51b818bb05e61852d87c5da73907f36352886326655341363b21e6225775f7d5

Analysis

user interaction
yes
max time kernel
465s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.exe
Size 1.1MB
Sample261023-axdafsbs8l
SHA256 51b818bb05e61852d87c5da73907f36352886326655341363b21e6225775f7d5
MD5 7802627ce23471f23163fc8a1cf0f5fc
SHA1 b682c7938e5a1a1559b84e0742daeb743b3a1868
SHA512 8eedb5440e790aa759ffa3eaecae442a9963ccecd169b6283f654c95c36081229aa9b40104886939c1e6bc3224fc5f86834e890a234f2ebee34195ca15048115
SSDEEP 12288:ubs/m0E54jwaFXGc8lEBBBHGBKq2IZwD4vfqItNqdg:ubOVE5ifGPRZwMvf3fd
TLSH
T187357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	4872	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5976	launcher.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\launcher.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\launcher.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 3616	6084	chrome.exe	89
PID 6084 wrote to memory of 4872	6084	chrome.exe	90
PID 6084 wrote to memory of 1740	6084	chrome.exe	91
PID 6084 wrote to memory of 1740	6084	chrome.exe	91
PID 6084 wrote to memory of 5712	6084	chrome.exe	93
PID 6084 wrote to memory of 5712	6084	chrome.exe	93
PID 6084 wrote to memory of 4216	6084	chrome.exe	94
PID 6084 wrote to memory of 4216	6084	chrome.exe	94
PID 6084 wrote to memory of 3784	6084	chrome.exe	95
PID 6084 wrote to memory of 3784	6084	chrome.exe	95
PID 6084 wrote to memory of 692	6084	chrome.exe	96
PID 6084 wrote to memory of 692	6084	chrome.exe	96
PID 6084 wrote to memory of 5684	6084	chrome.exe	98
PID 6084 wrote to memory of 5684	6084	chrome.exe	98
PID 6084 wrote to memory of 5772	6084	chrome.exe	99
PID 6084 wrote to memory of 5044	6084	chrome.exe	102
PID 6084 wrote to memory of 5044	6084	chrome.exe	102
PID 6084 wrote to memory of 5752	6084	chrome.exe	103
PID 6084 wrote to memory of 5752	6084	chrome.exe	103
PID 6084 wrote to memory of 1264	6084	chrome.exe	104
PID 6084 wrote to memory of 1264	6084	chrome.exe	104
PID 6084 wrote to memory of 3456	6084	chrome.exe	105
PID 6084 wrote to memory of 3456	6084	chrome.exe	105
PID 6084 wrote to memory of 4676	6084	chrome.exe	106
PID 6084 wrote to memory of 4676	6084	chrome.exe	106
PID 6084 wrote to memory of 4832	6084	chrome.exe	107
PID 6084 wrote to memory of 4832	6084	chrome.exe	107
PID 6084 wrote to memory of 2076	6084	chrome.exe	108
PID 6084 wrote to memory of 5292	6084	chrome.exe	112
PID 6084 wrote to memory of 5232	6084	chrome.exe	113
PID 6084 wrote to memory of 3640	6084	chrome.exe	114

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Checks processor information in registry
PID:5548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9868ac728,0x7ff9868ac734,0x7ff9868ac740
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,16778736723732247960,6972463017650597413,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1912 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,7027194063485185729,12027514708785497420,262144 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,10566658383842713534,16708510594612874663,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11101758556121029773,6099572098732450551,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3372,i,14733085157269628864,17517622517900533024,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,17947055964562113971,8823398334836549969,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4060 /prefetch:9
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,7389605058685162303,16896436640025038873,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,9985256851568652943,639653817424696563,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5760,i,1574581109983007866,7378496109235812449,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4640,i,11107923361393166086,7643498788416706542,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3496,i,17118670581626978539,3020155343729575180,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4780,i,2775972750138153872,12354370762526326411,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5556,i,1111950434962906713,3776101046032169634,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5968,i,8138791825436269496,4229126694893205884,2097152 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,16391076868226126873,16888098619895965351,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3580 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3632,i,7076704837335021569,11236349532542270329,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,18193020056566338361,14321160404137018739,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4560,i,13990838601983006118,13975406456528245919,524288 --field-trial-handle=2020,i,17517070647098422726,9666878254997785711,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3420 /prefetch:14
  2⤵
  PID:3640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1032

C:\Users\Admin\Downloads\launcher.exe
"C:\Users\Admin\Downloads\launcher.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40f05fc2-9986-4efe-b7a3-991b1c9e9859.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\40f05fc2-9986-4efe-b7a3-991b1c9e9859.tmp
Size 131KB
SHA256 de30bf6cd4050aed7000509435d6bda48befecac6ec52931bf3952bb9b691b18
MD5 3c58f20313d30278a127b72fd76d1009
SHA1 7d4c8afa4a44d73762b0790f7de8c108c606fdfa
SHA512 a934688862302980140a2cb28d02951f8cc937fb5ff2d8635fda8a98e4430a074dc3f95fa86072397266e6f01f10ecd7de71640b2fbb50f1ded2fe1787ec66a1
SSDEEP 3072:JIT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:J/ThDxWhaj5mjie/JYFobx
TLSH
T1ECD312239CEE01FB14BCC508907D3F0096F985B39640FFA39ADC6A4FA1D7EA4A366155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48a75b2f-8414-4619-9a5a-a3bed3d13e75.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\48a75b2f-8414-4619-9a5a-a3bed3d13e75.tmp
Size 330KB
SHA256 d8d0321ba87c552daba25ffd3ee0fd867f3887b9a57100dd6b5641fe1658c8b7
MD5 ff5d78a913f7922b9e173fe7616d06c4
SHA1 a347501622710edd97e8fca0b9ba7144ae6f4e6b
SHA512 24488f0c0f9e0415d49fea739cd2c937ae1d2ac1c20adff0b2b4c2061c8f2895823ed957e2b76582485b4145fd88076b8c2b4735b96d3cd1943a0bac6ac39dde
SSDEEP 6144:TNqezTFxIjJ8rkGpI2wCbJUiitbHThDxWhaj5mjie/JYFobV:zgjctI2lbJBIbzh/NmT/JYOR
TLSH
T129742373A47E15FB587EC128205B1F0405D899F34800FBABC7DA68CBA5C7DC0A7A9DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a7353bd-3960-4f42-8b46-17d946b6b8e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a7353bd-3960-4f42-8b46-17d946b6b8e6.tmp
Size 270KB
SHA256 b3c9cc8c8b0225f494409c3cbfe08cafd7a6f2d84db7ac43df903811c3df8330
MD5 6d05fa5742aa89243402730e95a50508
SHA1 47e9be76cdb6b8074e74b3dd393491758e6c881b
SHA512 9c1e6ca5b13e8c5d26f01aebf6401e9e1085b75633e313dae19e5e663eebf6a45443ffd47a975081a2ea369cb3f09d2a8b3155b48dc6af13c18067f2d609b4c3
SSDEEP 6144:W86kGpI2wCbJUiitbHThDxWhaj5mjie/JYFobV:D6tI2lbJBIbzh/NmT/JYOR
TLSH
T145442373AD7E15FB593DC03C202E5F0002D589F24900FBA7C7DA558BA2CBD91A395DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b73fc9c-8e79-4cb5-b80e-98610c25071e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7b73fc9c-8e79-4cb5-b80e-98610c25071e.tmp
Size 270KB
SHA256 b1b73337bb282202520a853a8020abc177f05096dd25e0f6edcc1eebe3063334
MD5 e7bb32b6626617ae20dfef7926faca9b
SHA1 f36529617e6a29459a13c97fd0619f54f33762c8
SHA512 bc1e38aac6997ae3f0d829e46db97193ec6f0c4c56dc947873bef6208300217520aa7b8bb39b8d8259e047467372b98e0be7e8cb62e2403007e79d68fe6faf80
SSDEEP 6144:T86kGpI2wCbJUiitbHThDxWhaj5mjie/JYFobV:A6tI2lbJBIbzh/NmT/JYOR
TLSH
T1B8442373AC7E15FB593DC03C202E5F0002D589F24900FBA7C7DA558BA2CBD91A395DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f45900ceeb7dc9678556463babb47662b5e544418a8cd415a5a3f9de01629e1f
MD5 9b9ccd6148c837ae3e8ed6a0a6345a9e
SHA1 6d0831a5a28910b0448453ecd510109643c80ea5
SHA512 bd19012e102b93cad070dcf6b461d144328094253aa3760416059c8df402e40a34382c33d5a55fb22f8a477484aa221270b043d913647dbdeeeb044acfd928a0
MD5 SHA1 SHA512

Submit Download

24df67e6-8280-4e90-9635-c296b307fb13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24df67e6-8280-4e90-9635-c296b307fb13.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

706911ae-773c-4abf-b75e-11d4b721cf00.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\706911ae-773c-4abf-b75e-11d4b721cf00.tmp
Size 13KB
SHA256 8043c36a29b89fc83d17ca3f34fa9569cc3359915e6d01862ad26cdc7ce195c2
MD5 695c53cd0ec217ea237156adddf7d103
SHA1 6f6875da6b9f4bdca328bbe9957ba51855717c4e
SHA512 8745098a52cac134e1cf67c8a661e5c49bfc95ed44aab8360cc54bde6497ea57342aea6840ed69860e7812c307b5e7b3000932021baff3ef865a7165c88f5385
SSDEEP 192:jRgwgvQ7q93TfRA9pT9L8nkMagv79fGMAPRp2i+FYWm9+Hsb+WNa1jPLjnTb912x:jRg3mv6NGtXnowITfH2caW8
TLSH
T1AA52B72EAD10797BCCEAC22AF965772BD7F5102160942E84EAFC8D2C14D76DD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 216B
SHA256 cce352d5de5dbea4ff3273c38374a57bc54b20b3d9ebbf1733cb96057387cc89
MD5 b5b13ac2dd1c949c3576dceff10f8b82
SHA1 2e98368707edc1dbd55a04d2f41f2755e645a13a
SHA512 f3acbf324e9851b1de2508259f37e9764094aafda83e690102b4880e08344a16b79d54b3491bb372645705587cae35562bc11c0abf99d1277d64681df07e3ad9
TLSH
T1D2D08011544A5506CF715F300571477000E545B945E11559B3F5647C68454B6C6070EF
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 68d37af656cacaeadb3166a6eeba6df3981604d9914a3f0c8710e6d89602056b
MD5 c1a152f8040c9f50d3fe5f0489ebab01
SHA1 e51b8dd530f119de78784b915751598fe5e7f7b1
SHA512 fb0f933a803cc7903da0192c55a8a5d77461dcb02b4802160ba483470ee8fab8c9f47b425c42645911c626a3cfdf727158d23f1b50902f66b64fea0d600b96c7
SSDEEP 3:MsEllllkEthXllkl2zE/larFKl:/M/xT02z7rF
TLSH
T1324404047FC00407D50111304071C35117F0DC100F135743377105337CC57C00C04440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a2efb00-c917-4017-89d6-58ca32476451.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3a2efb00-c917-4017-89d6-58ca32476451.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9a945c3c-b7a1-4d2f-a626-08531654136d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9a945c3c-b7a1-4d2f-a626-08531654136d.tmp
Size 7KB
SHA256 0518a7f3a4876c900b6928a5394ecbfee9fd4605e9f220238f49dd1df9d35b82
MD5 47ff95bd31bbd51be036f122b8a3ce40
SHA1 07fc39ecfdf217bdf6076c23a8c09bded06306e2
SHA512 91845a24a69c2723c9b8de5b110ad5169d0b2e43d97c9a3f5f89fa61e9008a3a7f1bbc3d1ec46893bc1441ea19703fdff4d8fcf409e1edafbca12e6ca29fb61e
SSDEEP 192:D58UA8NPaI8FSbg7OIfhDn+kL+OL6S2GTOx+8h3X:D58UA8NPaI8FSbg7OIZDn+kL+I6S2GTm
TLSH
T1DFE1CCF7C3E48A6DCD1166F1AB152E2BCE690924432C3D66C9D5EF1B97E34B1E20124E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f4f7135-9081-4f14-b61f-5bef77e92643.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9f4f7135-9081-4f14-b61f-5bef77e92643.tmp
Size 1016B
SHA256 b31ae48e9473788452eb6b28810b8e2504ea224ab2d2e40fc245845358d8d945
MD5 50adf786162da57ba0cfd8117d130435
SHA1 0befc70f0fb607b1f75025a7ecc7ae88e5a0abd5
SHA512 beb10834edbc4a5cdf2198d955253cfd13ce03e0cddec9ed57481e6a740c17f16169550531b23b26ab0c341aa94b64e13214c1f527d765f1260f2f38349c11e9
TLSH
T10A1189A3E2BAB82F103E48B71D057C49A97AE435025168F4CEA7422C70C69E31F07476
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 ac0f5cbd0cc402c767e0690e8a68c8fe5af4ca5cabf19eff29e7678f5d589619
MD5 0ddcf3a192ddc6cddebf46a977b1e9ed
SHA1 e42cf6084ca90e8de38d819cfe472345164c8ae3
SHA512 0ed29993431fe88ec3dec4208f63500c1df26b1e04712c4ef7ff740a7388f220b50e41871a205edc35dee9394e350c05a5f866d37bd24a41f25f5ef0073db976
TLSH
T19DB01204C0425711C08303B011A4148831549F10FA06130147F00D51C8365E190AB094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 652f0a467e852e80e5e6ec771863cd501abe893bdb8427b1d51cfb4da5b6588e
MD5 6ea0c7b5f45503d2bd1d5ca002056605
SHA1 ee65b2d48639371773bb65c1b67d47ab6dbceb9a
SHA512 c019d3879b4e99d15d54844aecf09fb99c94b4d0b9aa06c74e7b368128ebd8ad329fe5330982dc3b07f02fbde20b909edefd3d287f187d3f22c6108ba0ea4e98
TLSH
T15EB02200C003A202C20203B03080C0C83030CFB0C2832303C3E00B32CC2233200200A0
MD5 SHA1 SHA512 TLSH

Submit Download

a8b18e10-054b-4552-bb30-288a25aa62d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a8b18e10-054b-4552-bb30-288a25aa62d3.tmp
Size 17KB
SHA256 52faa1c0a2c145f24cb6bf0e4a48b0237ba969495c82d742d374c6759b4dc290
MD5 10219fe671f251c5a102a95887dac447
SHA1 7f90b76134fd16f85ae158bfb5c71425e83ed0ae
SHA512 caee2e22a50a8965d0fb94b1a22f1071e58b061efd33cb3d9eeb5e5a6d58e48d84366477559486942f9c5103a8a77cad8186aef0b09c97ec8427f2be08e3f9cc
SSDEEP 384:SEjml7KxkXqKf/pUZNCgVLH2HfgsluN7pLuLceSMtXODml+ErU3I6HGCX2v41q:SIml7KxkXqKf/pUZNCgVLH2HfgsAN7pe
TLSH
T18A720A677C4C9E7B4FA4CA8DD8277E4FACB5024B55D9886442FA5C2603D4ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdf8bb21-e44a-4b5d-babc-fc7b0c56fad2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdf8bb21-e44a-4b5d-babc-fc7b0c56fad2.tmp
Size 12KB
SHA256 64e7bf10c4df7449504bb67315d9dac035980cdcfbdfd5f792ebd6b1ce382062
MD5 6e26ae66e04eabc8f2bf2bc3805299cc
SHA1 cd94e461083fa9a7495629d41b4e83c7428612f6
SHA512 8f3ac3f772afb963d758c8d0bf1b104980db0c164213e010ae8296845b1e0e891bb032b9166c40873602c5715e9f368a635d204853402a2f968c201771ec347f
SSDEEP 192:jRg0gvQ7q93TfRA9pT9L8nkMagv79fGhAPRp2P9+Hsb+WNnjn02hHaRUVyIsnAU/:jRgLmv6NG8XYow704aW8
TLSH
T1E542C72DAE10757B9CEBC22AF9657767D6F5102260943E84EAFC8D2C14EB6CD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7340fd7-15d1-4327-a093-8b6d7cc9ec38.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d7340fd7-15d1-4327-a093-8b6d7cc9ec38.tmp
Size 414B
SHA256 b4c1e6f67c5149334bf4634914c2b8bfd02d228aa8aa7483b084e61a0eff81be
MD5 a4286b057419f4159d72111efd355969
SHA1 3222286b8a47431ebd70c669fe35a3afd8b553a5
SHA512 c7dc33cb4b5f42c7d926877489e239c33d7dac1ea68bdba059aaaa44572312f3f1af1392eb35193f5adb3b604f633f7c4decd28e2225dafef7a0625e19a75808
TLSH
T149E02BA6CC21ACBB0CFD0728A461464AE765136B2A81C94F3B3C41094FF173B418585D
MD5 SHA1 SHA512 TLSH

Submit Download

e6c22795-0ab6-4acf-afee-73fe92ed3b51.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e6c22795-0ab6-4acf-afee-73fe92ed3b51.tmp
Size 270KB
SHA256 2a38ca588c047661c5981113f8f6c061f0e82452cda839dc96fb4c705e15f843
MD5 50d01e6ec9caf0ff49e73feba6a2730d
SHA1 7b4ce0eae318d12570fb725558c3f2fa5458a41e
SHA512 9852ffb3bb09d4529d7a4c1f6b5fc09eaf7ffec453ae8d2e1c99183c4251813677812a3c41470f0eb1ae6903552e51fceb4782fa013f7fe2fbf6b15707c5e6da
SSDEEP 6144:WE6kGpI2wCbJUiitbHThDxWhaj5mjie/JYFobV:T6tI2lbJBIbzh/NmT/JYOR
TLSH
T1B3442373AD7E15FB593DC03C202E5F0002D589F24900FBA7C7DA558BA2CBD91A395DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 370432.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 370432.crdownload
Size 1.1MB
SHA256 51b818bb05e61852d87c5da73907f36352886326655341363b21e6225775f7d5
MD5 7802627ce23471f23163fc8a1cf0f5fc
SHA1 b682c7938e5a1a1559b84e0742daeb743b3a1868
SHA512 8eedb5440e790aa759ffa3eaecae442a9963ccecd169b6283f654c95c36081229aa9b40104886939c1e6bc3224fc5f86834e890a234f2ebee34195ca15048115
SSDEEP 12288:ubs/m0E54jwaFXGc8lEBBBHGBKq2IZwD4vfqItNqdg:ubOVE5ifGPRZwMvf3fd
TLSH
T187357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf0ec0b9-4069-4662-9e17-1f262c37607a.tmp

Path C:\Users\Admin\Downloads\bf0ec0b9-4069-4662-9e17-1f262c37607a.tmp
Size 12KB
SHA256 cc8a1aeecb6d9eac7c150f4c3887e1fcc7b322dd4394faf6d322455afcf570f5
MD5 f013b9c72144acbb0a802fc21aa7a3a6
SHA1 cc713f35e98321e1d9903112ae491b7626654669
SHA512 d794f7eb63153964c61669553abba11ea0adb35d946c7513c94b3d366ea14b91ba4268e06c9e16b050d7f06a20479bf26dc2aa2d55dc8a05c0d03ea0ae90ef11
SSDEEP 384:+UG0xzqdT/iTn7NKkbVPAxYPdgCf1DKtz:/G0x2J/iL78kPA+Pdlfg5
TLSH
T1B842550B5A92859DD24DCF79C36E91B3E9133C095524F20EABCC4F713D117A8A63EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\launcher.exe:Zone.Identifier
Size 160B
SHA256 fdd303a7802fbdfe9a01bc83d50c87122167e86669d451fa8f8d8994fd50fb17
MD5 2d00640219cef0a7af03778b0fd08836
SHA1 f743c1d635a13c92accf73c79b5a84ca09b0de4f
SHA512 d914c7437da5b78ae7ab75bba8ee9287ca7c9da9a28731563de75981cc197507027ad6db95a27c81f1a2052a249e7db412ce0a4fbbf729534a8cb45c8ce09087
TLSH
T1E6C02B6F5D11C440874833C1504C91DC655F71E58DC7F710CC89067AB9C847446C3D36
MD5 SHA1 SHA512 TLSH

Submit Download