43044912663bbd1ef446a0a77cc83083d5c2086cadfb2a85661bc6c06d8e13fd

Analysis

user interaction
yes
max time kernel
20s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LeagueClient.exe
Size 29.1MB
Sample260504-d3tfeabw91
SHA256 43044912663bbd1ef446a0a77cc83083d5c2086cadfb2a85661bc6c06d8e13fd
MD5 4a6de0fe8058bd0b109d32f52e736c04
SHA1 7b82f40b352e330654dd63ce4c82b6ad0d2457f8
SHA512 5ca205a730e4594e5d74ae5f32e25877496a497f215119251397b3c5b776193eaaea1359fc2b91d82b89540cc15bdfbac700ceb5b6d4fd9a6348b6681ad25c55
SSDEEP 196608:TBm9ik79KkvQ0QKA9/ImR7dBAuw11ZPC1fPXGwmrz5u7AgpUfTC55tGL3T03zzkq:TBI5UKcfLA7PC9mrunp4c5U0fkUTqG
TLSH
T16B678E27629212FCE0BAD2BDCA5B8913FBB1349A433566EF05A044525F57AF09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223391831101279"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5252	chrome.exe
5252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5252	chrome.exe
Token: SeCreatePagefilePrivilege	5252	chrome.exe
Token: SeShutdownPrivilege	5252	chrome.exe
Token: SeCreatePagefilePrivilege	5252	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5252 wrote to memory of 4240	5252	chrome.exe	92
PID 5252 wrote to memory of 5652	5252	chrome.exe	93
PID 5252 wrote to memory of 3844	5252	chrome.exe	94
PID 5252 wrote to memory of 5652	5252	chrome.exe	93
PID 5252 wrote to memory of 4016	5252	chrome.exe	95
PID 5252 wrote to memory of 4016	5252	chrome.exe	95
PID 5252 wrote to memory of 4264	5252	chrome.exe	97
PID 5252 wrote to memory of 4264	5252	chrome.exe	97
PID 5252 wrote to memory of 6096	5252	chrome.exe	98
PID 5252 wrote to memory of 6096	5252	chrome.exe	98
PID 5252 wrote to memory of 4072	5252	chrome.exe	99
PID 5252 wrote to memory of 4072	5252	chrome.exe	99
PID 5252 wrote to memory of 1692	5252	chrome.exe	101
PID 5252 wrote to memory of 1692	5252	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\LeagueClient.exe
"C:\Users\Admin\AppData\Local\Temp\LeagueClient.exe"
1⤵
PID:4608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9148c728,0x7ffa9148c734,0x7ffa9148c740
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,1211790069753828239,16842552719754573318,262144 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,8620035970404827779,14894525256372065789,524288 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,861017568860196563,15047712880842275645,524288 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,3668056646226107956,7450901233626295016,2097152 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,8697865086266355162,14858023132775607733,2097152 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,16458388102876210187,13962670037287996445,2097152 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3940 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,571031808819667575,2673649694895241457,2097152 --field-trial-handle=1940,i,15805404273599103895,14783241327570320227,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eec3bd782fa900c49190dd85b29e40d56a2ad13cd9481ebfe91ecf2f2d41ae47
MD5 8eca35ad26385c2671e7024f9c23553d
SHA1 860323a6218476616c72317373c1f62dfb5964e0
SHA512 74d5589bbc8188c12d6e73a1bd6dd1e0a788f405cbd6ed72531df21e21c6e6110092b0f312b28ed93f300395dc4ee9d80494c069473feeda440bea0360e0b539
TLSH
T1B4E02BA6C860A87B08FD0728A14D574AEB5923573F80998F363EC20CCF71636959AD6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f93e628f34fa1d24c9eca95f14712afa1acb076572af90e17c657d6a32056c9e
MD5 13e302d86e4db689e677453735a37e0f
SHA1 d3f94fde06fb56a4848a3cd90a317084a8c0c11a
SHA512 d20bb68a439d3b0287740483638613b74c36583544c9debf2acb32ac06a1b0bae2c5406de2dd76d068ba03ad53576e61717e2fa875c5baf9db355ae78c3c3729
TLSH
T165418BF793F4997E850192E4EA156E2FCE6D0925131C7CA289D4AF1B53F2972E20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 7d59c9b211340cff56e7206fd630dcb424372168bd18c660ff4e1ef6c25ac4a3
MD5 2eb20f058aecad5d4d2f9b66cf58e79e
SHA1 60346ce7b088b298514090fa4de1995be74b3b12
SHA512 16ca032458a156756b82f48b891288d5c7a0322d2d05b44e20dbba472dbc8366e71cbf7c79ea56f6fafac2a5d9784ba75dbb2cf8e7b9c35b10fb36a1c7650f27
TLSH
T1F1F050A7B67D7827107D44775D0878496AB65831068558F0DEA7456CE0D55E31B01117
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d102ad3090cb607a5d2b6bb5f200608c70125a5c124ad2f351c59e4e73e06c78
MD5 ade961678bd05e7c5fa068300e76a78a
SHA1 23e897ecff4d61307b9eff595d5d7134c5ae9719
SHA512 b4e9615fba089803883537cb1336925fb0de262e57143abc24920b2185c1b71eadd33fd2c95e6dee6be2acdd5c47de341931469620d3f9d2f61837c590c1dc68
SSDEEP 192:VRs6PZRNRf/v73pAPRp2V9YHsb+WNnh+0JzPyIsnAUge:VRs6xhXTUX6Cw00pe
TLSH
T16332D41EA958657B4CCBD229F961BB5BD7F5202275D02E88E6FC8A3C10E75CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 15acd3caa3f8fe7d25613bcb3f37fe1954c1f9a815be96c5d91e169369110fe0
MD5 d012769c2d63bb8ba88e1d7ceeb0704d
SHA1 842c570bc285439cf76e52847834f91e724d4683
SHA512 7942e26e843670e8ebd78acef93358bdbe5c69a7b5b14ee25b0ed6d3789ebab0065fd453794ed36429796f444f1b850df7b8af7a7372f74459c7ab5e97b07404
TLSH
T1DCB0125180017500D00701F42546049C2118EF208A06130963F0AD75D8671A34114250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58462c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58462c.TMP
Size 96B
SHA256 fff3c6915d96c52c02c4279e9f75b464da466515fd676eb1f784fdad3e830193
MD5 0e32c2c1a1dd8a57a6175c9984c048db
SHA1 293efb1d294c7312e63c7de87677469fb655a2f4
SHA512 1fb307d42de4535bd4d7329dd3f5f2444ddb1b0595ed35cc0ad1dddfae0b35d9fbba0d759c4c48a271c76b224d1bb4ac85830d78fc18dc43c22353189f42a10c
TLSH
T16AB0025AC1126223C04207B07D9595EC7560DF39DE57223B92F01AA6DD367F1C7355B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 2467212d52af2bee6c60eb1d96266de43edd55cf05dc4a44899ab700802a0796
MD5 f3133ec5ae522c9c73040b23193772ff
SHA1 e9baa09d729b30539ed476aad741f8cd1e212dca
SHA512 07b658c22861a217621f1ebb6e98778ab6e76acd2708f511b7a183fe129554d2f65f0f64484a6fff718d26dbd524f598f0600dc5dc99c35c9bdb1f3cc29b7bd6
SSDEEP 1536:5v6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:k3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1569312B94E1B46F7957D468276AE7808CE22234D709FA9CC316CA39C61D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 3dd372765f38039edb59102c0ff24177d4540de0e6cabcbd1a52954c7d06f361
MD5 1d71aca9710644462032c3036f295355
SHA1 11808ea0f6f8020c6a73e56a684673c9ea9be879
SHA512 5f5dd2c4987836b21df3881bcd5f1d8b9f94ba59f17223a6953b19a8f6fceecc1f86fe33e97141363f6fef669a3d55a4db967f94a20f2b5a98dace251c73bb5e
SSDEEP 1536:e9KxHcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Y:ccH3Qw/xLANk0mUW5GmRntSFCjEENg
TLSH
T14D9312BA5E2B4AF755BE4691725E7C0ACE12130E715FA5CC3268939C21C41CD2B73E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download