID 4208 wrote to memory of 4936	4208	chrome.exe	91
PID 4208 wrote to memory of 4936	4208	chrome.exe	91
PID 4208 wrote to memory of 2704	4208	chrome.exe	92
PID 4208 wrote to memory of 2704	4208	chrome.exe	92
PID 4208 wrote to memory of 1320	4208	chrome.exe	93
PID 4208 wrote to memory of 1320	4208	chrome.exe	93
PID 4208 wrote to memory of 4656	4208	chrome.exe	94
PID 4208 wrote to memory of 2628	4208	chrome.exe	99
PID 4208 wrote to memory of 2628	4208	chrome.exe	99
PID 4208 wrote to memory of 1100	4208	chrome.exe	107
PID 4208 wrote to memory of 1900	4208	chrome.exe	108
PID 4208 wrote to memory of 2100	4208	chrome.exe	109
PID 4208 wrote to memory of 2932	4208	chrome.exe	110
PID 4208 wrote to memory of 2932	4208	chrome.exe	110
PID 4208 wrote to memory of 1296	4208	chrome.exe	111
PID 4208 wrote to memory of 1296	4208	chrome.exe	111
PID 4208 wrote to memory of 2100	4208	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/strow/strw-v1-cl1.html#?act=cl&pid=26502_md&uid=4&vid=1565127&ofid=484&lid=495&cid=468500
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff84b0fc728,0x7ff84b0fc734,0x7ff84b0fc740
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,14224521218382363520,6841119690815041730,262144 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,18059207291294049427,9713291274800135185,524288 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,40150739128845074,9678564511037133435,524288 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,12694988971911121541,17205144318244679329,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,13762292986761696676,3123482818411902232,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,12343326787948929909,4030708487638953834,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3924,i,8713955344909548769,12415459562415215151,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,14119348925621582825,12483414009486823915,524288 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6116,i,15971706079160426483,2698219350574967701,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,13286021444189096084,14138804064242583743,524288 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,11286989456818520010,1014978479797555863,524288 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,2445487819946070949,9864641628418426027,524288 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3476,i,2309653227171969593,7063018331147026617,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4672,i,1444751563531181241,13046188582558520295,2097152 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6080,i,3905335351266930129,2556915289565842806,262144 --field-trial-handle=1836,i,6311310163512823424,11852279129724345682,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 02a79d5975ac86a74f9d3fde84ef358239ade99b011171baf64f578cbacdfdbd
MD5 6015490d0a71dfccacc8e6e3d940e768
SHA1 cac7215a10d843f3c86cfd345667e70f00117a33
SHA512 d0b884111d3d2ca237ae56af82889305b33d01c7cda7c35bb51109ed57bac4b8fae4f7b269b1863db6c5fc8ef101ed5313ac56c4dfd5619ecb5cf280f8714256
TLSH
T168E02BAAD935BC3719F9076C5044174AEB80135B3B40D96F3A3C8009CFB4B360145C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0f24cc5b4ea740d35e49a16f09f6fc3e2408ca3178beb27a9df4bc0a55755bc5
MD5 7fb3fea8d47db92ff8db7c5d277ac8d9
SHA1 d1d7259ca6c05baad828301646d52fcb5b6fdadf
SHA512 4317e46ecfc2ccb17658e67f914a51619ead4e3e050fd3eebdc82c5ebb3a3dfb230031eec21804ee1fde24a6759c212d797b9d25628997f24dffb01355958074
TLSH
T1A6B011A828E03282C3082B3028EB8822302A0C28BB02020A80E000E8A0A0AA28202882
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7d6119151c62860008d16de8ca0174d33dce6eb1e346efe9def9e45a6d75088a
MD5 78c437bda123f5baeba905f6c95a24b9
SHA1 fbb9ceba74ac691e2dfaf8dcfdbc10a573fda93b
SHA512 c7074bc320836e20987e608cf8bdcc15ddf58a8b7596bbf95781612cf10a56fdc89a7d6bc31d188fc0ec6d224a1fa7dc65511ab9c2e65318fc1b66d33d0bd512
TLSH
T1FB81CEB397E8CABDC91146F4DB107E1BCE690A14125C3CA689D4BF1B53E2572E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4d6391a469eb2ad9ce13e4021f578f98cf7055d4c427042668c231b1ec9c19af
MD5 533cc69f2b7983023324c5f1f20fa4a2
SHA1 e16a4716ee74633dd68a731d3247057362377455
SHA512 644f461033218bbdcb0872d233413a7e2d2bb224b181f5ba2f12839851f64faf1a0f711165b0066bdc17333562b519082f20931f33ca8b2323fedc142542c1ce
TLSH
T13E71ADB397E8CABDC9114AF4EB507E1BCE690A14025C3CA689D4BF1B53E2572E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 115ed0f1aceef01489c1427646e4073a5c030b3818908fdb902d1d316de35e43
MD5 88e8511aa1f36e9eb1b4af47dc4a4d8e
SHA1 eb6e4db9583bc585b6ebe5a7531cd7f56d47473d
SHA512 99adf209499f7d51ccc0addf016e4c974ad6740cf3f2f11bcc223b0af56cb80234bc7e2a740ceb12b94ebb380cce94f192b1f15a8f33236af9d9a06a4d5c8555
SSDEEP 192:/RowxQRxv78pAPRp26Ay9DHsb+WNnXJXCAIp2Igtx2h/a8HVyIsnAUge:/RowmRh4UXqy5w5XzO25tx29a2e
TLSH
T1B142D62EA914793B6CDBC229FD657753D3F6102225E42E94EAFC892C14EB5CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0aa47296996a444445b71e18acf1f3da089f5d810354e3c0e30c6defd7d8bded
MD5 0bf6da5724c22f2376d58fc0d06d20e8
SHA1 c52696e148a94fcc9717e150ba3d07d942c12efb
SHA512 0dbad91abd9309861a9e88d60b874e9d0dd3cf4accfdf16a59a3f9ac44885beaa979faad19cf2364a8da1871da0db931d4fb0fc0a4aa816dbb13dffc762381a7
SSDEEP 384:/RowmRCX4wXtIpy5Xhru5ZdexI6zO2Ltx29aRE:uwypA5X05Z8t32E+
TLSH
T11F52E82EA950393B6CDBD219F9157727E3F6202125E01EA4EBFC892C14EB6CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 deeb48630ab3b229f7670067ed56be6f710ac6ac82376bca86c778b634b0b19b
MD5 4544615b7009c1033019e74b27c80d68
SHA1 a01d2ff92ca8206eaa088575b8346eb8b7d643aa
SHA512 dbd3795ee2f0e1813be2e844cccccac660f41c33d5d23e390b31aa8f432cf79bf9435b810cc97d64a5164f2412f865d8fe15a3728188e2bb724200aaad2e518e
SSDEEP 384:/RowmRxX4UXtIpy5Xh8/5ZdXzO25tx29a2e:uwy+05X85Z5th2E7
TLSH
T1DA42E82EA954793B6CDBC219FD257757D3F6102225E42E90EAFC892C14DB6CC312711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4d864a2aa6463e19b61f242e875189673bbcb72fce150eaadb4b7e545b203ebc
MD5 681b43b92a3a3e5cf008dfd23f5b8892
SHA1 6fb42da2ea4c0fa03496687158bc728e8d7fcf1e
SHA512 c8dd7155463b1d8d416109f176b624e05440d737b3a44149b7202d1229c848ee8e85d3a2839dbd44711b2c2d938fbd1b2fd60163fd6d5b586e32c2ed5e38cf78
SSDEEP 384:/RowmRAX4UXtIpy5Xhru5ZdexI6zO2Ztx29aPE:uwyL05X05Z8tB2Es
TLSH
T1D952E92EA950793B6CDBD219F9257717E3F6202125E41EA4EAFC8D2C14EB6CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7ecfedb2ac1ab0d4388b672a588c4b146fad3ec302a63c651761b57adf52fa2f
MD5 e452bc53d3a6fbfc7f09f63d03b337b2
SHA1 b2d090a10fdff9869b8b67f736914b476939f191
SHA512 8406aa9721db868eb07d210217feaa467209bace6c04f818a2d3264109ab3c17b1fde5b578133df0710cfdf8747b02ad867a064ba369c9f670fa9a6279da9a69
SSDEEP 384:/RowmReX4UXtIpy5Xhru5ZdexI6zO2Ztx29aPE:uwy105X05Z8tB2Es
TLSH
T14952E92EA950793B6CDBD219F9257717E3F6202125E41EA0EAFC892C14EB6CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 46daeb6e3bc09f269411a79ac7fd6440dc71ae663622f8e298ed55cd931c2c8b
MD5 4da12e1207980be736107fd149684c88
SHA1 df565ce1ff82e5328df4f2958e4cd29cee78a6e6
SHA512 bcaf0879a85a2c2a2320df935defb0a3579b18ed694c050fd6a8816e9dd8cf14e1a2c3ee4b14e32bf7f5053ca567d883cd7e74477c02342d5851a1e5c71bc9ed
SSDEEP 3072:zfGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:zOm7Rkm1tYpBeh2BAoO
TLSH
T139C3123B5D65E8375DB9BB1AB04E0A1F1DF249A7C930DE42C8D46A0433FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a3dade18645c7a282d6af15cbd8057dfe58ac7f7ebad5909b712a68a34b70665
MD5 c7be2aa8ff25e4ccf84a99477b4de3dd
SHA1 dfc5a44995776a14b96315230f922770f65b26ec
SHA512 d1546eb85313a5c742cb0278a50a07b185fae984e9a3e21b629edb2ea9d87ec0cd5ad13f1ec1754c032ac49fbc5df774cb9d885545d590796d3b07dc7bf0c948
SSDEEP 3072:oxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:ogm7Rkm1tYpBeh2BAoO
TLSH
T163C3123B6D75E93759B9BB1AB04E0A1F1DF24DA6C930DE52C8C86B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d3fbb54777d41ba1ea101684cd4e696d203ff844f22e1d445fe4e6c1a31347cd
MD5 52e229299b9abde22d32c6d00242737b
SHA1 45f1b846c15accac4652fefc540e2bc02efb54d5
SHA512 a43ea176827c54aeb447398b514335a18e982cfb9a06a97bee67b054385e74cbf5e30ec94c9eb8b9914bfda464a343e16d2e8e0435bd847acdb2b0421760e3df
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:km7Rkm1tYpBeh2BAoO
TLSH
T1AFC3123B5D65E9375D79A71EB48E0B1E1EF249A6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a690f1b07536a46c3c7a1ff07920b3f146b3f296bde021f4e2cc6e0c0f50e0cc
MD5 a7bfab3550379ef7266cf61dbecd4f92
SHA1 4320a249779c0add6c6735d28dcfb0dd57f324ba
SHA512 5a385313fd62cd3a9d92a6f3620f4d799d86152dafad70defba0c14b8f41cd3b3abe0e4b6ac0003c2261574511bb837f22ef27888f29d63a81568bbd7c387585
SSDEEP 3072:yxGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:ygm7Rkm1tYpBeh2BAoO
TLSH
T120C3123B6D75E93759B9BB1AB04E0A1F1DF24DA6C930DE52C8D86B0423FA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download