Overview
overview
7Static
static
3legacylaun....0.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
4LegacyLauncher.exe
windows11-21h2-x64
7d3dcompiler_47.dll
windows11-21h2-x64
1dxcompiler.dll
windows11-21h2-x64
1dxil.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...er.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
300s - max time network
313s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
legacylauncher.setup.3.5.0.exe
Resource
win11-20260130-en
windows11-21h2-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral7
Sample
LegacyLauncher.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
300 seconds
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
dxcompiler.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
dxil.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/elevate.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
vk_swiftshader.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
vulkan-1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral20
Sample
$R0/Uninstall LegacyLauncher.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
300 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
General
- Target LICENSES.chromium.html
- Size 15.3MB
- Sample260421-e8kacshw9m
- SHA256 e252ff70e8d0a84350dfb28fb0a217e2955c7a5fa6599328643a02fa28ddaada
- MD5 ac3819300c2dd8002d56beb3a0d4aef6
- SHA1 d56a42c5d48c7ffe8f3b95c6c47f731d003e419d
- SHA512 5c5dcca04887d625cb52fbd2df610856618d1baa055f933244eabeb2c6518797f63b451f7aa37d2cb68bd4d427e7eddea6cbaf319725499cb5e3b532d024c603
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6DNgQdGxw:w
- TLSH T1B3F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4948 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212200421345614" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 5624 chrome.exe 5624 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4308 wrote to memory of 1028 4308 chrome.exe 79 PID 4308 wrote to memory of 4300 4308 chrome.exe 80 PID 4308 wrote to memory of 4300 4308 chrome.exe 80 PID 4308 wrote to memory of 4948 4308 chrome.exe 81 PID 4308 wrote to memory of 2552 4308 chrome.exe 82 PID 4308 wrote to memory of 2552 4308 chrome.exe 82 PID 4308 wrote to memory of 3536 4308 chrome.exe 84 PID 4308 wrote to memory of 3536 4308 chrome.exe 84 PID 4308 wrote to memory of 4320 4308 chrome.exe 85 PID 4308 wrote to memory of 4320 4308 chrome.exe 85 PID 4308 wrote to memory of 3540 4308 chrome.exe 87 PID 4308 wrote to memory of 3540 4308 chrome.exe 87 PID 4308 wrote to memory of 5396 4308 chrome.exe 88 PID 4308 wrote to memory of 5452 4308 chrome.exe 90 PID 4308 wrote to memory of 5328 4308 chrome.exe 91 PID 4308 wrote to memory of 1872 4308 chrome.exe 92 PID 4308 wrote to memory of 5624 4308 chrome.exe 93 PID 4308 wrote to memory of 244 4308 chrome.exe 94 PID 4308 wrote to memory of 244 4308 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa350c728,0x7ffaa350c734,0x7ffaa350c7402⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,11351627093531570523,855944277009190614,262144 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,3052123197534221362,14459088543144354070,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2228 /prefetch:112⤵
- System Time Discovery
PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,2974879626950152136,1630461721948416041,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2360 /prefetch:132⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,3352316826503863608,3812098628108087037,2097152 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,15473867284407633095,4766901703213312863,2097152 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,6350915698870930070,15321179594388163719,2097152 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4024 /prefetch:92⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,8138074678593943369,17030408368799000464,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5612 /prefetch:142⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,7317500720371397872,18294541068142393769,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5624 /prefetch:142⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,15738326558926748424,2436416704678733174,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5804 /prefetch:142⤵PID:5328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,11888666382616894661,6932763347841401748,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4960 /prefetch:142⤵PID:1872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4768,i,17221752912929290119,2496280799784484261,262144 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5800 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4336,i,10566795017624460050,1047260397612622726,524288 --field-trial-handle=1956,i,2705728094456532645,16864146915616743909,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=740 /prefetch:142⤵PID:244
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e992cda834e4300610c87c2a215e66a26b5e07a06a689ab0a5830649f071462c
- MD5 a873193d696533b1fbc7e8b4d4855d90
- SHA1 89849ca1a9599bb209b9d9ba29b8f3527d718f94
- SHA512 d7f4896754e3f5eeed96bb68bcfd2a38b703c088049013c8a27e0e3c865592fbcd8ba5f47eadf06ccecf6f1dd83972ac797f51345eabcd44362a4ea1624235c3
- TLSH T1F2E02BB9C921DC2B19FE0B5C70550B46E708131B2BA0858B3F3C52094FB5A7645C585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 065ecbc3e650882b21eb225aa890ab6cd1908d7471518790eeba7a957a34d00e
- MD5 4cd5e020a453c2bb8559578dcf3375a4
- SHA1 8bb933767510e41478d553628e122e6a25420845
- SHA512 0d8d6db1a6868a06bcabe791a58f2e9394286e5ff686e4076003aa322f43815c33cc95ddce1364663f729408b68aeb8c14b69c268dea0371342184d1a20172bf
- TLSH T142418BF793B4997EC61192E4EA146E2FCE790524031C7CA289D8AE1B43F2972D20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 17a093d0106ff091a6fe5a5621dca9fbdce26c76fce8c55bf45f914cb0ecbd04
- MD5 b426aee89942f5d7a5c0442925930cb8
- SHA1 1ad4eb1f97694e2593c615b5ad10100f461b569e
- SHA512 7f0cdecb4537eba6c9434533de828bc8fb9df8e75d4c7da355a6289533182d01a705c3e5d3a843b18b0bf966c21b6ee29d84c964d4a46318960f35415218df94
- SSDEEP 192:xQRKJf83wkv7XpAPRp2uY9BHsb+WNnquPs12a8OskwKS+VyIsnAUge:mRKJ/A7UXUDwHPY2a8hr2e
- TLSH T1EF42E82DAE14693B9CCBC319FD66BB57D7F5102161841EC8E6FC8A2C14DB5CE221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 b348ef89a2004de3932b2d422cfbadcb8511ef1f7a57517647d45e46cced5182
- MD5 b0d1f07abc4aceeca25ae213a8bbac55
- SHA1 a12bc0ba5cc6482694c623f530bb61f84aa919e1
- SHA512 31718e2157284309c07a2a635a298c85d9a7fbefa24d929b57b0b42e496770d473b3856a02414740260339a70352d551dfa116ce6cda0e72e227cf4c48e62db6
- SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLuLcifa7XOD0z+ErU3W8HGWTStBdUV:460v7KxkXqKf/pUZNCgVLH2HfgsyX7p0
- TLSH T1AE72F867AC4C9A770F94C6CDDC26BA4FADB5024B65DD886483FB581903C5BCB110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 7ee9c352bfa8605ae3177625bc1d577523dfe2b6bb02ec8e84667dcc6170cd86
- MD5 e137f6c6895b27ad5ed96d64ead37898
- SHA1 8dec6ea406a8bbe53d164909cd3173716ace5241
- SHA512 2d4b339cee409c467461c6d309576d9faee88bfac509656678f681c7a0dc7ef66f6d3d6eb6c8b6d39fe545b2a483cc5f25c55b0af019b358964adb63a5bb572b
- TLSH T1CCB012129881B511C04702F01186188831785F208709230353F46976D8371A14015292
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58848d.TMP
- Size 96B
- SHA256 3559af6cc2f5686d88dac87de85121f78ce17a0b80fde35b8c777a9ba17b5fd3
- MD5 0f01ead174d2cf73deea3b04f43e9981
- SHA1 4e5c152a17c298feeb9f44e0bf562578d4c6eabd
- SHA512 f52fee41cafc04cbe366619ec1169eea5410a24a4efb573b7ce5d822d2edfac816e6d22b2a3ee4b37b2758ffec91469acf535dcec33d43d2e6c0582fbbe0d49b
- TLSH T13CB02200C002A222C00303B02EA080F832E0CF3AC203232283E00A22CC20AF80020030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 bafb095b4e3cba7384691ddd8e318de6d8f40bda430598aba3fbfc7480d370c0
- MD5 ff65950c65a63b0b5f15ad74490304be
- SHA1 500bdd9dad5749ecb4680a7b748a8936c110800c
- SHA512 e68b1c112ee203055b19eef7cd7cf604911470aad2f2ba51345ee5520143027c6b4aa3fe9e1124422687134a1ad95f8a671b36e165f0a3d389573c107415a018
- SSDEEP 1536:DP/k9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:4++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T18D9312B8981F7D3953ABD6A690079CAC4CD3DCCE2118257C31C72F5E04BA393A3478A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 d400c052a497f962277675e1db867da901e302dca7e2a9d81d63ee0484bfb56a
- MD5 703ce4cc9229a61b063dcfb5d1adef08
- SHA1 ffde3b5788ee294dd188252ec559c4a7f06ecc9a
- SHA512 b858f128015fdc769da7fe3ca7e2634cd544774233fe9342fcdde35316d19d527e5381f95a56950c8761af228c9f7995925cfb69a6ba9c3e53673c83ea58e460
- SSDEEP 1536:jP/k6P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:7++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1E49302B8691E7C7953ABC6A690079CAC8CD3DCCE111815BC31C75F1E18FE392A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 3e82075112ebcc6086e1c30398708e3cdcbfa58eb46ebf4ebb941bf49a7988ad
- MD5 06807f4858f7945d8ba03d6c22d5fcd9
- SHA1 5575a22fcfa46c22b23bc7b9f7e4097d870d4a32
- SHA512 60d2c7afbc071a99e784ecde9d117c85bbc3e28b462250426208ae598f8836adab4c6173c7c4dd1ae60303756d90fc5c2826dc168ada76fea6985a981a9db855
- SSDEEP 1536:jP/k9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:Y++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1BF9302B8981F7D7953ABD6A690079CAC4CD3DCCE2118257C31C36F5E04AA393A3578A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 b816c0aa672e012c1c7e14437b4d368192fb09cd0b0503e7f70c31d6eb574f94
- MD5 a5f2be22b8c5d5a32d66a15d25a4c28a
- SHA1 f91180e076974ac99c6807b452efa74c8465ddd6
- SHA512 91acfbb24aa43e9a45a1b4eedbb14983c8cf23a3c819c778c8cd9171aa3ece4c9109ea948969d0ea017fc2939fd35e0fd30f03e116cf9ab5b42b1858071cb39a
- SSDEEP 1536:GP/k6P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:k++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1129302B8691E7C7953ABC69690079CAC8CD3DCCE151415BC31C75F1E18FE392A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 a6f8ce857d6e868d35dbd2acbe90ceaa582a3cab34be34d74eb00bbcb9f71962
- MD5 296aa5ae75bf7f5612870a8f3372aec2
- SHA1 5b19ff2b7bf492b223d81605d9db927a5b18980b
- SHA512 f1e2d9bc1c1dbe19be95e902a5cb030078459a42ccf26ebf047d5f1130b098e0b74584a9b5ae450eef5c4bea007cfbd18d04063bf7a54185f5508273b7fa77c6
- SSDEEP 1536:aP/RoP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:5++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T19C9302B9991F7979636BC29690179CAC4DD3DCCE111421BC30C76F1E18BE393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH