5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe
Size 345KB
Sample260517-ea47wab15w
SHA256 5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852
MD5 c1b29c991b45789bda71074cd41a0ca8
SHA1 0590fd821c037b404527566eae38d63519ee6a11
SHA512 9ecb55a52eedb97e15248e2efd6b27e3fa46ff73cdb6cf84e1b8040d1422f80f518f97a43acd0db1938c6bee864e1bd2f8e0bc5b4de8dd1c8f2ee32d5ccc7c6b
SSDEEP 6144:BejegB7oHRpXUsqiyB+50UttinA/hvCW2xBaJSo0Dcv:+EzOB+5VtuA/pPEBaJ30Qv
TLSH
T1EC749F15FB9910FAE177C17CC9634606EA72BC560B70ABCB13E44A562F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1868	ahy.exe
1556	ahy.exe
3700	ahy.exe
4992	ahy.exe
2700	ahy.exe
2192	ahy.exe
1548	ahy.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1868	ahy.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ahy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ahy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236948434777431"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4628	schtasks.exe
1872	schtasks.exe
3352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1868	ahy.exe
1868	ahy.exe
212	chrome.exe
212	chrome.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	ahy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
212	chrome.exe
212	chrome.exe
212	chrome.exe
212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe
Token: SeShutdownPrivilege	212	chrome.exe
Token: SeCreatePagefilePrivilege	212	chrome.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
212	chrome.exe
1868	ahy.exe
212	chrome.exe
1868	ahy.exe
1868	ahy.exe
1868	ahy.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 5080	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	86
PID 3900 wrote to memory of 4628	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	88
PID 3900 wrote to memory of 1052	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	90
PID 3900 wrote to memory of 1872	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	92
PID 3900 wrote to memory of 2472	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	94
PID 3900 wrote to memory of 3352	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	96
PID 3900 wrote to memory of 1868	3900	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	98
PID 1868 wrote to memory of 1340	1868	ahy.exe	99
PID 1868 wrote to memory of 4196	1868	ahy.exe	102
PID 1868 wrote to memory of 2152	1868	ahy.exe	104
PID 1868 wrote to memory of 212	1868	ahy.exe	114
PID 212 wrote to memory of 1632	212	chrome.exe	115
PID 212 wrote to memory of 3884	212	chrome.exe	116
PID 212 wrote to memory of 3884	212	chrome.exe	116
PID 212 wrote to memory of 1852	212	chrome.exe	117
PID 212 wrote to memory of 2400	212	chrome.exe	118
PID 212 wrote to memory of 2400	212	chrome.exe	118
PID 212 wrote to memory of 4320	212	chrome.exe	120
PID 212 wrote to memory of 4320	212	chrome.exe	120
PID 212 wrote to memory of 4076	212	chrome.exe	121
PID 212 wrote to memory of 4076	212	chrome.exe	121
PID 212 wrote to memory of 4672	212	chrome.exe	122
PID 212 wrote to memory of 4672	212	chrome.exe	122
PID 212 wrote to memory of 4444	212	chrome.exe	124
PID 212 wrote to memory of 2068	212	chrome.exe	126
PID 212 wrote to memory of 2068	212	chrome.exe	126
PID 212 wrote to memory of 1772	212	chrome.exe	130
PID 212 wrote to memory of 440	212	chrome.exe	131
PID 212 wrote to memory of 740	212	chrome.exe	132
PID 1868 wrote to memory of 4744	1868	ahy.exe	134
PID 1868 wrote to memory of 3192	1868	ahy.exe	136
PID 1868 wrote to memory of 1900	1868	ahy.exe	138
PID 1868 wrote to memory of 1492	1868	ahy.exe	142
PID 1868 wrote to memory of 224	1868	ahy.exe	144
PID 1868 wrote to memory of 4736	1868	ahy.exe	146
PID 212 wrote to memory of 4992	212	chrome.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe
"C:\Users\Admin\AppData\Local\Temp\5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:5080
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\chrome_task_240644093.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4628
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:1052
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\chrome_task_240644203.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1872
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:2472
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\chrome_task_240644296.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3352
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:1340
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:4196
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa71fc728,0x7ffaa71fc734,0x7ffaa71fc740
      4⤵
      PID:1632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1808,i,2333099393052464429,9195674866202994578,262144 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
      4⤵
      PID:3884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,4025964598626485771,5534282629764634556,524288 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      System Time Discovery
      PID:1852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,7948107018217547685,9667783351608837109,524288 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:8
      4⤵
      PID:2400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,5299316095699086810,7315936337594233879,2097152 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,4783409292604997110,1812726202680174043,2097152 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:4076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,5977524531274877397,9965484118522704554,2097152 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
      4⤵
      PID:4672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,11119211875723708217,8996532872434380483,524288 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:8
      4⤵
      PID:4444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5212,i,5880911925810238030,14613633398391397678,2097152 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,4664592961929919473,9029067470741597933,524288 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:8
      4⤵
      PID:1772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,6164566216057209938,17550682227050899936,524288 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:8
      4⤵
      PID:440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,17553640166289959015,13699748566781755999,524288 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
      4⤵
      PID:740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4628,i,4720888734083173153,14619244174741665541,262144 --field-trial-handle=2028,i,3951375354425184031,11041425066220348990,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
      4⤵
      PID:4992
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:4744
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:3192
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:1900
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:1492
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:224
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:4736

C:\ProgramData\Microsoft\DeviceSync\ahy.exe
C:\ProgramData\Microsoft\DeviceSync\ahy.exe
1⤵
- Executes dropped EXE
PID:1556

C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4292

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
1⤵
- Executes dropped EXE
PID:2192

C:\ProgramData\Microsoft\DeviceSync\ahy.exe
C:\ProgramData\Microsoft\DeviceSync\ahy.exe
1⤵
- Executes dropped EXE
PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ahy.exe

Path C:\ProgramData\Microsoft\DeviceSync\ahy.exe
Size 345KB
SHA256 5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852
MD5 c1b29c991b45789bda71074cd41a0ca8
SHA1 0590fd821c037b404527566eae38d63519ee6a11
SHA512 9ecb55a52eedb97e15248e2efd6b27e3fa46ff73cdb6cf84e1b8040d1422f80f518f97a43acd0db1938c6bee864e1bd2f8e0bc5b4de8dd1c8f2ee32d5ccc7c6b
SSDEEP 6144:BejegB7oHRpXUsqiyB+50UttinA/hvCW2xBaJSo0Dcv:+EzOB+5VtuA/pPEBaJ30Qv
TLSH
T1EC749F15FB9910FAE177C17CC9634606EA72BC560B70ABCB13E44A562F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c10b1371d29ff99c1530c55bad0d6a5638708ef1fd5a58adfcd466e54945c2d
MD5 8a54ad91dcbcbb209e526f343298ab3d
SHA1 0ad31788d41904d6792c648a3b2c1f932cd21804
SHA512 b0bbf1bfda67aafe6c8275663455c9851ad6ff866f3ed352bbd0ffc95272f84fa1f4be659a06314e068f3ab15bd8e007509f61845565e9f19a22843b5eb54df1
TLSH
T18DE02BAAC821AC370CFE471964540786F761135B2B91594F3A3DA108CFB0A2651C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 f7a0325fd9dc57700e178ecad8a2af401c15d384280f1615e73ea5ba13108c6d
MD5 9cd2ec4936853f8a62271f5a3d530995
SHA1 6145815757dd294bd06612334e45a433da1fc8a5
SHA512 c88910b9f1fef69da11221a7f7741e53e7d19b719db217bdc2c27b4a2884e600c0672818c00cf0faacf6677c2c74dac94fa0ca4fba5e4aaf698af1d726657049
TLSH
T14ED0221420722242CF2407F31B382070EB3B2C5E07D4034340C447A10A1397EEAF7480
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3cf63d96bd6b692800cdc3e621b7f251a37c26994f96c5be16bc890aacaf1205
MD5 5dcf0565fa0c949af402429aa7e326bd
SHA1 6b55e9740b33d5672e90a628021d4c4d736c31f8
SHA512 13cca0463a81f3cdc838fc4881bacd2af4c6fbfff43ebaf6df0ad94072e8b4c49072c30788206af63c04afc9af93b4cbeedc056bebeb62215598d6e5174ffaab
SSDEEP 48:YALlhihShQWhQZhUsARsafoKsDXLspfs4oslKs0gmzsWrsstsIcsuqzsT4sj4Bs6:DkgmWmZ2BEc9Vqp9/Kzc8fkKK
TLSH
T18EA18EF7C3D8C52D891156F4AB156F1FCE290A24531C3D26C8D8EF4B93E28B1D25069E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 97e19c8bbc3098bb0c05b1a0134616472bd5015e049d7c2fef342d68e47c11b6
MD5 d795fe2b1b253c3175678ba9326aeb63
SHA1 ab4f4a636583f78d359c1fcd5999dc3e2ca4bb33
SHA512 e0e77c6d367314b3eafb90e4932a3c0eb3c007146858bf4a3dfd0d9d3cbb29f6fdf73ad9f2d974707a1aaeb93fc1bc1480013469c58cefba77e80c4712cc6ec7
SSDEEP 192:KRq/qr8oAO/hv7spAPRp22B6S9wHsb+WNnrkPZDeoVyIsnAUgtaJ:KRq/C8o/xYUX/MSKwYPt8
TLSH
T1AF42C62EF954653B5CDBC21AFA627B53D7F5102121D02E94EAFC8A2C10DB9CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6d644da90e6eb50511e036d4ed647a47eaf3a0455da70406c7e402282e1af8c9
MD5 4ac6b44830449152bcc0bb447c9fb8f5
SHA1 617ca24a98a17d04dae646656b8a4fb2fa716bf1
SHA512 08fdb25d0491c9a4beeb71db8b9e9fd7d47c532e4e2d5ef87a35104733564e6b0cf761b40a1232052ed4f2fb9a4233a30ab1ffc65097be6c3e5aa2ac0899e36f
TLSH
T179B0120080019111C4420AF41293648CB1245F25960B170243E06AA2E9252628028160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5847f1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5847f1.TMP
Size 96B
SHA256 579cbec8bd191b9d2f921e467dce76d3f1d335240ed7e9ef17a4e79d52129535
MD5 0bdc348de620722d541b76c5995be54b
SHA1 cda546d7b886cc2abc959da0123b28421b9ac76c
SHA512 cd6957025729d46f2225b19b7d5076958e57b9b6f7cee26c53d209d6f8348aa5a790004409cb99f508b1dd39d554423481f5ed2498aaf4b836fe47fec06f2511
TLSH
T1CBB00265D5836216D14343B0699DD5F8B170DF29C613121297E01A66DC666B14526160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 760f85565ca13ddbaa60f04a54a2132706ac756cff5739a39350e7d75b159725
MD5 965d5a8f4681bd3033670fdd677dbde0
SHA1 44ca1dc94b4a8c7ae4219fc31a7adfae1097338f
SHA512 afdb796a6d5e5b9a2ec75927dffe2b57504684aaf453dbc19c775ab23d6789ede885c8dd49fe8cd4baa8fabf720fdd26e581543b9890b45058b13e31a2115edb
TLSH
T142A0022413C01D75CA5282B3E08E21416621A81D21CD8F1760AA04458C562C8721E067
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 9f0e066031017add585c3281fe27c5b6006041402e4e8856113c747932a640b8
MD5 62846d254922e3c9db29edf0c8d4eb4a
SHA1 bc2ae461c02c4340e28459d278eba9f53cff1d3f
SHA512 a5955a0ffda4fecd5e1f553f3a31147c84f82e92b3f137c69107cf3befaf6eed45ec46672ef9426afb56ba187f16413ceefd4190e6a791c1dc68692dda6c7cb0
SSDEEP 6144:KstF3UJcOjvP4F7DyCwXvm7Rkm1tYpBeh2BAoI:Ht9uvPwKe9oBGcAoI
TLSH
T146341217AC6ABCB7D869FB5F740A490F1FF20C768902DD9686C46F053B16B9C144CA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 229KB
SHA256 4179297aa37e030bd3a68487e00b33af4931bd0c1e390cc5dfede7f08bc4e2d0
MD5 9ac40a8a1caf7038169c982436bf0bc3
SHA1 e7a0a019f59d7655a6ee8812ccf8129149929842
SHA512 e9286a15bdddbb09af4d03e4cd713ecf5f5335479334b06d7f8c69d81a6077f2a1cfdf726fecc8cdf9ade6717cf883ebe6b446714d52ca3fd756035732533fd1
SSDEEP 6144:CUstF3UJcOjvP4F7DyCwXvm7Rkm1tYpBeh2BAoI:Yt9uvPwKe9oBGcAoI
TLSH
T1C8341237AC667CB7D869FB4EA00A590F1FF24D76C906CC9A86C87B053B1B798584C934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 e8260c6e967ca7da6b57408eceb6bcae3d46b001b3d147648e36c14440c9e6fe
MD5 cf36b430e4e902cb7b6afa5ff5cbb8d7
SHA1 ef759ceb1923304bfc93c894e9f8f7d41a999fe0
SHA512 36548c41d6fea6997391c637aff6e1964db79037f1b76d065ead8e2033c7795d4d091c94f5d060dd47a168d6b6fd87f8e8fbee38f0fa20e64f287d01c74277e1
SSDEEP 6144:FstF3UJcOjvP4F7DyCwXvm7Rkm1tYpBeh2BAoI:6t9uvPwKe9oBGcAoI
TLSH
T196341217ACAABCB7D869FB5F740A490F1FF20C768902DD9686C46F053B16BD8544CA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 27a317ad3a5e7c1dbfb9c9215711c66b06043756b249d9abfddf3cf8c0588de5
MD5 0a7b4defe8ab27b1575a1b9116f2560a
SHA1 c1a6662d637649bb880252b75f5db55c28cdd867
SHA512 5214e38bb168405b8f4d5ae2485b264e35fc1f39e4a3210e1fb39ec20c9bfe15156e8c176ad2d883f9c28a7352f5f290794bc7654618bb78066346fd4e81746e
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:um7Rkm1tYpBeh2BAoK
TLSH
T13FC3123B5D75E8379979B70EB48E0B1F1EF149A2D920DE92C8D86B0877E97CD0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 161B
SHA256 627f24e5e37245d6746351d540612d6bdf3e0de49a91880db662fd241e76b028
MD5 4f5c63a85803ed886ee1ab0e9d0189e4
SHA1 50cde4b489ab920ef01e2bcfe0ff648bbff2dedb
SHA512 85c28782216439223d7e2332d5267737b0b6e9420731df8adebc82d79b0c1d447f4cf8d547c7244d59c961523214057de19d030c03d6c7c5ca7dd31e1ce4c7dc
TLSH
T1BDC08CEB6810D05EAAA0B1C09AF3755C187922888C81CA1820C0292659143BAD806C8E
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_task_240644093.xml

Path C:\Users\Admin\AppData\Local\Temp\chrome_task_240644093.xml
Size 2KB
SHA256 63fb016c52fd5ae085710f99039159efdf9ed3587d7ecf4188b401d9422dc768
MD5 eff91bf1227a0b7054a72b988f1785e2
SHA1 fcc117e067cb68f1e9f31daff8bbeb9a1f38481a
SHA512 fc89e622227941d1d78151fda4450f583eb79dddfb5db41de467e5dd1e0b4a0fe06cc2689031e0c959c891eb30c22704f362731cfaa21d8832e05726bc680ec5
TLSH
T15B41E3436BFE1119B2F36A9CAAB754215E67BC555939C46C10AC200CCBF3D2288617B7
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_task_240644203.xml

Path C:\Users\Admin\AppData\Local\Temp\chrome_task_240644203.xml
Size 2KB
SHA256 3b9caf76735d1433afad4e03e3dc09854af09acc0db2e882491a897b61cd3da8
MD5 a67b30317a96969dde899ffe8b75b961
SHA1 6546baa4d29512acf782bf7baf2ad832f7698ebd
SHA512 77b1e24cbd067dbb991a0f25159fd3f777b046f64e7fc36413d1c601f2d4b9f7e6fe242053d8396e75d5847209054b5b701bfd6a0f4761df6fdb138ee8f044f7
TLSH
T14041F443ABFE1119F2F36B9CAAB754225E67BC955939C46C10AC200CCBF3D2285617B7
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_task_240644296.xml

Path C:\Users\Admin\AppData\Local\Temp\chrome_task_240644296.xml
Size 2KB
SHA256 4b9592207b454bdcd741b42cfdb1aef6d3b81dfd02d4248f6b60582ebb9e47f6
MD5 85935434f8e82941b0618e80cc5e14fb
SHA1 49dfbfb1c87c8851f4d308beba4a3fb325f6c463
SHA512 1e16ba4fdeebaaecf3c26a4e98ada4cac13fe4756cc992a50310f10c88ddfd56b10c71231a9413ff31eab26a7bcd66ba03eceaad800e59f2a74fa79a8f9bfba3
TLSH
T1754106436BFE1119B2F36B9CAA7744315E67BC955938C46C10AC200CCBF3D2288A17B7
MD5 SHA1 SHA512 TLSH

Submit Download