hxxps://web[.]archive[.]org/web/20260928125631/https[:]/tribunaledicesena[.]it/

Analysis

user interaction
yes
max time kernel
899s
max time network
886s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://web.archive.org/web/20260928125631/https:/tribunaledicesena.it/
Sample260928-w8l8dsce25

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2216	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 2708	5860	chrome.exe	89
PID 5860 wrote to memory of 2216	5860	chrome.exe	91
PID 5860 wrote to memory of 2780	5860	chrome.exe	94
PID 5860 wrote to memory of 2780	5860	chrome.exe	94
PID 5860 wrote to memory of 1248	5860	chrome.exe	92
PID 5860 wrote to memory of 1248	5860	chrome.exe	92
PID 5860 wrote to memory of 4820	5860	chrome.exe	95
PID 5860 wrote to memory of 1096	5860	chrome.exe	96
PID 5860 wrote to memory of 4820	5860	chrome.exe	95
PID 5860 wrote to memory of 1096	5860	chrome.exe	96
PID 5860 wrote to memory of 5600	5860	chrome.exe	97
PID 5860 wrote to memory of 4340	5860	chrome.exe	99
PID 5860 wrote to memory of 1700	5860	chrome.exe	100
PID 5860 wrote to memory of 4340	5860	chrome.exe	99
PID 5860 wrote to memory of 1700	5860	chrome.exe	100
PID 5860 wrote to memory of 1764	5860	chrome.exe	101
PID 5860 wrote to memory of 1764	5860	chrome.exe	101
PID 5860 wrote to memory of 2220	5860	chrome.exe	105
PID 5860 wrote to memory of 4324	5860	chrome.exe	104
PID 5860 wrote to memory of 2220	5860	chrome.exe	105
PID 5860 wrote to memory of 4324	5860	chrome.exe	104
PID 5860 wrote to memory of 4240	5860	chrome.exe	106
PID 5860 wrote to memory of 4240	5860	chrome.exe	106
PID 5860 wrote to memory of 5068	5860	chrome.exe	107
PID 5860 wrote to memory of 5068	5860	chrome.exe	107
PID 5860 wrote to memory of 4460	5860	chrome.exe	108
PID 5860 wrote to memory of 4460	5860	chrome.exe	108
PID 5860 wrote to memory of 5412	5860	chrome.exe	109
PID 5860 wrote to memory of 5412	5860	chrome.exe	109
PID 5860 wrote to memory of 1552	5860	chrome.exe	110
PID 5860 wrote to memory of 1552	5860	chrome.exe	110
PID 5860 wrote to memory of 3140	5860	chrome.exe	111
PID 5860 wrote to memory of 3140	5860	chrome.exe	111
PID 5860 wrote to memory of 5648	5860	chrome.exe	113
PID 5860 wrote to memory of 5476	5860	chrome.exe	114
PID 5860 wrote to memory of 840	5860	chrome.exe	115
PID 5860 wrote to memory of 2648	5860	chrome.exe	116
PID 5860 wrote to memory of 2648	5860	chrome.exe	116
PID 5860 wrote to memory of 3368	5860	chrome.exe	117
PID 5860 wrote to memory of 3368	5860	chrome.exe	117
PID 5860 wrote to memory of 4128	5860	chrome.exe	118
PID 5860 wrote to memory of 5980	5860	chrome.exe	119
PID 5860 wrote to memory of 5980	5860	chrome.exe	119
PID 5860 wrote to memory of 840	5860	chrome.exe	120
PID 5860 wrote to memory of 840	5860	chrome.exe	120
PID 5860 wrote to memory of 4324	5860	chrome.exe	127
PID 5860 wrote to memory of 4324	5860	chrome.exe	127

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://web.archive.org/web/20260928125631/https:/tribunaledicesena.it/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff95b5bc728,0x7ff95b5bc734,0x7ff95b5bc740
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,824962904231199176,6327200998485134864,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10079226229181968309,8551836632306181723,262144 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,1561926058313490287,3899335220850505046,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,5921653407269999136,18098416399843286037,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,5357362655246588717,2259956079619221041,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,13507039506045220195,13177103382967496131,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5432,i,16689253426783613481,5004534976653130266,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5444,i,8625204225262866741,5551043697418568475,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,2215913601221678589,18416254749220512421,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5932,i,15442916567188260986,12251623817863943054,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6036,i,12132575834954361273,14780421721711725529,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5348,i,1155966870399629672,13256559223815046278,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5500,i,11818034585561861165,16647211147270220659,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5900,i,18203432924155952207,12645681250769430225,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3408,i,8063806737019129506,949124329724559474,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3284,i,17025271127104877033,11429824331778901298,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3392,i,6242229058805415740,12924440393927761718,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,3208890483549486684,13369541539302780147,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,13554946920000726311,3845718626911630302,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,12300459226869010268,5669499091496039058,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5908,i,6440314208444284986,3301213938256946932,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5768,i,12272428714947971877,18327397311328957567,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5452,i,8052313918856179179,5580308306707375314,262144 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6236,i,5797103655767235882,4350072390096939972,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,7460604415707163770,913833960743694264,524288 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3908,i,5077663259722665457,11181582823331348527,2097152 --field-trial-handle=1904,i,14577673557127606301,8623811763735897776,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4388

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16937772d48322a30ca0e9097f2244b292585faabc146d0cba9beed4bf4de889
MD5 a1b079d361865768ba19f9d9f8b2b919
SHA1 c970a2af022c1d8ca7fa9a347d1df222cf3b4567
SHA512 7febd2cd2f3bd806506668ca8debf95337918f76fc3830ee93bd8b190f1300f1165d27b376e7cf99d7ae19cd513dc69d788cbf20346a22bcd3f4621b3f7a4354
TLSH
T15A417CB7C3D8863D890156F8AB256F1FCE690E14531D3C56C8D8AE5F57E28B1D21068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00fed69fc6cc0720b6bc3bc096193211476b7a627a4ce8d6fe1bf90fb92a9aca
MD5 2e3f3458f33a403fe45e71efb0b5778f
SHA1 43b3e5d9c2b0715f7c6d4148a7fc818acca3870b
SHA512 d0609d07d414997af6f6c458ec19ff6246ef474ffbcbe0e914ce6cd2b44a471371ac0388a3f8937992a5310f485ed63647189b96ffde1e6832abee6ab7acdd7c
TLSH
T1A1418FB7C3D4863D891156F4A7156F1FCE690E14531D3C56C8D8AE5F57E28B1D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9f4a9f1a343ad67efd367d9243192439a591841b45604a51ec1eccfa02d9d5a0
MD5 1d97aa19e9963635d08b116879ecb674
SHA1 06f9007c67f61d256e9aa5ff488b9e8a9d840b1e
SHA512 a4f53f666b1d3933ed5e489bc87350fec497645d98c81c94a5a98cddfcde4c7bb3c37d871ec164c68240beb9d7b1825831b66b1176e15f68cb206e1b2c5f55ca
TLSH
T172417BB7C3D8863D891156F8AB256F1FCE690A14532D3C56C8D8AE5F57E28B1D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 70b757e046ff896b57c0852ed5da776d7a8c905c4638e3a6b1dcd1fe9f74ef4f
MD5 b97396690ce2d676c7b01dc3cc8f20d0
SHA1 e69d5ba96ca66a99ca47f6adf885a749ea93db36
SHA512 f56ae00ea2305f30b04f53f756b7d1586ad5eb8989fb6d57a9f0de14563d54b5cbf6989e0577f92efe3d5e5c957a9f14fc1bc915dc0192c229232b1d6d5ce29c
TLSH
T1F4E0205F8F69B57B107904772E04F44566B2983043436CD0CD66435CF0875E30F05897
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f96036e1517969be8a285f4f6bc1b658bb4ae7298c8a27334c588b9406540efc
MD5 049c2feccde6b4418b4f316b76276ea6
SHA1 6ceac660b0bce7c2d264969a5674c0f1f9bb9578
SHA512 0533d8576081169e6bff95054b94c7f0c89b69485f0b34c7f6516a2d75dec89560bf065bff2dc7ac5348bb14efa01680ec4a7f243527ab783c7984c8606f31ad
SSDEEP 192:SRV13n1v7E/vAPRp2V97Hsb+WNnnGPVIew52dyVyIsnAUge:SRV1XFq6XyVwGP624e
TLSH
T15D32A42EAE10757B6CDAD219FA797B93D3F5102121952F84EAFC893C25E79DC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af728d6426dc85e5dad3847f55d782f68e6e5b07f981ced1233582443f847e5e
MD5 0818e47891f96d580109889716b955c2
SHA1 e0125fec5aff672d698f313f2f0aa6d44db7bdd8
SHA512 eba4ffc3c699d26096d0dfc60dfabc1cdc071936b75b389a0b640389962f5acb918db166ca518bbea44c5182acb6d673dfd3b1b7089dc43b3b23ae68758dc655
SSDEEP 192:SRV13n1v7E/vCPRpIhf97Hsb+WNnnGPt9Iew52dyVyIsnAUgE:SRV1XFqcXcVwGPty2QE
TLSH
T1B942B52EAE10757B6CDBD219FA657B93D3F5102120952F84EAFC893C25E7ADD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8ecec3486058d289197fbeb84d0c1ca1eb76d36f8a5c15dbdca36446173499c8
MD5 1112b8b6b24653073bb47f28ff80cdb5
SHA1 cc1d6533379aa8cfeefe7049b02cb11f5401a0f3
SHA512 a973fcd153230d12f42cdae4fa8e5f984c00c7f30787b691c7077a38032d9c12d1f98439454f02d931adc956778ed5698f41c2f7ef5cdedeffe784fed491dd77
SSDEEP 192:eqB4K6uU7KxkXqK4I40pUZNCgVLHrKHfFKslEEEmXzKD/lc+ErUkKN98+LIsG/hA:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmQ
TLSH
T1F632D91B988D6A7F4FD8D54DCC53AB8B6DF4019672680D2452FB9C0803A578A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5801d2a37d0006be30d7c7376a834672da2ee3f81354738640e70cc309cc05a8
MD5 28b8f49444878d177a00de30fd05ce1c
SHA1 459bf1574d618055c30b3d1af25d95fc28813219
SHA512 048336a2793eceaae1264b69546a46d6eb3890200fd3710cf6356d8c36895187df140c1fa66ae192f78814a7b8d26cf27c5866089f7fec33455b3cd9b8eb3bd4
SSDEEP 96:eIVbJod+pK242KafJf1Oo54Sl8h4otop5mzDhB6OGyv+mYXcQccRNC39ISyVN6cw:ZVtobt8OZiU2CXi0YXcQccuCAcRi
TLSH
T12DC1F8B0E46D58B718F6A494B1032E47DEF9215B6565BE98EDEE5E1810D70FC1383223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5bb5ecdfd591dae0f4bef031ad0dc3cb3014cf24e1c2111c2247a4e3119ff650
MD5 326115c36f92e9ec9c4f9f9e9ab57d32
SHA1 4d33d657df52452fb1f082888b3ccbc452175e34
SHA512 1c101053fb8633c708a786ad75bbabced668e8eb09e2967a724aa39c35b3cd68268197a145ab25abd6a760708c759ff08bdaf55ff4cf2316483bf9066575f4a1
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok5msDhB6qpGyv+7hhc0bZv4a:ZlC0bt8OI8lDUDfXPUhhhc0bV
TLSH
T1CFA12870E96C89B728B6C080B6122F43EFB922676562DFC4DCDD5A1D20EB1F80382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 504a9db88dc739484a2d9e5fb4e10f702941be00a5901a415cda51799d68f9d3
MD5 7bbc1c52e9b83585ac477f11530f9b8d
SHA1 e2d65a0a3294118d7eec6073347d315831442b6b
SHA512 025c361e1a5a50f45b3b1295e2d001cb23d341a79d30454cc6f4559ca3f9fd22e675c613c18243377f198626eac58c5918d956fa628da96cc5a71b0ee93c03ce
SSDEEP 96:eIVbJ0d+pK242KafJf1Oo54Sl8h4otop5mzDhB6OGyv+mYXcQccRNC39ISyVN6cw:ZVt0bt8OZiU2CXi0YXcQccuCAcRi
TLSH
T162C1F7B0A86D58B718F6A490B1032E47DEF9215B6565BE98EDEA5E1810D74FC1383223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6c7d95c0de6decf1fecd77ee0aee9c526480f6b5cf50dd430b83289e8e72f605
MD5 d3686d7bb816c8aaae0f43c1a0cf02ae
SHA1 0b5d58c55133ca19cec9fe5d40ce1cfab0d3983a
SHA512 96fe0279e0e5432216c1b2268832515946a8b04d717d88bc887e580928ac75ab9167716e7a4e0cf9a6cc3ccc400b7a009b92cd595782054ac1c06a2ab4d60eee
SSDEEP 96:eIVC0d+pK242KafJf1Oo54Sl8h4otop5mzDhB6OGyv+msQxwzmRFVX2Qc90j9I6v:ZVC0bt8OZiU2CXi0HxbRPX2Qc9UJv
TLSH
T16AC119B0B87C68B324F6A554B1032E57CFF4225B5661DF94EDEA4F2820D71F82382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2d20bb0ffd354bcb501cd80262432b4c3203b11ac764fe6df8c29c92f80297a8
MD5 b2a21fa19dbe8e0f2d70f4f25c1ccaab
SHA1 b2800176b15bb5460c5380041a65c3740c2a737f
SHA512 c0dd2fc084c770381130bf7c9e06de63acb23b7ff448c4c34478e7d0b8aa3c7e16b5c2289928ffc691d13bfee508b75a49743d6e5b78dac24899bf42a8c48705
SSDEEP 96:eIVbJ0d+pK242KafJf1Oo54Sl8h4otop5mzDhB6OGyv+msQxwzmRFVX2Qc90j9I0:ZVt0bt8OZiU2CXi0HxbRPX2Qc9UJv
TLSH
T106C118B0A87C68B364F6A550B1022E57CFF4225B56619F94EDEA4F2820D71FC2382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download