27f0b4010b36a0857f9a10492af817bc8b3d051440da9621af397ab5957e61e9

Analysis

user interaction
yes
max time kernel
30s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
csgo_legacy_debug.dll
Size 8.3MB
Sample260419-2dlahags2v
SHA256 27f0b4010b36a0857f9a10492af817bc8b3d051440da9621af397ab5957e61e9
MD5 b126daefe2133948a4a1dca610a035d5
SHA1 c09919ba959999d1021399716ed98dfdafd1476d
SHA512 9dd72299d729808bab72a59b535a2657b04155d202a6929f681ca0d9b502c711e15df91de82cdbdad082be18a77c0b41203bdd7fc3127895867bd92bb231d198
SSDEEP 196608:pUn2XIIQQDv9agiOffmVgGJcClFZtaGZMxFTWq8ldL/3Q:82icKTtaG
TLSH
T146963B11A700E52AF9EB11BF99FF19DD91085AF097085CC3A3E8589D83AE4E179325CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4752	4580	rundll32.exe	84
PID 2428 wrote to memory of 4640	2428	chrome.exe	87
PID 2428 wrote to memory of 3924	2428	chrome.exe	88
PID 2428 wrote to memory of 3924	2428	chrome.exe	88
PID 2428 wrote to memory of 3420	2428	chrome.exe	89
PID 2428 wrote to memory of 4160	2428	chrome.exe	90
PID 2428 wrote to memory of 4160	2428	chrome.exe	90
PID 2428 wrote to memory of 3076	2428	chrome.exe	92
PID 2428 wrote to memory of 3076	2428	chrome.exe	92
PID 2428 wrote to memory of 3128	2428	chrome.exe	93
PID 2428 wrote to memory of 3128	2428	chrome.exe	93
PID 2428 wrote to memory of 5032	2428	chrome.exe	94
PID 2428 wrote to memory of 5032	2428	chrome.exe	94
PID 2428 wrote to memory of 2708	2428	chrome.exe	95
PID 2428 wrote to memory of 2708	2428	chrome.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\csgo_legacy_debug.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\csgo_legacy_debug.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffae35ac728,0x7ffae35ac734,0x7ffae35ac740
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,2983178617606079939,888808893933773801,262144 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,7549029726001729797,14056079540951243001,524288 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,14305591416563360935,1089805221366464921,524288 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1410703602957819863,13284849729414568470,2097152 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3416,i,17454085720755983034,3103021122964757760,2097152 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,18123800644661140931,4468509411324571806,2097152 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,4008823768508681706,2348895869935131336,2097152 --field-trial-handle=1976,i,18147325082272232528,18160563109906888988,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cc05cc4f44e75a849d87f46a3b9d3609c9cc9885c2988b640ff1878be52eb91c
MD5 2f8c4a137958b3bcf1153957a68ef1a3
SHA1 0c636341c49a06d3a895cddbcd06d0f617d371b8
SHA512 258d8d669851ff3be837b4229c611ab44aeae92c91285bb53f0120f44f1430ecfcb195917014eada399bc18e04ac6938e2e752e5b407264fac22f33a1baebd1f
TLSH
T134417CF783B4997E8A0196E4AA146E1FCE690924131C7CA689D4AE1B43F2972D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 1bb429f834ab25dcb4a58e8a05b5d2ff656b0b469319536dc677d18cc0097be7
MD5 31a07c4c7fe43f4f22addf9e15febc7c
SHA1 d8015d44a0174d6501c941b726a81b1f210ab8c8
SHA512 d9e1da2d370fea541f5c1de7e279b5a5a158b356d8eefd39c4483f8284f4f38bd81aab2f2f2e5dbe3b359259c18184d31c8bed2a8f79fad0fddb771fb9df3d1f
TLSH
T1A5F00EA7E77D7417A0BC81775F04FC05A5B6B831069224E0EF6A416DE0884F30F03057
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 60ca28a6b128a569fd46fce75876409b4b503d3272ca63d5a4a1497b6f91a41e
MD5 eac569af1152e22721f161240cbdf396
SHA1 f209059651cee37ea4434b0d451e71c739b7de2a
SHA512 262c2ba06df53a4800b16c4c00d9c2bba7f17be4e68c49769f7c639d2f1b599a2d2c10cde918585f35aad13c3e7fe11a4cb128ae83f38c6ccfe761171495f062
SSDEEP 192:pRJlMQmdcv7rpAPRp2m98Hsb+WNnMI10JVvPyIsnAUge:pRJlIIHUXF6wM60fLe
TLSH
T19732B51EA914757B4CCBC229F92AB75BDBF6102134843E84DAFC8A3C15EBACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e20f580660e2ab86d0bc73cc710e55e3e582743a8e2aaf9879b1317277b58775
MD5 fb37a17e788def337a54d46bfe64ef38
SHA1 d1e1fd51a82de36e0efcb5cc74b7bc18a96e3e28
SHA512 19ebc430ca40b78da104f8b00a427f795887dca1f3230e2ac413276a52e64c0a54bdffd518493d64e0d5c3c03d7ea7017ea653e017d3511fab41f2e9f5ff7061
TLSH
T1B0B0123080419640C81302B81186148821089F198704131653F06B76EC364A14025350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5874be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5874be.TMP
Size 96B
SHA256 888f4480154a501b25a2aacdf4d92bf3ba13291faca2225e2bf98b6021dbec44
MD5 0edb3eb7495278e4662aa3b4ef9502ca
SHA1 3208a3f68548db7cf1ad1232e551e462e41bba26
SHA512 b6c8750296d10dde466b6c25a3efbda3792af2bc9b7a30f941b88fbb832610ace398c22630d893c353b72ac5bdfaec55931b869a7b86d62ae169f869c1aeb17c
TLSH
T12EB02228C003E202E00303B028C0E2E83020CF2EC283023382F02EB2CE202300830A30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 da177a5fbe199a5c556b9f7d0624f5236263c1a86ce9bcd4584ea7124f116d89
MD5 d89b502dbfb93088e8c4968666feceab
SHA1 3210add46b985fe8def635b07e72008ab023b4a6
SHA512 3b7e9a0338b23b348691aef76b25e036c5c5b58b22c6a557e4d0c142f62b791fa040c82eaedd809c895b1ee67ba2d0a9c0267bc5fed330971505ecacc799235f
SSDEEP 1536:ggcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:F3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1179302BA4E2A46E7957E469176AE780DCE12134D70AFA8CC316C539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 a85f7319cc49fde0e6c1cacd331ef698fdc5d079285180019cd68ec6c44bb706
MD5 9df6a21791c6f10732ef403be44f027b
SHA1 146213d2e12598be066c382704bfa968a95d292e
SHA512 c3c370222ba3a925e7369308f872b2d38abc0a154c30c393af5875a84a9a04084d1bab8b074914452ebe40ea0b8d6e3c9391c30805102e658de0b515912a0bd5
SSDEEP 1536:xfHcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEi:t3Qw/xLANk0mUW5GmRntSFCjEENE
TLSH
T1A79312BA5E2A59E355BE46D1326E380ECE12130D319FA8CC72A8139D21D41CD2B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4752-0-0x0000000000C50000-0x0000000000CD7000-memory.dmp

Download