abe1c511dc81d1da0fe647a05cb2810e4e8edc9004eb1feeec13c16a2b4e2eb9

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mafia1.exe
Size 46.5MB
Sample261012-1d2rtafv6z
SHA256 abe1c511dc81d1da0fe647a05cb2810e4e8edc9004eb1feeec13c16a2b4e2eb9
MD5 fa78b428b0a3edbbc3410a9ee10ff4cb
SHA1 b70392058aabc12970faa69b3ffe70f17140510a
SHA512 f4a4d2e75dd2e487c57ee78935d42eeeed12447349af23489efdb60f5c5073547a46e7421f2dad2d566f521e1aa0d71437e88cad6eb43a65458cceede755ce50
SSDEEP 393216:5lWZtsox/9M51IMKLwaAOdIJ/TDYULwgsnZ5zjl4Iz9tW90:PAt1CIMRPFJ/8fB
TLSH
T1D9B74A57F8D21A85C4EFC630C536406BBA72381A1B7823D76990F7342F3ABE0AA75751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
93	1080	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
4220	mafia1.exe
6024	mafia1.exe
5356	mafia1.exe
2408	mafia1.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
87	api.gofile.io
89	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mafia1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mafia1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1080	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe
Token: SeShutdownPrivilege	2132	chrome.exe
Token: SeCreatePagefilePrivilege	2132	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe
2132	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 5644	2132	chrome.exe	100
PID 2132 wrote to memory of 5056	2132	chrome.exe	101
PID 2132 wrote to memory of 5056	2132	chrome.exe	101
PID 2132 wrote to memory of 1080	2132	chrome.exe	102
PID 2132 wrote to memory of 6112	2132	chrome.exe	103
PID 2132 wrote to memory of 6112	2132	chrome.exe	103
PID 2132 wrote to memory of 5700	2132	chrome.exe	105
PID 2132 wrote to memory of 3992	2132	chrome.exe	106
PID 2132 wrote to memory of 5700	2132	chrome.exe	105
PID 2132 wrote to memory of 3992	2132	chrome.exe	106
PID 2132 wrote to memory of 1988	2132	chrome.exe	107
PID 2132 wrote to memory of 1988	2132	chrome.exe	107
PID 2132 wrote to memory of 1004	2132	chrome.exe	108
PID 2132 wrote to memory of 1004	2132	chrome.exe	108
PID 2132 wrote to memory of 4920	2132	chrome.exe	110
PID 2132 wrote to memory of 1204	2132	chrome.exe	122
PID 2132 wrote to memory of 1204	2132	chrome.exe	122
PID 2132 wrote to memory of 4036	2132	chrome.exe	123
PID 2132 wrote to memory of 5124	2132	chrome.exe	124
PID 2132 wrote to memory of 1328	2132	chrome.exe	125
PID 2132 wrote to memory of 5352	2132	chrome.exe	126
PID 2132 wrote to memory of 5352	2132	chrome.exe	126
PID 2132 wrote to memory of 4464	2132	chrome.exe	127
PID 2132 wrote to memory of 4220	2132	chrome.exe	128
PID 2132 wrote to memory of 2680	2132	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\mafia1.exe
"C:\Users\Admin\AppData\Local\Temp\mafia1.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9cae8c728,0x7ff9cae8c734,0x7ff9cae8c740
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,1883556034251953373,9575493143824501300,262144 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,1687447983903694441,6041589962392872796,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,11626589703327801255,16327784898234886234,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,7216441392904871604,5995175120752245425,2097152 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,15927581415182259631,5071897645734899195,2097152 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,3906760988207883772,6190007901734236736,2097152 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,7775814643783197621,1476537558697278166,2097152 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,131351960913052681,12155366701771886860,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5808,i,8093244004984157403,8204289105479519774,2097152 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,7978036528400251834,15222259489268402959,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,12594426681965892911,5292831596585322105,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,7449595428731300663,17437833061693401314,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6092,i,13639810634394687450,4546529846576147235,2097152 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3572,i,16514363684782525307,2429233573663540808,524288 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:4464
- C:\Users\Admin\Downloads\mafia1.exe
  "C:\Users\Admin\Downloads\mafia1.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4808,i,6876965624869279243,7116733703639315286,262144 --field-trial-handle=2088,i,7927770763559617841,7137401874973770337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3492

C:\Users\Admin\Downloads\mafia1.exe
"C:\Users\Admin\Downloads\mafia1.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:6024

C:\Users\Admin\Downloads\mafia1.exe
"C:\Users\Admin\Downloads\mafia1.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5356

C:\Users\Admin\Downloads\mafia1.exe
"C:\Users\Admin\Downloads\mafia1.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91b1dda2-abfe-4fc7-aa43-fb8f3e644d5e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\91b1dda2-abfe-4fc7-aa43-fb8f3e644d5e.tmp
Size 269KB
SHA256 750fd38a7d7f3c44edafac22cb1d894d1bc39cf920f5aa1b9fe28bf52ffde486
MD5 6fccc2e3407009e9eb6a6b177da61c67
SHA1 aa3b8819d4ad819b65f4fa43794852f28d89c552
SHA512 277f55ca7fd5e639fad7299244c76173373b03c1b0531a1e019da864e8c54c2fd2a9471b6be174d00ecd1dc6e067137dac446be15d085af191d769d709fcca29
SSDEEP 6144:xpRFhruCdzCicP8gMvPP58+hFD+7t56OD9ZfSApprD:FFF3W8gMHP58yFSXD9ZfS4x
TLSH
T18F4423317ED89FD382BC5242D11B9316CF99ACFEC56E2658846F6F81C04F8891753A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32bc8437-4d65-45e3-b5f6-97f27b1ab813.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32bc8437-4d65-45e3-b5f6-97f27b1ab813.tmp
Size 414B
SHA256 37da971e35e9dc7e90873a7fafa5ab14e91bf50793a92fbf7e532cbcd9234927
MD5 83b5e804425e1f8786a33e02902aff59
SHA1 05cd7b638ad5e49927274f529ccc7b8a8a3b0405
SHA512 becc47ad8a8d6b810dfa1064d9c25527179a8703edd3823a58430bcf4d848188bb0c4c6d7d3121959249a1b2eed2d935c2092710ef4d401722a1afb6f86ec1f1
TLSH
T124E02BB6C861B9371DFD1B5D50908B87EB46135B3640845B3A3EA1098F79A7A0285C5C
MD5 SHA1 SHA512 TLSH

Submit Download

47ea2ea6-e98d-4aaf-8ea9-31e74f488433.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\47ea2ea6-e98d-4aaf-8ea9-31e74f488433.tmp
Size 12KB
SHA256 1a12907de2e33184df60c71b5d528f399b5ddabcca4d29eb78aab3be03df5c90
MD5 b77b7d4e3f56b2998369f085c94ba942
SHA1 a0c67641ae81c84db1ae9853bd2e4b59ccb6f48e
SHA512 476a6fea7557e3f16960c76904ce9c6ff440e9d2761c8de5880cf7a189c78a7e40dacf816f3993b0da5ffe262200da861f8c66fe98bd360e72aff0104a0e8ed0
SSDEEP 192:eRUoV6P+cMBv7GhAPRp2C96Hsb+WNnrJ0H7O2GQpOkw7VyIsnAUgtaJ:eRUoVsIRC8XtswN0HTGoOd8
TLSH
T11842A22EBE10793B4CDBD329FA217757D7F6102524942E84E6FC883C15EB6D8222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e6c8eaf-6cd5-44b6-bca5-08d6aab8e63a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6e6c8eaf-6cd5-44b6-bca5-08d6aab8e63a.tmp
Size 12KB
SHA256 992a77072ce432e322562b30cc8969f6fed5030d333dfbe3fc32d3dcb4987f41
MD5 e9b6fd64ff1697e82688f6f8f8bb2224
SHA1 c2dd8c4390c595d59cc80f2ae9bbf69e4816fb31
SHA512 ed78f4b4bec2048e41172f71a197f0a9c5a59800603fa106eb3fa87e233dd547a85b7878c4bea6e3cf27157387332f5cce8d065ca4b162d8e4e12c767dcafa71
SSDEEP 192:eRUoV6P+cWKv7GhAPRp2C96Hsb+WNnrJ0H7O2GQpOkw7VyIsnAUgtaJ:eRUoVsiGC8XtswN0HTGoOd8
TLSH
T10242A22EBE10793B4CEBD329EA517757D7F6102624942E84E6FC883C15EB6D8221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fb2af79-2146-4a7c-9275-c553817cfc92.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6fb2af79-2146-4a7c-9275-c553817cfc92.tmp
Size 13KB
SHA256 7824cceb07a574a2af9a8e39d90c22cfc194635a4d9529c6f3fc143e13cc0f79
MD5 703bc776bda710b10c4a2d2a71810f2c
SHA1 b5b5c8de53590ac32baae9c5b1b99716c946ddd2
SHA512 54f38bda50f10794be5bec4eabe6fbb3f9de5b8035fc2791b4a421415164659acae540d0cd7f8ae47354b22ca33d0604de70e5ad338c0089215b5069ae56ee06
SSDEEP 192:eRUoV6P+ct+v7GhAPRp2sls96Hsb+WNnrJ3Lh2PO2GQpOkwAVyIsnAUgraJ:eRUoVsp6C8X6swNt2/GoOke
TLSH
T1F852C42EBA107A3B4CEBD729FA117757D7F6102624942E44E6FC893C15EB6CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

826fb7ec-5bfd-4dbc-a809-019708faa94f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\826fb7ec-5bfd-4dbc-a809-019708faa94f.tmp
Size 13KB
SHA256 da81a8e353f5ff2087816beeb56e0f7eb4c53c362d079b3e0186f60df87f2e7d
MD5 3697f436e2cfb5d5a101a4154828ed4e
SHA1 187dbd577547ad6c065d86b3cd3391c9e132f1c4
SHA512 2cbc80bf14b71979b834938edd6c49ed44c3a89edbadfc8f2109b4123bd8a6490881fdd3c787c2ccc5d0c05efe0e20ed4d0447f339267e62d8dc095d73e1a666
SSDEEP 192:eRUoF6P+ct+v7GhAPRp2sls96Hsb+WNnrJ3Lh2PO2GQpOkwAVyIsnAUgraJ:eRUoFsp6C8X6swNt2/GoOke
TLSH
T13452C32EBA107A3B4CEBD729FA517757D7F2102624842E44E6FC893C15EB6CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 9a4d0c5e31510d992b315a2f8eeb5e93952267fa7ad6e70ef12db344544c6d1d
MD5 91d949fbdf54d715593be4e1e19ec79c
SHA1 1bb6693b0c0e18ed34d44e22489441cec4dac13d
SHA512 d2be559efb071c47b2c2db51465137e7b354d3f1fe82338b1073cfe8f5dee19dd095a1372b5a0daef55fa5182ac276832f7410d0e04062ac64d2c680460988ea
TLSH
T1CC214EB1B7600832CB633270A8C8966B393219C3494B3DF7004938BC72017DAB6330D4
MD5 SHA1 SHA512 TLSH

Submit Download

e51be480-e2ee-4d91-a114-20e3f6777bdc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e51be480-e2ee-4d91-a114-20e3f6777bdc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fb270084-25d2-4e0f-8242-ae5347cad525.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fb270084-25d2-4e0f-8242-ae5347cad525.tmp
Size 2KB
SHA256 cc29bc9c4a1b6f6a6859f0403c861c0a9c7c01051d18684f15d79aeab9333b9d
MD5 9321a1bfb236ae80e1b367ade1d70ac0
SHA1 bd83af4086c00db22d376611ca28fc630a772de8
SHA512 6a7cbc18077936a599f45d5e18b5c64abf060dcc0ef7f111a4b24c3384ae062d3532de21d721257b5ac4b92f4f508bc498582fed6289eb301c62c75fcb2c61ad
TLSH
T1B351DCF3C3E8866E891152F49B10AE1FCE2D0924532C3D66C8D4AE5B53E3872D24178F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 14967a825c35fb8f43bcef9246fdc328bdb2d97fd476ea99775cf1ff86c6eccd
MD5 26126d3a07100b924daa53534d1a4642
SHA1 38d1d68478c6a222356f30c1d6cd0883c78e2a61
SHA512 d89a3c7be66abdff572765d6bcb2816b0f60fc2be0795865faf2b96ebf624777adac91bdc43c23057ba41480f0e81a500ea2239321880247dd5f038bbe3d7241
TLSH
T1A3B0124681822302D00103B02154946437608F36D232239651F00D4188312504057148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 bf6aaebbf383ffe7ef82538d45d40dd8126cf32e2674c4df13c5e2fcca5a2fe2
MD5 2fa4c214f445ad4dc0418ebe7c6f8bb5
SHA1 3ee0910b5d96a646fc4737d5e3727ea1d4391baa
SHA512 f50b5ffbf93ce8ae887ac3d720303c68975811c88ab9189225ca5ec9c15ac0379c15cfcb0b7f6e91f043a731fe5d3324f373a5bada31ede5b3cbd9d085f117c9
TLSH
T125B022A0C3023303C00333B02E8880C83320CF20C203020282F08E22CC282200028A20
MD5 SHA1 SHA512 TLSH

Submit Download

bb3c03fb-3e34-4e02-9a0e-00414b9f34bd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bb3c03fb-3e34-4e02-9a0e-00414b9f34bd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cb7a03be-cb08-4537-8fe8-30190c351855.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cb7a03be-cb08-4537-8fe8-30190c351855.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a04c7129-792c-4c82-8123-bfb1412577fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a04c7129-792c-4c82-8123-bfb1412577fd.tmp
Size 268KB
SHA256 d3b023ffbfbf67a3fe0c0edbaa3db2eca5813921653351f426ca79f7fbc830c7
MD5 731df70f246af25740cada0d18a6a58e
SHA1 eca966ca35bfa7bf7561aa013bda2c5fbfbaab8c
SHA512 7ab8f1fc322c337527dcd169cd2f2de2abf78daead00557bcd60c54f581cf052dc313cd6c114b70c83890453e830bb9269c656aec714f9498295a0d41e967d06
SSDEEP 6144:2XFhruCdzCicP8gMvPP58+hFD+7t56OD9ZfSApprD:OFF3W8gMHP58yFSXD9ZfS4x
TLSH
T1AD4423317ED89F93C2BC5212D16B9315CF596DFD816E2658806F6F81C08FC8917A3A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd2eb4b6-122d-4414-b5f9-3afbef4439c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cd2eb4b6-122d-4414-b5f9-3afbef4439c8.tmp
Size 130KB
SHA256 c3f1cd7210dbf1603abd6451b16d277005121df5256e45c1f53572b1ab9960ea
MD5 93a96f4166dbd246c8bfa9b885adfec3
SHA1 4e05a7b39bcbe688bfaa4c4ca52eecdf491e3d5a
SHA512 f977f22502ee0487a7023d3391216667f8f02e69b4f5dbf700249e3dc8b71b436d34b9a4d8b1af7e0c57b1b20a63358a998e2dad9014c81ed9f3b7f9ee5d48fa
SSDEEP 3072:Um+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Um+hFD+7t56OD9ZfSApprB
TLSH
T135D31232AA91D8BBC9BC6541B147A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc32a27e-5d2f-4fe2-8a1d-6cf509b5454c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fc32a27e-5d2f-4fe2-8a1d-6cf509b5454c.tmp
Size 268KB
SHA256 42c0047fae34b5f14c8f712197ff4a3066dc76b0ca95a9f07c04b6c031ecf322
MD5 ac6927a85cee97c8061a2f4b4dfd3085
SHA1 9d3e1dc390f23660932855b411df6d061acd2aea
SHA512 71734a3855e1bb5041322c86daff9e9bce6e2973f785f41b4acdbe48c37a2a669ff91b26045ab0db08126870524a4f044a504398fe029dac6e4c691a475c7d53
SSDEEP 6144:xXFhruCdzCicP8gMvPP58+hFD+7t56OD9ZfSApprD:VFF3W8gMHP58yFSXD9ZfS4x
TLSH
T17D4423317ED89F93C27C5212D12B9315CF596DFD816E2658806F6F81C08FC8917A3A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99d322cc-7e73-4c50-a4ec-6aa6ca753082.tmp

Path C:\Users\Admin\Downloads\99d322cc-7e73-4c50-a4ec-6aa6ca753082.tmp
Size 12KB
SHA256 eb95ff69b04fd377aca349504574b696e91523110acd960ddb7f8ea5a40e06a7
MD5 85d21dbbe519c78fc15e2c7b8db76c53
SHA1 a33b07826539bdce861ceb7081ce937324892594
SHA512 6e81d4fdba28dd41caa71c66ba60aa32649d9793fabb8ac59fa36a2f03b569a71b4729611e1db09e76f8d66630ab17fa77508469b9eda90ecb720b5a193789f1
SSDEEP 192:9XJY7HfUBrhjWHOXtbCLzPw5n2M1i/ojhyaKwIZ:FqTIaO9bC/En2M1i/EhjKhZ
TLSH
T1AF42635BAB9DC41AE83BD03C49E7683D35A97C8663E164F329072CB50E4BEEC4530369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mafia1.exe

Path C:\Users\Admin\Downloads\mafia1.exe
Size 46.5MB
SHA256 abe1c511dc81d1da0fe647a05cb2810e4e8edc9004eb1feeec13c16a2b4e2eb9
MD5 fa78b428b0a3edbbc3410a9ee10ff4cb
SHA1 b70392058aabc12970faa69b3ffe70f17140510a
SHA512 f4a4d2e75dd2e487c57ee78935d42eeeed12447349af23489efdb60f5c5073547a46e7421f2dad2d566f521e1aa0d71437e88cad6eb43a65458cceede755ce50
SSDEEP 393216:5lWZtsox/9M51IMKLwaAOdIJ/TDYULwgsnZ5zjl4Iz9tW90:PAt1CIMRPFJ/8fB
TLSH
T1D9B74A57F8D21A85C4EFC630C536406BBA72381A1B7823D76990F7342F3ABE0AA75751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download