346a5c3c0544fe08b5c36e7adfd5caa528651cd81d30c2974c65552c657a2310

Analysis

geolocation tags

asiadelhiinindia
max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 941KB
Sample261107-saj4lay1ay
SHA256 346a5c3c0544fe08b5c36e7adfd5caa528651cd81d30c2974c65552c657a2310
MD5 34ae965c43e59f619ef785834c9f9422
SHA1 99b968d3d9974f0f6d4a6abfc6f4777242676559
SHA512 25f149d50e2c2596a9512d026f7a29a5f0eeb7b7757d853f22a6c0872cdcf5b281a9d1d148a5556aad69023976dedb049d969b53af81a69359dc7d048ae6e083
SSDEEP 12288:WFvxnvxBvxzvxhvxwvxevxdvx1vx4vxkvxWvxvvxJvxtKnkNg4:WQeu
TLSH
T161253E64086868B29857E547DEF5FF7E5CE007294BC9DAAEBDB7D39C01DCA000DAE412
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
248	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
4276	chrome.exe
4276	chrome.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3456	3760	chrome.exe	89
PID 3760 wrote to memory of 248	3760	chrome.exe	92
PID 3760 wrote to memory of 3008	3760	chrome.exe	91
PID 3760 wrote to memory of 3008	3760	chrome.exe	91
PID 3760 wrote to memory of 6120	3760	chrome.exe	93
PID 3760 wrote to memory of 6120	3760	chrome.exe	93
PID 3760 wrote to memory of 2064	3760	chrome.exe	95
PID 3760 wrote to memory of 2064	3760	chrome.exe	95
PID 3760 wrote to memory of 4512	3760	chrome.exe	96
PID 3760 wrote to memory of 4512	3760	chrome.exe	96
PID 3760 wrote to memory of 5388	3760	chrome.exe	97
PID 3760 wrote to memory of 5388	3760	chrome.exe	97
PID 3760 wrote to memory of 4516	3760	chrome.exe	99
PID 3760 wrote to memory of 2604	3760	chrome.exe	100
PID 3760 wrote to memory of 3244	3760	chrome.exe	101
PID 3760 wrote to memory of 4832	3760	chrome.exe	102
PID 3760 wrote to memory of 4136	3760	chrome.exe	103
PID 3760 wrote to memory of 4136	3760	chrome.exe	103
PID 3760 wrote to memory of 460	3760	chrome.exe	104
PID 3760 wrote to memory of 460	3760	chrome.exe	104
PID 3760 wrote to memory of 4788	3760	chrome.exe	109
PID 3760 wrote to memory of 4188	3760	chrome.exe	108
PID 3760 wrote to memory of 4788	3760	chrome.exe	109
PID 3760 wrote to memory of 4188	3760	chrome.exe	108
PID 3760 wrote to memory of 3092	3760	chrome.exe	110
PID 3760 wrote to memory of 6080	3760	chrome.exe	111
PID 3760 wrote to memory of 3092	3760	chrome.exe	110
PID 3760 wrote to memory of 6080	3760	chrome.exe	111
PID 3760 wrote to memory of 3096	3760	chrome.exe	112
PID 3760 wrote to memory of 3652	3760	chrome.exe	113
PID 3760 wrote to memory of 3096	3760	chrome.exe	112
PID 3760 wrote to memory of 3652	3760	chrome.exe	113
PID 3760 wrote to memory of 4276	3760	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff652bc728,0x7fff652bc734,0x7fff652bc740
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17573637307815682197,16386305888744187793,262144 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,10348382317931773827,303551288658523483,524288 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,10769843081550175495,6715800546804709307,524288 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,217927380705930243,10800919770686663360,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,15774821303862273922,2500877846790508602,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4932,i,16787059618627484080,7782225766378137944,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,12945957118777451642,1834501938244164830,524288 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,16826717178991285143,13140740420676414311,524288 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,494263702049831235,1891047567923067356,524288 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,15435178020255846829,3555753787645915395,524288 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5856,i,15595319694155814659,2077290735426010003,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5892,i,13186214091499810681,4848678449345830395,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6212,i,16454692654168426003,12678172845390950089,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4852,i,11675499485001571254,894040492084803275,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5856,i,17679592944628548114,6463563872279960949,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4792,i,18209891780584998333,12085896698719691306,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5652,i,1145250657288845147,10244645962104195235,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4632,i,7660575323686747107,5517932088031242904,2097152 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4804,i,2651503813175677274,10279945565812154494,262144 --field-trial-handle=1916,i,8326565702053670565,9761995607513949894,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02d533cf-68dc-481c-8900-4fb9c6f63553.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\02d533cf-68dc-481c-8900-4fb9c6f63553.tmp
Size 51KB
SHA256 a995a46b4e4621d8635530a4dba8b8b5d83ffe68c956511fed894dcf48067571
MD5 fdd264b622b207868b89ffd52346d37a
SHA1 8b5e28f110eb8a776ef8e7b88d4c45e1bdc7f178
SHA512 80e03d83abac5148f4cc7e31868eb08e61aef9e781e64926f1c37ebf0f284ef4f919224a95a18e22a8f4139e70ae43292e237b50a2876a35be2d9ba343ea3386
SSDEEP 1536:HLUHkfwryMPDsv+FXZP5ikvbql9vdOkSDRN5IQa:rOlI+BZFOPoDRzpa
TLSH
T1D733F1F0E5AD2E6932FDD081F6177E0B8C45846B7400FE20D25B2AC5255A6FE6347E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08961a2c-88dd-4633-97e0-2eb1e8aac188.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\08961a2c-88dd-4633-97e0-2eb1e8aac188.tmp
Size 5KB
SHA256 bf473bf0b70f40d6dc1cd94021113f735d1cb1be69cd01771c7645f5df578a10
MD5 997ebe36cc5506927b9949c8d10a7d65
SHA1 13b9f3d29958668c6400cee51c16b593f5757255
SHA512 7c0f6996bccc7463c84caa572e029c95051c2aa5f4744937a55476f6765618b40451f98497048b5894fbd17592aea8c8bdca7413144680755be1422b9387810c
SSDEEP 96:K1C0d+OBIsu/Fl3fIUKsI8KaeI9bSl8h4otop5ICbDIaB6M/0dGyvELc6w2z6+R2:0C0pB+fTbnlpiU2TLWw/cFN+RDiUk
TLSH
T1D2C10931B47C1CB755F294C5F5433E43CEB4A2AB99109E64CBDA1F0C01AB5F82382A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

402668cf-b01f-4319-b776-af6ae1c66102.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\402668cf-b01f-4319-b776-af6ae1c66102.tmp
Size 5KB
SHA256 552c9cf51c00c1b227a2bfc4764536b744c2aacd370ba5af9aefa46b611b122d
MD5 8328c44806b9a969afa5951a973d7b8c
SHA1 ea239d071daf751ceb1ba45f80877065d71bb498
SHA512 be9084ec7438c943ca84df1e57b16380f0b059dcb82cb0547e8f61ff1aaaa1fd65c355d65baa77b1e9a2b25f9d30b506d3f86936396d434e84fe6181aed1dfc1
SSDEEP 96:KlbJ0d+OBIsu/Fl3fIUKsI8KaeI9bSl8h4otop5ICbDIaB6M/0dGyvELc6w2E6dQ:mt0pB+fTbnlpiU2TLWw/cFydRDiUk
TLSH
T1AEC11930B46C5CB755F29485B5033D43CEB4A2AB9910AE64CBDA1F0C02EB5FC2382B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

020509e6-fad1-4da8-8a4a-5cd09120311c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\020509e6-fad1-4da8-8a4a-5cd09120311c.tmp
Size 12KB
SHA256 7260ea129f642ca2fdce0c6a198a11ea0ff5cc59f67aec72ed9d3b24cc6fae96
MD5 be81ce5425101c967002ba11cbb178ac
SHA1 2e589fe0437abd4a3bcc40a59a50ff6e32e586c1
SHA512 0a4e212f11eb952ceae0acb8e344e68b99564075bcd652c11a7a7f38c1b564fc7a13630d0f1816d901ade6820a5008b640cf67de397a94410998003233e89d3f
SSDEEP 192:wRV2XcfHv7H8v5PRpBXs9OHsb+WNnPoPoWvgU1VyIsnAUgE:wRV2XEPb8ZX6kwgPDVjE
TLSH
T1FE42B839FA54B93BACDBC219F962BB57EAF5103620941E84E6FC893C15E79CC2257007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3795c4d6-4c9f-4ef3-87b5-0845163d813f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3795c4d6-4c9f-4ef3-87b5-0845163d813f.tmp
Size 11KB
SHA256 d1a21d494ccc273cd0b51c4e7b47119c22539f7f35226028d26f676d862231b9
MD5 7d0a6f13e75e6e7cb2db9ca545fb6597
SHA1 2c5210465bd3cc076abf5eb1fcbe0a16a3ddc9bd
SHA512 c937517ea38109a4940fc7ee3e273eb91cdbcfb7969c88b682ed6b9de0b029bbb7d604657e8b369cff31ed9f3cd0b9a1f6ba3cae7975260ba08b3b99effb3186
SSDEEP 192:wRV2XcfHv7H8vAPRp2Xs9OHsb+WNnPoPbWvgUQVyIsnAUgR:wRV2XEPb86X/kwgPCVUR
TLSH
T1DB32A639FA64B53BACDBC225FD22B757EAF5102620941E84E6FC493C14E79CC2267417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

569c2591-28dc-4ec3-96e3-0b6934bb5125.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\569c2591-28dc-4ec3-96e3-0b6934bb5125.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9944754ed04f12bb5360ea9f68428595f24a28047da7a8dee4cadae250c4b4f1
MD5 b7633015de31540bff8b03c6274acfe0
SHA1 c20d9f5f6a334fd73834e28718bcc7a59967341a
SHA512 d7295edeb659a91e74ae5003f9a68d637c18842303019d173ce3799f12473a1acd70c28754a43cc084ea8d4e85afbc5ba03bbbd2fe42f1beab232c0c35a6b7ca
TLSH
T1D6317AF7C3D8CA7D890156F8AB156F1ACE290914632C3D66C8E4AE1F53E29F6D20124E
MD5 SHA1 SHA512 TLSH

Submit Download

b05b2de3-7bdb-48fc-8256-ef331802bdeb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b05b2de3-7bdb-48fc-8256-ef331802bdeb.tmp
Size 3KB
SHA256 ac42ab637ba493dbcac5e6aaf9bd75115bcdbfa98268d7d404a4f3662beb5cbe
MD5 a714dce4ee9c022e0cfe796c11600c3b
SHA1 c6cd39a92977198b96a0e82e3be5f6f684a60f29
SHA512 0a3b95c7982540587b167713f2c2acfe9e22d441080a920d9c33dabe69f43df03a8a5964877402c7fcf3c36d0c5db366c32e837a473464b09d5c8a5380093b71
TLSH
T1EF71ADB7C7D8867D880156F49B256E1ECE2E191A432C3C668CE4AF0B63F2571D10129F
MD5 SHA1 SHA512 TLSH

Submit Download

d6bddfd7-de3a-41a4-9d94-20f5c3c6f1f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d6bddfd7-de3a-41a4-9d94-20f5c3c6f1f1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f3b585df-e82d-4387-93ca-4b8d95154807.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f3b585df-e82d-4387-93ca-4b8d95154807.tmp
Size 3KB
SHA256 d5d19c536c9160ede79173b18fdcabe4f03d98352f3fa191f26e1880d6860a29
MD5 59939d5f3a5a99bdee89ee4ef7c89e64
SHA1 8fcc105a9028879694640ad2fb5bf6afa80a3d68
SHA512 5e00de79ec687c9710c2ca4969ea2862894a37cab8c685b2b15763280cac71093ecde31ab5d7ba21053a9db4a9f63a3a5a629887f135b4f2001d1ce1c2115264
TLSH
T184819CB7C3D8877E881156F49B256E1ECD2D196A422C3C668CE4BF0B63F2571D20129F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\eda14648-63d8-4000-b8fa-3bdb50dd74a7\index-dir\temp-index
Size 1KB
SHA256 d8dd369da744e4caea8ea34541c93fb4fc00bf14540a173eed4270a8baa0bbe7
MD5 0a70dd9da3894942b95bd875cb9f1328
SHA1 ec273fda49e5d4aa36c10bed6592204f8db0e089
SHA512 b67fabb6b5ef0efb5235a6c49f1ab4d67257fe89a8a44f2f528fb2b9ab2e8f4ea1f3306f04db114f2422ba23c29d42c8b075b0b7f0cb3158703fc9a987906043
TLSH
T16031238ED8412BDDD97012B7660C02B437B01D2AFD4CD340B1E8B56B384576953936FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\eda14648-63d8-4000-b8fa-3bdb50dd74a7\index-dir\the-real-index
Size 48B
SHA256 336325a6a148d2f1031e8bda3ed6801409a6bcad306bc94bc322fb1a9dae88f1
MD5 d21f1354d4ee056c5bd4e23175849af3
SHA1 7f5cd7a45b49f268f6b51fc2975a7c0f5a0f896c
SHA512 7d6236dbde534b32a52264ce2d3d9174c66d560874a440e7b5cd504acfa0f79211cadff34cdf8c6305a79c0dcb7dbe6a04e9cba0db3f9e2f04ba96c4bce15f3f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 105B
SHA256 7426c51df5ce9a95fe6cae0dfac8bbde8c72e525a0dc9b328905aeac2f5b164e
MD5 d85a4fd95ad2272834895d7234c2460d
SHA1 955256ecfd2836d4d9e0122f7822b9ac442db2e9
SHA512 4c12a70c6251e34a881557531226ea07d839f1d0fbb04039e21659b33afc5dc7ddda89a9f608c1d6c10c3e8193220078cffb5ca2f214da5a9876de4c0be4bb26
TLSH
T152B012AC52B10D6273A5060D130519021E2A9C015805A7C8F18A310A22345238CE48F5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp
Size 182B
SHA256 34dbb57afd7dfc4979afaaa51665d29c566c8c00ce60908ef5a0b774434f3e41
MD5 56419611c2847a0c8912da41830a9d2d
SHA1 9ee8c4b1ed8d31970f9ae86c157a936744248ce1
SHA512 86a7769aee0e0e95468ad09b6330fe43ce2e6cfb31c7e6d95345e64c55030db149b38db435daa7a7465efb93baabe36c2e42c2809030ac2f6775de235390cdd2
TLSH
T147C0C08CC3F20D717331071C310012060518AC05650D7684F944F1872174307C8F44BC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp
Size 98B
SHA256 b2783b2f8e337a705cb87e59d4330f035b475ae83f1d76064c49cd498e17c24b
MD5 0393bcae7a54659062a053735459c01f
SHA1 a6ec5a1754fb5c1ce3e495d3c4edf3137f80ac94
SHA512 597ca07d2c8c21254899d17cfb04bbb9271f977140e9f77a0ee43db528dbab0a8e6401ea302eda9e24e9ef7565343776fdd78066f3330cace6a989f5ce24e29d
TLSH
T191B012D892A14D6673B40B0C220419121E0ED5006415A688F188010A16345234CD08F5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp
Size 100B
SHA256 4e3d3cebde374540ed5b508bfa659c73eb411af1da2ce2442bc3a556c22affa1
MD5 49f53d45d453969304eb66640494d33e
SHA1 3a941f5d4ca24eb2bbb86880ed633f17c8f40488
SHA512 d611e676622ba07b525482cc13f9b641668067c82e7a48541e2be350d5dc761158bd7ee4392401fb2020bf5c816cc6bf50a4ec62109d7dca81644da12b8f5626
TLSH
T1D4B0129852B14D6273B8070C120419121E0ED4006465F688F998014E1368A634CD08F5
MD5 SHA1 SHA512 TLSH

Submit Download

fd574ba1-7c43-452d-9d52-d815d1200ed8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd574ba1-7c43-452d-9d52-d815d1200ed8.tmp
Size 11KB
SHA256 c15884720c6fc996f6a0d410eca39d19561b840840215d708d10c39193cbfd34
MD5 55891f59d93c7e99d57a444c2de47ff1
SHA1 dd23caba9c05728c4c93e3fb63bcb04af04cbb12
SHA512 32e4998d913fdab5cab8c26aeffca99f93a76810654cb6e7d245eeb4f44aa944bb8f27e3f0b67fe609b13e1be590ab511e751321721ee186747b4f929f56405f
SSDEEP 192:wRV2XcfHv7H8sAPRp2Xs9OHsb+WNnPoPbWvgUQVyIsnAUgR:wRV2XEPb8NX/kwgPCVUR
TLSH
T1AB32A639FA64B53BACDBC225FD22B757EAF5102620941E84E6FC493C15E79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe4bc506-c753-4ae5-8209-2412b19bea16.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fe4bc506-c753-4ae5-8209-2412b19bea16.tmp
Size 11KB
SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
MD5 25870f956a3593cdd54af66ae9235678
SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
TLSH
T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6eee601-f624-43c9-a217-81c04e89fc18.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a6eee601-f624-43c9-a217-81c04e89fc18.tmp
Size 4KB
SHA256 302e1f040a84562706d8516cc08bf9bf3ed7dc1be106a7dfeb1a250c6d3d9158
MD5 ba5e6c6cd54e918ad42394d20f2b25b6
SHA1 458f05b3f0e9388456380d711b9db2508095f217
SHA512 bed8427a749e3547ad8e370e532db930383291b865ac4636f1abfd614c34f06d7dae6295c990d08f8c22047a6e37cf72d5c664ea3af79abbb78fe76c30cfdfc7
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5ICiDIaB6m8dGyvELkzAvLrbuj1v4a:kC0pB+fTbnvDUDgL4w/gADrbu1
TLSH
T199A12B31A4B8887754F6C5C4B5863E43CFB462EBA8109E80C9DE1E0C10AB5F82381A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef09392-5061-4012-940a-3e92148cd435.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cef09392-5061-4012-940a-3e92148cd435.tmp
Size 5KB
SHA256 f1d4f134f6690fc1fb28d42736295d8b350e8a715c17bd3f711601e8b4ee9420
MD5 6b3a7c8dafc988e7c80a93da472a130f
SHA1 df32b0ebc372d34c1c8ace78fdbf891d5582f9a6
SHA512 40821141b3797fdc14e21c21577f96d46187a11531bf166dfa78dcd049019e143f1c0a74679bd7ee784790ffd49d5b7cb93ad47daeadf918a3a9e70e105f25ad
SSDEEP 96:K1bJ0d+OBIsu/Fl3fIUKsI8KaeI9bSl8h4otop5ICbDIaB6M/0dGyvELc6w2z6+Q:0t0pB+fTbnlpiU2TLWw/cFN+RDiUk
TLSH
T1EBC10931B47C1CB755F294C5F5433E53CEB4A2AB99109E64CBDA5F0C01AB5FC2382A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download