Analysis
- geolocation tags
eueuropefrfrance - user interaction
yes - max time kernel
178s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 01:50
Static task
static1
Behavioral task
behavioral1
Sample
SLaunch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
SLaunch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target SLaunch.exe
- Size 245KB
- Sample260731-b9dmestybw
- SHA256 fe4e2de98a58a3d67785c9ae2343ba34f3207a2a77fe21c88c1a5488acc02d22
- MD5 a05992c20a823307544a9840a8ffed4d
- SHA1 e85cda936c5ce601da7d57e547751be93aaf5ad4
- SHA512 338ed0c985f36f72fe2411f66d4e75465b7743373d9e292bef33f89f753584e379ba957af1c62ddca95d385255f44f274f069fe7a2e2b6f7b23303361097abee
- SSDEEP 3072:bNwrkXnZkTZfGK3uhMhXktRo8LeReUZqCZKl1Q:BJ8ZgyiLTEmQ
- TLSH T18A349F13A6EC3CEAD03A8730B77747C0DB2EEC655391D58E42D006A68A7E5937E267D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 69 2788 chrome.exe - Executes dropped EXE 4 IoCs
pid Process 4180 SLaunch.exe 1964 SLaunch.exe 3968 SLaunch.exe 3796 SLaunch.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2788 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299362660426231" chrome.exe - Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\SLaunch.exe\" %1" SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell SLaunch.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\SLaunch.exe\" %1" SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command SLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\SLaunch.exe\" %1" SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open SLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SLaunch.exe\" %1" SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command SLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\SLaunch.exe\" %1" SLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command SLaunch.exe - Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 4388 chrome.exe 4388 chrome.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4312 wrote to memory of 1580 4312 chrome.exe 103 PID 4312 wrote to memory of 1568 4312 chrome.exe 105 PID 4312 wrote to memory of 2788 4312 chrome.exe 106 PID 4312 wrote to memory of 1568 4312 chrome.exe 105 PID 4312 wrote to memory of 2828 4312 chrome.exe 108 PID 4312 wrote to memory of 2828 4312 chrome.exe 108 PID 4312 wrote to memory of 4168 4312 chrome.exe 109 PID 4312 wrote to memory of 1212 4312 chrome.exe 110 PID 4312 wrote to memory of 4168 4312 chrome.exe 109 PID 4312 wrote to memory of 1212 4312 chrome.exe 110 PID 4312 wrote to memory of 2952 4312 chrome.exe 111 PID 4312 wrote to memory of 2952 4312 chrome.exe 111 PID 4312 wrote to memory of 4936 4312 chrome.exe 112 PID 4312 wrote to memory of 4936 4312 chrome.exe 112 PID 4312 wrote to memory of 1304 4312 chrome.exe 115 PID 4312 wrote to memory of 4404 4312 chrome.exe 118 PID 4312 wrote to memory of 3568 4312 chrome.exe 119 PID 4312 wrote to memory of 1028 4312 chrome.exe 120 PID 4312 wrote to memory of 4372 4312 chrome.exe 121 PID 4312 wrote to memory of 4372 4312 chrome.exe 121 PID 4312 wrote to memory of 3852 4312 chrome.exe 122 PID 4312 wrote to memory of 3852 4312 chrome.exe 122 PID 4312 wrote to memory of 4592 4312 chrome.exe 123 PID 4312 wrote to memory of 4180 4312 chrome.exe 124 PID 4312 wrote to memory of 4388 4312 chrome.exe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\SLaunch.exe"C:\Users\Admin\AppData\Local\Temp\SLaunch.exe"1⤵
- Modifies registry class
PID:1432
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff803b5c728,0x7ff803b5c734,0x7ff803b5c7402⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,782682988935622938,11416531425359866848,262144 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1980,i,4044680513559885493,10531270140423488520,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,9227261829899131704,1704076948521054948,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:82⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,4019174567104398072,17441070413099138487,2097152 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,11417499257413453036,4438624666079222345,2097152 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,5593904281453210082,8573073858379067748,2097152 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:22⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,17479937024935813935,11389456091074623693,2097152 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:12⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,1574042723345709553,17659636063059813684,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:82⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,5060411441236644922,16740105581007421033,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:82⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,16983049064799793311,17464720432576839275,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:82⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,11115952073107571256,17956400535886329546,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:82⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4344,i,6608321207305498554,308080732905633879,2097152 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:12⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6040,i,3756381332895046502,2813575960395618990,2097152 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:12⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,9010813793679686194,16463070295047235257,524288 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:82⤵PID:4592
-
-
C:\Users\Admin\Downloads\SLaunch.exe"C:\Users\Admin\Downloads\SLaunch.exe"2⤵
- Executes dropped EXE
- Modifies registry class
PID:4180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=864,i,15251701434434554864,11477977522224587507,262144 --field-trial-handle=2072,i,8445098054320180303,7859373892217578832,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4900
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1652
-
C:\Users\Admin\Downloads\SLaunch.exe"C:\Users\Admin\Downloads\SLaunch.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:1964
-
C:\Users\Admin\Downloads\SLaunch.exe"C:\Users\Admin\Downloads\SLaunch.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:3968
-
C:\Users\Admin\Downloads\SLaunch.exe"C:\Users\Admin\Downloads\SLaunch.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:3796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 feb02f5953ea056e68877b75ea0b2d1423156f9b0672ebe776c150d67fe30091
- MD5 2ca3f08b0ab7aac71da4ee4579e5d02d
- SHA1 e811883e7d420f0981af1bcb7e179ebd3d42b561
- SHA512 0ef7018ca2a3c80a8e76f00315b2793cd42746b8fdcd30cddce28dfc9b999b3d3771f859d51dc63935e60b51ca1fa25f99ad06c3013d705ce5793e6e3cc2530c
- TLSH T10EE061B9CA22EC3B19FD171964654B09E641135B77409C4F373D850C8FB4B3E4686D6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 15a7d0e3e178dc79fcdaa7a4cc72222ac174c598eb7053c73b07b51e01ae632d
- MD5 f3988483dfcf4512dc1eb816881b5eff
- SHA1 d5eb2672dc12c263cc17b8d186ef48f98b108924
- SHA512 3c878d936c4876279550f2e6f0ead5b48ec9df0a82884dafc6fae47fb199faafb7d46c2cf0ac685b40577ce688b52a14de9d08cbde5e3325598176cc8f24304a
- TLSH T135D02247B34C2834C7900CF0C00000A03EE4DCBE07833EA343C0C08A08FAAE322029B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 083afbd0e74f991f850a12a00cc300d2bccba57f5092887d421cbf7068cef77b
- MD5 74cbb081ad23349f9a57b33559ec2129
- SHA1 b6b8438f891503bc97be778751588cde9eab4ce4
- SHA512 0c3b14bf832499d91ff4b008cf2036e2b37a3cae9f584241bbd963a057a5199d9b00a985bc4a7e46d096122c7f2b2ad869bd01bf7b555b8bbb981294866d2180
- SSDEEP 48:YALlqBqAhIq+fo7XLsi4srgmzsUdQ2sRbRs7Iysc8Fsnqskfsj+sgqs6Ksj/Qa:D69Wra/rfd8boIyFO6qM5X
- TLSH T1D9917EB7D3E5DA7D891156F4EB256E1BCD2D0A24122C3C62C8D8AE5B53F2872E20134E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 bf57a9320446b40dc15dcb5766e77edba7c72b5537d13923f59a62dc03f784fb
- MD5 1bfa625032005468f40117122bc95709
- SHA1 63de53410279bd6a0c6e49659b4e87866e749b2a
- SHA512 a8dd1e1b880bb9ad21619a3cdf486691545086bc301997a480a0dbf11c899f1858e8e9a88936ae41da4145309419bdc23a19a0947a9f8b09e3f1b5f02acd2513
- TLSH T19C717DB3D3E4DA7D891166F4EB256E1BCD2D0A24122C3C62C8D4EE5B53F2872D20134E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 e8bbffa28248cff00c0a8a35d2402f7a86caa3a06b297d0084340a3cff775373
- MD5 192e6501b7fc75bdf5bbc14c435519d3
- SHA1 a1f93b85c214ded6f301e80475e032dfb74949a6
- SHA512 89cae5c06a92d9bb95a5253600db821e832d52db871867b27f7925c6ad2ae8fb30f00b22ca6c752e9bf6995b51c9633e9708f982f450b6421505a36b999cdbf4
- SSDEEP 192:CR45PsSKoT0v7MF+IAPRp2S9HHsb+WNnKJtHjna80UeYVyIsnAUgraJ:CR45ZbTwgoJX91wMtTax8e
- TLSH T19E42D72EAD11297B6CDBC61AFD12BB57E7F5103131852E84EAFC8A1C15E7ACC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 57e8d0f51e46389307c314cc3bb8ef7b413789e0cec4ac891a41da2bc0c54665
- MD5 e10a40dfa916ce9ae0d2c4c4e7563ff9
- SHA1 9df53fda0282bcea192ebe493d1822583a6fff93
- SHA512 b6a459a97b743f0654bb3cb10c27b2361d171a3111c85245a6228a79d1fa94af073b79037eab253db8def61281d2b37f079a4e4830a6c8112792de8a61bf3cd5
- SSDEEP 192:CR45PsSKe0v7MF+hAPRp2S9HHsb+WNnWcI0Sjna80UvVyIsnAUgtaJ:CR45ZZwgo8X91wk0eaU8
- TLSH T1BB42E92EAD11297B6CCBC61AFD22BB57D7F5103131852E84EAFC8A1C15E7ACC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 605e2d0ea1ff1609a6bae339739464699ed6cccc28734dc9799e3a45c0c3bec7
- MD5 bc12eee9fbb359d0a53110979222a40d
- SHA1 c53aef7e3e0f72b81d65e535c05acd0e22326a8e
- SHA512 946f4a698def37d54d9c8bf8a3c1ebed39c5b19c8f6b4ef9b35619f2c8c9d6c31eb462aebc5bd2e8af89d748bdd84f39f8cbe87d0e5415890f038bd4220ff48f
- SSDEEP 192:CRnJPsSKy0v7MF+IAPRp2S9HHsb+WNnKJtHjna80UeYVyIsnAUgraJ:CRnJZvwgoJX91wMtTax8e
- TLSH T14852D72EAD11297B6CDBC61AFD12BB57E7F5103131852E84EAFC8A1C15E7ACC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 439e5b0f668a8e2694037eeb67db4fba358a6ff5773dbb221d7bd021ff39f787
- MD5 20e3d4eab25a3122d30a67542acb15dc
- SHA1 57f54d59a719fb8f0e640e16e612b6a851f4706a
- SHA512 dd6e1d96f1b00ea80addf089edce41e597b5bb3ebe0730e7b3ea8ba5218e1a5eb1db50ea1c969fed8de63f9e610221f92420fa2528b8e622d98ceb536ee7f9b5
- SSDEEP 192:CR45PsSKm0v7MF+IAPRp2S9HHsb+WNnKJtijna80UvVyIsnAUgtaJ:CR45ZTwgoJX91wMtOaU8
- TLSH T1B742D92EAD11297B6CDBC61AFD22BB57D7F5103131852E84EAFC8A1C15E7ACC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 44456b99614e4ffa7bb568aad3450b5f542797d76de2158bfb858ec61b613784
- MD5 b5d8114f3dde6c5daa700e686ce0b5bd
- SHA1 e2779a3a4a969ba8585c46769b0f6d321b61f357
- SHA512 a0ad97acddd1fee886af5a9a5d91b6ecd710015060e7f0eadb0dc8454cd3dec73e446f0189e6cd0efed1861e928a9e53f5b5b4a5734c5664074d50635153a919
- SSDEEP 192:CR4JPsSKy0v7MF+IAPRp2S9HHsb+WNnKJtHjna80UeYVyIsnAUgraJ:CR4JZvwgoJX91wMtTax8e
- TLSH T15B52D72EAD11297B6CDBC61AFD12BB57E7F5103131852E84EAFC8A1C15E7ACC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
- MD5 73285efb9f7ee0bd384426865ccccf8e
- SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
- SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
- TLSH T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 afd6c14782f9eb258eea19625b175fb0a3c1859ee90f6850fb9a3dbbfaec7088
- MD5 18b3652912667d0c944485341f3a3b34
- SHA1 75d33f640b0f6736642456b6e9ea35f43639a2cf
- SHA512 6f5a4f6be2eefef11e265b50985715fd7d25d3a1e85d9c289cce41632d538485d1bc2f95e8e0a036b2000a7a689a3eac94eefdeed46c4031f77c5dd86674949e
- TLSH T1B9B0122280419112D84303B43246188871186F249B0A270543E0AA22CC295B18014161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590507.TMP
- Size 96B
- SHA256 95c01047729fafbc7e9df51a564de3bfd37d65cb4f98605ff04af49fe6b9ca70
- MD5 736006edece07c0e16e3630448544959
- SHA1 554cafd7df1919a2ef513dfca0960869c81aec47
- SHA512 5828260c3e93b7ce4dbb9ca7b0c3cea4c3881d36a725dc27f121c09824a256bb1bb66bb0990eae8054d00f799813bb8971625396e7a2f7b9043144bc8fa7169f
- TLSH T116B00256D647A313C14203B1399595D87170DF26DF831312B7E41EF7DC29EB14635261
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 2b7454e2f310b0b1662f018ad46eaca7855813b529ca1273e6d28c466a8c86df
- MD5 4aabbe4b86a694976994d07629f033f8
- SHA1 21583425edea237cef6973fec815bfb27641658a
- SHA512 340d5dd04a49fbebfc14302440cb4afb9a186af8a500ffde7c5d3385c48f2c654196103a0a2c2f97f5f71c6965c33de57c31339f647a802862e47b126eeb77dd
- SSDEEP 6144:qXsFc6ni+GR+up715m7Rkm1tYpBeh2BAoP:qcFxiTt69oBGcAoP
- TLSH T1E234122B5CA4DA7B496DF73EB04E260B1EF18D42C418E29AD8996F0473C8AC51F1F974
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 85c4e7e02fde72569ae5eb280e136fc070c9740f29fd463a6fe9723a6e264f98
- MD5 19a93c7d4adcad026d0933491ed42a80
- SHA1 c4a37ab3c399e0fbb6210e8e58162b9042df7c77
- SHA512 b43b7b5dfb9ba41633b884c355da17fa0308d29c451ecf36c1b03d3a6f96d7bdb13ae687a317bb90adb1c427e83d1a6e06e3674c77ae42c6a4cc96817c95a0a2
- SSDEEP 6144:q2KsFc6ni+GR+up715m7Rkm1tYpBeh2BAoP:qGFxiTt69oBGcAoP
- TLSH T15834123B5CA09A7B49ADFB2DB04E250B1DF1CE43C918E65AE8982F0473CD9845F1B974
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f3abbf50-86c3-403f-8dbd-ff5f9017bd99.tmp
- Size 115KB
- SHA256 e8e5aaee097123e3bcecb77362d8a8db0853c09b59baae563ce625142f102f32
- MD5 8353b6dd2761ac642b7e377c9f3d0720
- SHA1 319a3a101149bfa47605f32b7fe89af1c79c5b2c
- SHA512 e7846864a3a8fd7ecf8f4955f61f89ecf3ad523c0bd37e1cddb979b8212c092d7440fc4c510a281fd047a4bdb430582623dc2abb2255329910d6e201af635610
- SSDEEP 3072:/iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Vm7Rkm1tYpBeh2BAoM
- TLSH T136C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SLaunch.exe
- Size 245KB
- SHA256 fe4e2de98a58a3d67785c9ae2343ba34f3207a2a77fe21c88c1a5488acc02d22
- MD5 a05992c20a823307544a9840a8ffed4d
- SHA1 e85cda936c5ce601da7d57e547751be93aaf5ad4
- SHA512 338ed0c985f36f72fe2411f66d4e75465b7743373d9e292bef33f89f753584e379ba957af1c62ddca95d385255f44f274f069fe7a2e2b6f7b23303361097abee
- SSDEEP 3072:bNwrkXnZkTZfGK3uhMhXktRo8LeReUZqCZKl1Q:BJ8ZgyiLTEmQ
- TLSH T18A349F13A6EC3CEAD03A8730B77747C0DB2EEC655391D58E42D006A68A7E5937E267D0
- MD5 SHA1 SHA512 SSDEEP TLSH