f8f25be02b3f1a55a5a791a7246e3707595cce07cd4031e3b1221de1fa0ee49b

Analysis

user interaction
yes
max time kernel
65s
max time network
70s
platform
windows11-21h2_x64
resource
win11-20260513-it
resource tags

arch:x64arch:x86image:win11-20260513-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/dlls/lzo.net.dll
Size 10KB
Sample260620-m8v1vsfx2x
SHA256 f8f25be02b3f1a55a5a791a7246e3707595cce07cd4031e3b1221de1fa0ee49b
MD5 bd24f6c05fec63ad938ab954e1665ce8
SHA1 ef2854e8692772d13d28672ae504bdfea3d46f4b
SHA512 7ea05c1fe72cb7402c95bf882ad49256ed63c38fe6008c00527e5c8f5f29fa30d2e5b22d8d8fad18fa7eb43d56a729c475eda0a015125b460b8614554a22d116
SSDEEP 192:r5cuTq81aE7iQes5evVbzY3GmQ1C2O158ju5xaOWzrgo:yuxNe9bUWmHSuvwz5
TLSH
T10222B314EBECD217D96E0BBCA5F3160203B56C75AE23EF8F1948219A1C22F544963B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1848	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264279485460908"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2740	4676	chrome.exe	81
PID 4676 wrote to memory of 4012	4676	chrome.exe	82
PID 4676 wrote to memory of 4012	4676	chrome.exe	82
PID 4676 wrote to memory of 1848	4676	chrome.exe	83
PID 4676 wrote to memory of 2196	4676	chrome.exe	84
PID 4676 wrote to memory of 2196	4676	chrome.exe	84
PID 4676 wrote to memory of 3848	4676	chrome.exe	85
PID 4676 wrote to memory of 1436	4676	chrome.exe	86
PID 4676 wrote to memory of 3848	4676	chrome.exe	85
PID 4676 wrote to memory of 1436	4676	chrome.exe	86
PID 4676 wrote to memory of 4120	4676	chrome.exe	88
PID 4676 wrote to memory of 4120	4676	chrome.exe	88
PID 4676 wrote to memory of 832	4676	chrome.exe	90
PID 4676 wrote to memory of 832	4676	chrome.exe	90
PID 4676 wrote to memory of 4756	4676	chrome.exe	91
PID 4676 wrote to memory of 4756	4676	chrome.exe	91
PID 4676 wrote to memory of 3904	4676	chrome.exe	92
PID 4676 wrote to memory of 3904	4676	chrome.exe	92
PID 4676 wrote to memory of 4176	4676	chrome.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\dlls\lzo.net.dll,#1
1⤵
PID:5200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba416c728,0x7ffba416c734,0x7ffba416c740
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,2891506693392797510,17595439007264964835,262144 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,8118877999058825098,6774839947615897829,524288 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2300 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,9926243774031151176,6880929275194738454,524288 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,15457067086454496190,8803516155839233920,2097152 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17748865445472311030,11907371874964532656,2097152 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,1342084406374542008,15303184706166819670,2097152 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,6969717701178755256,18115695562978848658,2097152 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,13993132610709520469,4316666412347714766,524288 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,10777354153307768860,8680409901288182245,524288 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,12993686476455734792,1119479190844733595,524288 --field-trial-handle=1988,i,2618583593981880753,13967118133388346812,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e6977244651334516dfe3485340738b07568e556b23d1a9e067c543da1a99564
MD5 e27b7accf55d3a1cce2b1ced62156466
SHA1 1e374031d5121d13786f271dd2dd0760cce638ee
SHA512 faeed78b29aefdefd7a1dbc85a54357484ba499260d7931913b1a9d0fe0ce50c26876e81f9e9dfc9209bedf8f504ebc09cab4fd2e49f20bd3d77fc561c8794b8
TLSH
T1BAE02B6ACD21DC7748FD171C74514666F60013673B40595F3A3E820D8FB467E4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1ddf84cd407e18435d75e574144d25cee430d893a6568c8cd696384dcbe8c347
MD5 a2915a364d79e09d4c614a8b1b471704
SHA1 e5dc5baf1b388acf2d2924d6beafef328ba4f0d5
SHA512 1d7b287819660ff6d23599894b00b7f2f911223ead7fd0af854f953c813a17ee21f3ccc40432ba41856e8b73a25141071b9383d9cdbdac0783489b71ace0383a
SSDEEP 192:0RIXqEKRuY8zv7+pAPRp279uHsb+WNnP00eA2Wwva56o+VyIsnAUgtaJ:0RIXGRwL6UXkUwM0H2fav28
TLSH
T16842C92EBA15797BACDBC31AF9227753D7F5112231852E84E6FC8A2C18E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 bef46d5fcbba4ac62ee75bb2244faf8f37e6f2847f229566e039ea9f755a5824
MD5 e1757ff421651779a2a1e8da3309ff5a
SHA1 08c44e9b95749c3886df134f3afc3bec95567e57
SHA512 a677d4737e6ee473b0a25bc9e84c580a32b5a04b0a61a6485bac91167684fe352a7a41ce5b475097e179002b5a28a634485f920d7f48db2c1ff482c9e1107d13
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLALchjBsXODLi+ErU3ZgHf7Ep0/wCmn:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427pb
TLSH
T1357218676C4C9E370F94C6C8D8267B4FEDB5024B65D9C86493FA982903D4ACF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 93bc046cdf07ee97e6b27c9c1179712592ff385a3dd3e28e03cd705804484d2c
MD5 53c5050dbed6f975e5ed51ae062cfecf
SHA1 51a5760f11faef513ccd3d6c4a01bc6bf5745b70
SHA512 6ccdb659952e5379cfc9a2d10d7cf1040c774e56dec922c26a7fa36bde5b5fca812f6e01bd3eb450bf621c8bc0bc710e8e89300c8cc5e359800e7be97d1f746b
SSDEEP 6144:JVzWC9sbQsFar3Z006l6wCcmXKegIh6jh9JvexhT:CC9sbEH6swCHHgVUxd
TLSH
T1B834236B7D933EBA9CBD6EF2794333454BA287A66802F15E5185AF0609CFC79114FC20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8a2e32fa997d02d5687657bca79772a7fdaaed489ce5bdd3404fd7a0864647cd
MD5 c22326ecd0d78610082b55422cad1a81
SHA1 09cca25e30c8f0782d26cd87b7d1f0bb18af5e2d
SHA512 5479035a617576726aa11407f0a2f1f861640fe0c3078ff15b5d31c40e2467a1110191af17dac111261d4214cb573c9c51f78ba46d05573b9c35c5701c3f12a7
SSDEEP 3072:B8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:3wCcmXKegIh6jh9JvexhQ
TLSH
T1E9B3125A29273DA688BD6EB37453338286A353A26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download