5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe
Size 345KB
Sample260517-ea47wab15w
SHA256 5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852
MD5 c1b29c991b45789bda71074cd41a0ca8
SHA1 0590fd821c037b404527566eae38d63519ee6a11
SHA512 9ecb55a52eedb97e15248e2efd6b27e3fa46ff73cdb6cf84e1b8040d1422f80f518f97a43acd0db1938c6bee864e1bd2f8e0bc5b4de8dd1c8f2ee32d5ccc7c6b
SSDEEP 6144:BejegB7oHRpXUsqiyB+50UttinA/hvCW2xBaJSo0Dcv:+EzOB+5VtuA/pPEBaJ30Qv
TLSH
T1EC749F15FB9910FAE177C17CC9634606EA72BC560B70ABCB13E44A562F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4340	ahy.exe
424	ahy.exe
5100	ahy.exe
3048	ahy.exe
3444	ahy.exe
3688	ahy.exe
576	ahy.exe
1996	ahy.exe
3696	ahy.exe
1636	ahy.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4340	ahy.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1500	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ahy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ahy.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236948899827151"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2824	schtasks.exe
804	schtasks.exe
4948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4340	ahy.exe
4340	ahy.exe
4804	chrome.exe
4804	chrome.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4340	ahy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4804	chrome.exe
4340	ahy.exe
4804	chrome.exe
4340	ahy.exe
4340	ahy.exe
4340	ahy.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3952	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	80
PID 1964 wrote to memory of 2824	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	82
PID 1964 wrote to memory of 2988	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	84
PID 1964 wrote to memory of 804	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	86
PID 1964 wrote to memory of 3640	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	88
PID 1964 wrote to memory of 4948	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	90
PID 1964 wrote to memory of 4340	1964	5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe	92
PID 4340 wrote to memory of 540	4340	ahy.exe	93
PID 4340 wrote to memory of 1400	4340	ahy.exe	95
PID 4340 wrote to memory of 4780	4340	ahy.exe	97
PID 4340 wrote to memory of 4804	4340	ahy.exe	105
PID 4804 wrote to memory of 776	4804	chrome.exe	106
PID 4804 wrote to memory of 1500	4804	chrome.exe	108
PID 4804 wrote to memory of 124	4804	chrome.exe	107
PID 4804 wrote to memory of 124	4804	chrome.exe	107
PID 4804 wrote to memory of 1764	4804	chrome.exe	110
PID 4804 wrote to memory of 1764	4804	chrome.exe	110
PID 4804 wrote to memory of 1772	4804	chrome.exe	111
PID 4804 wrote to memory of 1772	4804	chrome.exe	111
PID 4804 wrote to memory of 4228	4804	chrome.exe	112
PID 4804 wrote to memory of 4228	4804	chrome.exe	112
PID 4804 wrote to memory of 3404	4804	chrome.exe	114
PID 4804 wrote to memory of 3404	4804	chrome.exe	114
PID 4804 wrote to memory of 4684	4804	chrome.exe	115
PID 4804 wrote to memory of 560	4804	chrome.exe	116
PID 4804 wrote to memory of 560	4804	chrome.exe	116
PID 4804 wrote to memory of 1068	4804	chrome.exe	118
PID 4804 wrote to memory of 272	4804	chrome.exe	119
PID 4804 wrote to memory of 4612	4804	chrome.exe	120
PID 4340 wrote to memory of 1152	4340	ahy.exe	121
PID 4340 wrote to memory of 3136	4340	ahy.exe	123
PID 4340 wrote to memory of 1868	4340	ahy.exe	125
PID 4340 wrote to memory of 4216	4340	ahy.exe	130
PID 4340 wrote to memory of 2192	4340	ahy.exe	132
PID 4340 wrote to memory of 5044	4340	ahy.exe	134
PID 4804 wrote to memory of 1568	4804	chrome.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe
"C:\Users\Admin\AppData\Local\Temp\5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3952
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\chrome_task_240660078.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2824
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:2988
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\chrome_task_240660234.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:804
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:3640
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\chrome_task_240660375.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4948
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:540
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:1400
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ee01c728,0x7ff8ee01c734,0x7ff8ee01c740
      4⤵
      PID:776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,12701309702392173727,15589488088385696557,262144 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2024 /prefetch:2
      4⤵
      PID:124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,14882972924368605148,17664301057712883259,524288 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1844 /prefetch:11
      4⤵
      System Time Discovery
      PID:1500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,15142819704032053608,2089355503890226190,524288 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2552 /prefetch:13
      4⤵
      PID:1764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3048,i,3190804444730486598,17227706998390133061,2097152 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3088 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,11309477314669957764,8404172593872817145,2097152 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,14236370101875184455,9389706036531367888,2097152 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4476 /prefetch:9
      4⤵
      PID:3404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,11752429192715244421,9737338948377764009,524288 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5448,i,10629063422262001348,7883802595476309930,2097152 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,18335667966621221680,15119063119316289602,524288 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:1068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,4528781644722627631,14194380952611586293,524288 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,16326789986553867167,314317227656105582,524288 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4472,i,2023522433818668131,1679666260323660823,262144 --field-trial-handle=2028,i,12381048187027736190,6510067503144274014,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5728 /prefetch:10
      4⤵
      PID:1568
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:1152
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:1868
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:4216
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:2192
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:5044

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
1⤵
- Executes dropped EXE
PID:424

C:\ProgramData\Microsoft\DeviceSync\ahy.exe
C:\ProgramData\Microsoft\DeviceSync\ahy.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4072

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
1⤵
- Executes dropped EXE
PID:3688

C:\ProgramData\Microsoft\DeviceSync\ahy.exe
C:\ProgramData\Microsoft\DeviceSync\ahy.exe
1⤵
- Executes dropped EXE
PID:576

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ahy.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
1⤵
- Executes dropped EXE
PID:3696

C:\ProgramData\Microsoft\DeviceSync\ahy.exe
C:\ProgramData\Microsoft\DeviceSync\ahy.exe
1⤵
- Executes dropped EXE
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

82ca9446-5bf8-49d4-af39-05a7e6c68cee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82ca9446-5bf8-49d4-af39-05a7e6c68cee.tmp
Size 12KB
SHA256 b2e5cc25583c278ffac1bbef27ac53497f1261393878190e0411b29fdec57bf3
MD5 938117b18e5f5e21b28a92fbd634c9a0
SHA1 7955cba58c27f390a119c178b73022659c945bb5
SHA512 d10439c2c6d115a700dd2100092807283c72348372637982fcaf8b9aee4846d10a38f097ff95b422daca8bac78b35efe6e7058bcc2c497ea0c94cfe4b903b204
SSDEEP 192:GRfxqrRkmhv7+pAPRp247Mef9uHsb+WNnTePTHetvVyIsnAUgtaJ:GRfx7mx6UX7fUwCPs8
TLSH
T12E42D71EBE10657B5CDBD26AFE227763D3F5102225A02E84FAFC8A2C14D75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dbaff343936ed8526e23eaf0bff2ab3bf588185f6de4d73187238d2e0778a1c8
MD5 264a692bbccb88266d5687adc57ca082
SHA1 a2468b0cd250ef6a08a9396c0b8037bf01cfb997
SHA512 d0dd009f9f3857d03a29ef2320995a45a09816eac0351820e27894583ff7995ce491b8fcb96756d6325588ea44469a9482fb6e24249f022e88d436f201ed4b7c
TLSH
T1A1E0EDAACC21AC7B48FD1768A5500B42FB10135B2A815D6F363C96098FF067E018686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 df081870d54863f0c9ce26343524ed7cb7049a5283def712339064074422c7d4
MD5 c60d63d4fe01eb2770e17c7646c3f42d
SHA1 d93516222c9c1d8800ccafe7d06f30cbc88091d0
SHA512 1ddf0ced88c497131693021a0a030050367acc01d65bddf63e1d6cea16155ebcba421ce380b6face45494e8c3e51f526c717df6dec9101be2bcb4baf9e80bd40
TLSH
T154D0A75020D004F1DF5D47B710E110F95E282D8AD115322344D4689CC5536B9E449331
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f8023f4997feec798024002280b6cecd4fc2f7070cc036987fd3942fb60e6cf4
MD5 94830441c58b0baf2bc0cad66ef8b600
SHA1 7d142a36835c020a00fe092c70d8412f9a78e396
SHA512 b01afa442fef640ef10512a824fbe66e1c0862f754d8b0401c3099572cab846ce349ddb316ec385198d2c16caddfa770e1844b874dfd5488934d93b5d60af824
SSDEEP 48:YALlhchSrhEsPVRsNVXLs9foKsifsXosQKsEgmzsTWrsT9tsiqzs+VFsocsD4sWz:DGipVyVIh6A6AWy9p4LXWjh+K
TLSH
T12D917CF7C3D8852D8A0156F4AB156F1FCE290A24532D3C56C8D8EF4B93E2DB1D25069E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bb289e8393ac1f90b066e61d4e8bb93c5e376eee9f0733cdee731a5586d384cc
MD5 f962bf7c08e3903a086d893c62911839
SHA1 aedbec370072eb7516279748f68466d9b29efeab
SHA512 b5b13896a6edb38f89b3e4d5be93b3519a395eea49e019c2ae358e7d909ffe28fd510161ed2efaeff54a357d2104b071ad51d1c32e6f65483f7295c527107425
SSDEEP 192:GRfxdrRkmhv7+pAPRp247Mef9uHsb+WNnTeP0HefvVyIsnAUgraJ:GRfxomx6UX7fUwCPpe
TLSH
T13442E71FBE10657B5CDBD25AFA227753E3F5102265902E84FAFC8A2C25E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 66afc698129740ecb7ec954985ce68bd6e50438423fe6d7f18347e298ada4822
MD5 4c595e84e5fe96309846ae4870a81db3
SHA1 dac7600794ed79b214489bed0b6e0cdf13529a63
SHA512 79da7586ce5ce2286eb3f8e8b7b56a0491b6e49623b1c3d741d81359f555964a267e59e686a28458524fcb0cb56bd091c69988dbc5ef0467edd8fd42f90ce4a6
TLSH
T102B0120184C15101C08602F0218A2CD8B114DF24D60B270683E0FD22C82A1618414090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58877b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58877b.TMP
Size 96B
SHA256 bc870ab6018dce93362238241ebcd35c0a5d1ccc0df0326630260fc01991cd58
MD5 c11145f80948bf446b8927b2cd87f7d7
SHA1 db5927ae1e4d6a248dfedde3c61ac2f916ea49d4
SHA512 f073b254f465c110291606c1fba117558981b09341c253b008ebd7974b79e1d01243a15cbb56c679c8e65617cc5c07deb0391ab1db8097ca4791d24e66f9b1ea
TLSH
T142B022F2C30A2202C00303B030C8C0EB30A0CF20C203030282F08E22CC223B00020230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 80bcc5ca92c4eb151b1f0b310d6fb00d56f574cca103aa92992de206ef66b587
MD5 ac668a9868994f16923211d449c28ae4
SHA1 4ba0b4eb485bcaaff7a3c8ea33d76b9431c5b114
SHA512 d0c4f193b2a7befbda64ad1e8f783c412297d9804daccc726d342f3291afaf1d09ad513845cdbb3f8d169c48fa50e3a7f74642dde554dd2e46c1ef02dae26625
TLSH
T10AA0025149C4CD23D945267228CE21E47A15F911664A8B0770DE44A99C621EC719AE02
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 277KB
SHA256 5465d5351ed63dd7c371e5dabfebf8b8e00c1cd813231138a30e2c18aee4580c
MD5 ed38d73aee0488c551e7e7049fd95345
SHA1 c360b2ddf4aea0f86ad7738b04acf6be47799a4d
SHA512 7cffac25729acac6b73a5d9213d35a708c08dcd2a7db250e8b6b26be556537e5a6519926502faca59e4ca78965653b2da097b01cb77fa3f22fdf119b0845f762
SSDEEP 6144:V3MGptc2KstF3UJcOjvP4F7DyCwX6wCcmXKegIh6jh9JvexhC:6GXt9uvPwK6wCHHgVUx4
TLSH
T1A5542325745B3CC6CCBDEAB374133B414FA216A72C06F85D46C8AF0B066AEA955DF078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 64ff266fc1626da5734dde70b5af8227fdf2be803cbe74464308c5b1462c3373
MD5 770a2a2965ffb45583bcd99631207957
SHA1 839860144202d11cda6da12d363e54da7acfa051
SHA512 8daa41fd0d153b3c7b8a636a9b28ac9d0f761aeabaef813a444211583c04892f543b10620df788da48ae70cdbe6b377a4194f56a1e902fc060c95e40bfcc2f4c
SSDEEP 6144:1stF3UJcOjvP4F7DyCwX6wCcmXKegIh6jh9JvexhC:Kt9uvPwK6wCHHgVUx4
TLSH
T186341245786B3DC2C8ADEEB7752336424FA30AB55807F49E82C8EF071A4AEB454DE434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 0d40a8fd032ed61f9b186911c8915b0118d58a488f36bfb9da6aaaec1db59df7
MD5 060840edac1970adbe7fe8e53ee390b3
SHA1 62ea0e79143fa171c59dec708a954b1e55eabd81
SHA512 fe8d1d33da43a3a2c8ed409eab97b9785fc15ea45ae4b2f90bf07e269cc2377ac9eabf87419d3045b72e637ab24751c1b8a05a44568a52be2b8c10c1a185a81e
SSDEEP 6144:gstF3UJcOjvP4F7DyCwX6wCcmXKegIh6jh9JvexhC:9t9uvPwK6wCHHgVUx4
TLSH
T1BE341245786B3DC2C8ADEEB7751336424FA30AB55907F49E82C8EF071A4AEB454DE434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1b1ab2fda3515177cef586a0e98c570211d846c8050107d53234ba7b385b6dcf
MD5 8ab9e0f4e5aa3aac637b4afa6ae394ac
SHA1 d93adaaa7cd8473d591dc7d6649d221e5b4aa38d
SHA512 8a310d47afc6c3d9aab9c51b8f6bc031a5681695f8c17581def739c911f60e9958ca86175b7f7a33ae7686f38ff22d3aed0a6599a085e78ae9a8a3a2019a2a18
SSDEEP 3072:x8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:HwCcmXKegIh6jh9JvexhQ
TLSH
T1B0C3125A29273DA688BD6EB37457338286A313A26C05F14E94CCDF0B49DDDB414EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 161B
SHA256 627f24e5e37245d6746351d540612d6bdf3e0de49a91880db662fd241e76b028
MD5 4f5c63a85803ed886ee1ab0e9d0189e4
SHA1 50cde4b489ab920ef01e2bcfe0ff648bbff2dedb
SHA512 85c28782216439223d7e2332d5267737b0b6e9420731df8adebc82d79b0c1d447f4cf8d547c7244d59c961523214057de19d030c03d6c7c5ca7dd31e1ce4c7dc
TLSH
T1BDC08CEB6810D05EAAA0B1C09AF3755C187922888C81CA1820C0292659143BAD806C8E
MD5 SHA1 SHA512 TLSH

Submit Download

ahy.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\ahy.exe
Size 345KB
SHA256 5940c41ab003399680a04d726587eed242e4ad8969abe4b5617d712ff190a852
MD5 c1b29c991b45789bda71074cd41a0ca8
SHA1 0590fd821c037b404527566eae38d63519ee6a11
SHA512 9ecb55a52eedb97e15248e2efd6b27e3fa46ff73cdb6cf84e1b8040d1422f80f518f97a43acd0db1938c6bee864e1bd2f8e0bc5b4de8dd1c8f2ee32d5ccc7c6b
SSDEEP 6144:BejegB7oHRpXUsqiyB+50UttinA/hvCW2xBaJSo0Dcv:+EzOB+5VtuA/pPEBaJ30Qv
TLSH
T1EC749F15FB9910FAE177C17CC9634606EA72BC560B70ABCB13E44A562F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_task_240660078.xml

Path C:\Users\Admin\AppData\Local\Temp\chrome_task_240660078.xml
Size 2KB
SHA256 0dea2a8a9b23aff6e3cfd15b49bdcd1d63d91549c52d74110bc2c1c6ff3c9c50
MD5 2a459903df7b9c44c35da2c7abd939f3
SHA1 b56952ad966da5b5e3e4a37fc191d2d909069514
SHA512 b8f39786655a778c37e27b7ff87f3d81a1d57960c2a9af6627ebbb802d29c8ae96f716610c1b246be60bc269b456e51036f2b48e166fe92b313acdce2341e7c9
TLSH
T14D41E2436BFE1119B2F36A9CAAB754625E67BC955939C46C10AC200CCBF3D2288617B7
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_task_240660234.xml

Path C:\Users\Admin\AppData\Local\Temp\chrome_task_240660234.xml
Size 2KB
SHA256 9039925c0aa46191f1e8410d579dd8d93835c93aa08ff26aec14154700cac0ad
MD5 6e9a680204c505f975076cc92fc13485
SHA1 c69778500eade67b0dcf54292d79a5b1ad3072d5
SHA512 081543ee4ba24719c634d9c3df64f64ca23b3908c92d2a6724fecffc7ad4103bab52b7ec1d7de48eaaa96d9dc7a336119b138c270b1cb9a2d49fd61d4222fbf5
TLSH
T116410443ABFE1119F2F36B9CAAB754625E67BC955938C46C10AC200CCBF3D2285617B7
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_task_240660375.xml

Path C:\Users\Admin\AppData\Local\Temp\chrome_task_240660375.xml
Size 2KB
SHA256 ed4a687870497cc1266d7adb0efed98813677decfdd27a6caa9e683838587168
MD5 30ac36cee28be41260552d9f0729cb5b
SHA1 ba948fb902127503666d97fd3d9d884b9c59a747
SHA512 41bb8858f78f1231c5a4633f91a36e46d123baa556b909e3236b1f24417f47d78a0255545586ad41059fc3032aee9adce1d8b06ed39f644223a03db29310b867
TLSH
T15D4106436BFE1119B2F36B9CAAB754725E67BC955938C46C10AC200CCBF3D2288617B7
MD5 SHA1 SHA512 TLSH

Submit Download