hxxps://www[.]catalog[.]update[.]microsoft[.]com/Search[.]aspx?q=0f7c13ba-e653-4d4d-bb6b-b3581b2df8ee

Analysis

max time kernel
900s
max time network
895s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.catalog.update.microsoft.com/Search.aspx?q=0f7c13ba-e653-4d4d-bb6b-b3581b2df8ee
Sample261011-2brphaaa97

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
916	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1292	2680	chrome.exe	89
PID 2680 wrote to memory of 4268	2680	chrome.exe	90
PID 2680 wrote to memory of 916	2680	chrome.exe	92
PID 2680 wrote to memory of 4268	2680	chrome.exe	90
PID 2680 wrote to memory of 768	2680	chrome.exe	93
PID 2680 wrote to memory of 768	2680	chrome.exe	93
PID 2680 wrote to memory of 5008	2680	chrome.exe	94
PID 2680 wrote to memory of 2756	2680	chrome.exe	95
PID 2680 wrote to memory of 5008	2680	chrome.exe	94
PID 2680 wrote to memory of 2756	2680	chrome.exe	95
PID 2680 wrote to memory of 4252	2680	chrome.exe	96
PID 2680 wrote to memory of 3376	2680	chrome.exe	98
PID 2680 wrote to memory of 5456	2680	chrome.exe	99
PID 2680 wrote to memory of 3376	2680	chrome.exe	98
PID 2680 wrote to memory of 5456	2680	chrome.exe	99
PID 2680 wrote to memory of 4736	2680	chrome.exe	100
PID 2680 wrote to memory of 4736	2680	chrome.exe	100
PID 2680 wrote to memory of 5360	2680	chrome.exe	101
PID 2680 wrote to memory of 5360	2680	chrome.exe	101
PID 2680 wrote to memory of 1300	2680	chrome.exe	102
PID 2680 wrote to memory of 1300	2680	chrome.exe	102
PID 2680 wrote to memory of 2304	2680	chrome.exe	104
PID 2680 wrote to memory of 2304	2680	chrome.exe	104
PID 2680 wrote to memory of 2452	2680	chrome.exe	106
PID 2680 wrote to memory of 2452	2680	chrome.exe	106
PID 2680 wrote to memory of 1832	2680	chrome.exe	107
PID 2680 wrote to memory of 1832	2680	chrome.exe	107
PID 2680 wrote to memory of 2700	2680	chrome.exe	109
PID 2680 wrote to memory of 472	2680	chrome.exe	110
PID 2680 wrote to memory of 2496	2680	chrome.exe	111
PID 2680 wrote to memory of 3260	2680	chrome.exe	112
PID 2680 wrote to memory of 1248	2680	chrome.exe	113
PID 2680 wrote to memory of 1248	2680	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.catalog.update.microsoft.com/Search.aspx?q=0f7c13ba-e653-4d4d-bb6b-b3581b2df8ee
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa8bb5c728,0x7ffa8bb5c734,0x7ffa8bb5c740
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,9519008377128975946,17991023386406828796,262144 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,4120005267511885976,10161599711681700076,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,669790578734805966,12302843408558287890,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,1773460049847731876,9483454500453194964,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,9958241990382253047,8068156720763871687,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,12822627192773111055,17280543481572289884,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5376,i,17176702805956449605,2014284179802454940,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5340,i,13261702464683543932,5429449494222374548,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5680,i,275953862318319306,1984746491911329392,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5756,i,1450764308843676578,11475638770657258815,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,12790953573401994067,12750404700536336753,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6168,i,18358996560600645088,14868114535732521298,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6348,i,5546512135208385433,5175602802805362503,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6416,i,648879331858928564,17361516889525008390,2097152 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,5680689584554644923,10249291407993659679,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,1988692571267034778,11251721576890310984,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,6754210679383151835,1096591523088280495,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6008,i,10794859494494994082,11054104559707196002,262144 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=it --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,8796390375140077645,4119521862155515065,524288 --field-trial-handle=1840,i,6596157749360383293,8544457685972037358,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
  2⤵
  PID:1248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2740

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28adde17-46e9-4e79-a16f-a350a9add492.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\28adde17-46e9-4e79-a16f-a350a9add492.tmp
Size 5KB
SHA256 aa769ed4f5f41b320cd0d307c4977f6040dc6fa577b2e944cb2c3d2873350e8a
MD5 9d036f7d52717b0494af3d759ac145ac
SHA1 9b5c4007ccd88d7961e76278c2611227704ac8d6
SHA512 18e92d0d390161495170cb0629a3232b7ddf5115a1966d12ac1e5826a82a0d1e3359f67600b062c808ae1e02be1895cd2cc8941041c34589eabdadd9278816ee
SSDEEP 96:OsbJ0d+qJw6eq8Em6eifKcIzKxNoTSl8h4otop5FdDkwB67GyvQH4Q8TBlUnJO8P:Vt0xJPz8/CknBiU2bbPr4Q8wnJO8UQ
TLSH
T13BC12A7078AC9E7354F7F695B0832943CEB46197B525AE90EADA0F1C00E75EC2356633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6663e2d8-ba60-41c0-ba54-c57188dc6b7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6663e2d8-ba60-41c0-ba54-c57188dc6b7e.tmp
Size 5KB
SHA256 1c7a585b779d222ee3a7928b68da4fb9700077de2b668cc1e2584e67b28fa7a3
MD5 ac92ee3935c623dfce6297f562c3b5f2
SHA1 af1098dd11f55b537fd5156be3bf1764133d1417
SHA512 cd48ffee04c266993766ec46c114d9850a5fa4303d7018a2d71906f3cd4126a553a028f9b672783597e5fe0c03ad44a8ed4d1ae3a44c682b7069e038a6841994
SSDEEP 96:OsC0d+qJw6eq8Em6eifKcIzKxNoTSl8h4otop5FdDkwB67GyvQH4Q8TBlUnJO80C:VC0xJPz8/CknBiU2bbPr4Q8wnJO8UQ
TLSH
T195C11A7078BC9E7354F7E695B0832943CEB46197B525AE90EADA0F1C00E71EC2356633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9270e794-a8c7-4171-b7b0-6958173b2271.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9270e794-a8c7-4171-b7b0-6958173b2271.tmp
Size 5KB
SHA256 72b476563393007707b1c7d6f7dbe04d8b2d50045fba5f83a9aed6431851a24b
MD5 2072c748aea0f20548666740b7fb73db
SHA1 3f5ca6dc2a33f120ef8e3b457076224d21c1530f
SHA512 cd134ed8bef8452f6bec7048a761ebc345a9660fd32832a018dd221165bd17dc72fcbacabfff358c64516bc9eec075b43ecd9365dbca68aefa65b7fe722573ce
SSDEEP 96:OsbJod+qJw6eq8Em6eifKcIzKxNoTSl8h4otop5FdDkwB67GyvQH4QnlJOPRNC3f:VtoxJPz8/CknBiU2bbPr4QnlJOPuCmN
TLSH
T18EC10930A89D9D7B88F6F59571832D43CE64619BB9257E54F9ED0E1C00A74EC1393623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1570e8b3-b97a-4a72-8be0-39fa9196e266.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1570e8b3-b97a-4a72-8be0-39fa9196e266.tmp
Size 12KB
SHA256 d3ce0f119da1bc75b76552b33b914808e6e1bbd683fea7c8ebb0291f7d56ade4
MD5 1e21c2b809d7179014012226cccbac2e
SHA1 24d4e59fc680131b3a8a1e5e11ebea5b615ebfca
SHA512 91497e8cfd5bb8e019d571f339e7824f6c661a401930f77ab057ed47a3b7fc99ca224c2384f4eb4cb6487660c3572e9b21cbbc811f9986877e0397ca7626a404
SSDEEP 192:vRVTADgv7DvAPRp2mO9bHsb+WNnsCudq2cO2CIaWyxCl8yIsnAUge:vRVTI8/6XaBwB12P2la7Cye
TLSH
T15B42D62EEA10753B9CDBC329F9A1BB97D6F5002170952E84E6FC892C24E76CC7227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16dd5050-6359-41da-9de4-bd2765fd07bb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\16dd5050-6359-41da-9de4-bd2765fd07bb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

896cbda4-559b-4d4f-bd77-350321dc10b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\896cbda4-559b-4d4f-bd77-350321dc10b4.tmp
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 18674e5291788d27b78984daf7b4a48e22efa04cbeab5c7ef5fc297b13fd0fb0
MD5 c9ab553d696f5ccf323fa607633d9e4b
SHA1 265630290e56fdd0b30ab9ae0652503888f4ec79
SHA512 29d13914c77b6c1f5dbe37fcb10ded73a27344e2dedca6a342f250726f23fdd7a95343cacd4fe0dfac232b638183b5642a36b176e4dbe01496d0667d581ee8f1
TLSH
T1C2D0A7451493D1D0DB1872F84DD20B71713006C707174D7761F570B15803381C779C02
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

290d5d06-46fd-4b66-a0bf-2d70be1988e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\290d5d06-46fd-4b66-a0bf-2d70be1988e6.tmp
Size 1KB
SHA256 77dc529aebddd7423c5131bb1d6e699a8052820587e6c89c6d82dc9b18b65a4c
MD5 62da0b2f04579fed7d7eea545bd7d78f
SHA1 e5f045bcb39d1ab1b36b31e9e25d9d205cb35cd5
SHA512 bd35656e0eceb40ff24ebd74208d9163b0d67269a1be73d5dbbd4160f3e13b1e9c66f86e3ed5f78f883e7bb899c320d28251ed22c79d659e78bb6d39da465324
TLSH
T140319EF783B4957D8A1092E4EB15AF1FCE6D0514031C387688D46E2793E3972E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

2f98a836-8ac8-412f-8b3c-97a586136399.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2f98a836-8ac8-412f-8b3c-97a586136399.tmp
Size 1KB
SHA256 46baf8ab8aacda230c9a19b74f14e4fed32b377d4fdabfd94fb807e8c205adac
MD5 91cbbb0a545322e9b31630a704ec24d3
SHA1 dadb4374c43016e82701b11628c41520ced4399b
SHA512 5d22ed78429ea340bd64d9bcd58bd6c44fc18c3ab12a4e54b75e7808fd6d739dc9fce53200ad955c67489ae30552be8b9aa2203676108f3d37d8592bdcea8f23
TLSH
T18731ABF783B4957E8A1092E4EB15AF1FCE2E0524031C387688D46E2B93E3972E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

7b3caa28-b6aa-4be5-a8ea-1321eb0be4b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7b3caa28-b6aa-4be5-a8ea-1321eb0be4b4.tmp
Size 1KB
SHA256 cabbbbaa31f3bbafb7c0c0ce968d2156527b15ca4b9237a6e068e4289f5aed9e
MD5 a4904cc6fec61f1a2ea7a16b61fcac44
SHA1 9a1fb10365fed112cee5139e321af392a7ed3797
SHA512 c9545b314c77b450b09dea60ca6a57bc4b0706242f0c2f5ca2c60a620791e086260827c7a7f2f93027f2dcd38b4329a97fc824a652c1ea7113fb6e932fe4558c
TLSH
T15931ADF783B4957E8A1496E4DA15AF1FCE2D0524031C387688D46E2793E3972E10439F
MD5 SHA1 SHA512 TLSH

Submit Download

b347c7f7-efe4-4f85-9af0-bfaa06b7691a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b347c7f7-efe4-4f85-9af0-bfaa06b7691a.tmp
Size 690B
SHA256 2d97efb7c9c6eab7564166590372bcbcd43f86da5c46a88501fb3a45c4e57f5b
MD5 ac0513807dcc192ceffcbd72a3665ca3
SHA1 8c895f1b32ec864a56b2729ec67ee57a16b881fa
SHA512 d1cc694e776d243f465c84e3709d43bd4b63128dee600130aa2497a38529659340c4ca9c53f119f5e5d8701e1af07d56bff8f849411c9779b5523e51ecb713b5
TLSH
T1B0017BA792BFB43710BA06E71D14B80624B6A8B50757E9E5CEEBC23C60C16F71F16423
MD5 SHA1 SHA512 TLSH

Submit Download

d448d178-d495-4dff-8ea6-c9aa2ea5480f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d448d178-d495-4dff-8ea6-c9aa2ea5480f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bf818c97-02ab-4d23-a98e-72ef533ef03e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bf818c97-02ab-4d23-a98e-72ef533ef03e.tmp
Size 12KB
SHA256 47999c769650b97fda6d6f684aea6ccefa5c0a42e4e67713be49a6e963811e96
MD5 084270472fcf85317ab4f2688ecbc4fd
SHA1 1f1b4e563954e8e046cea162d34454e74800f8c4
SHA512 8e0fa364ef9c103c2eee257d6846cfb0311769158c3d56c1e03df7f3aba90538f4639e1129fa420bffb02c78f88b09a061fb41b4eeb50a706aa53753d8a8b970
SSDEEP 192:vRVTADgv7DvGPRphmO9bHsb+WNnsCudq2SgO2CIaWyVCl8yIsnAUgE:vRVTI8/wXbBwB12Sj2laXCyE
TLSH
T13F42D82EEA107A3B9CDBD329F9A57B97D6F5102170952E84E6FC892C20E76CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1a71ecb-b78b-46be-b360-948883993590.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a1a71ecb-b78b-46be-b360-948883993590.tmp
Size 4KB
SHA256 39accabf5de5905b7b9878ca9805259f2819132d52cf14f56f1ffd937a1d83a0
MD5 907f4bd2fb1cd325a93097f210461139
SHA1 167e0c2f2f05ddae472c6bbe3543dd4867dd7b5e
SHA512 cefd557c429e31245e8e618a187ba85e6b9f2588d15f378b20738b62c5edbe9991ffb763ff5b2964eaf1266791fd480295101245bb524f91a1d9085957482ff6
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5F8DkwB6vGyvQH4jYO0bblDv4a:qC0xJPz8/CkqDUD4bfr4jYO0bb1
TLSH
T1B6A10931B8695EB794B6D585B2832E03CF64B197F621AFC0B5DD1E1C14F70E81752A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb2b6f40-4bf6-4c5c-bcae-033249936b80.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bb2b6f40-4bf6-4c5c-bcae-033249936b80.tmp
Size 5KB
SHA256 84cb520356b50ec84684abafb43fe9af126c7cf42e47beb193e9ca0d05d4e4a4
MD5 18592bc08958e1dbfe95295766bf099d
SHA1 bac63369fdd94e6320481dad8e0f437b604b3b0e
SHA512 e96a70e641fb998a090c333447fdd7e3adb237b9a198188e1c7e24038b490e04c1b658bf5cac35b8736b12deed235d03a62d9ecb2197d940f5b5a7b66474d78d
SSDEEP 96:OsbJ0d+qJw6eq8Em6eifKcIzKxNoTSl8h4otop5FdDkwB67GyvQH4QnlJOPRNC3f:Vt0xJPz8/CknBiU2bbPr4QnlJOPuCmN
TLSH
T173C10A70A89D9D7B88F6F585B1432D43CEA8619BB925BE94F9DD0E1C00A74EC1393633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download