335ece5a7b777407207008ea7052a8e96fc56494d1d7422d5b5d5cdcf4cc3b5b

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccc.exe
Size 6.7MB
Sample260525-ev6lfaa12q
SHA256 335ece5a7b777407207008ea7052a8e96fc56494d1d7422d5b5d5cdcf4cc3b5b
MD5 4530223e41575768248cff405c7b11f0
SHA1 4f8fb826fd24eee4c01633ddfd3530f2e9526cd0
SHA512 faa30477ec9cc195f48fb3dfe1f8404739b47cceb91272701c10def8791d5e808e6f1e5ec1ec0db06d1b391ff95f75d347b2ec9d810f79f635d798205d5fbaa7
SSDEEP 49152:ciTPMOfCI2CLXQzQpooN3UjvBUmuDbCQ+x52/wpfQIhgyzAhnsS9iO3TcfXzB20x:GO6IRguCPi1d62xYeOFzbZBxh
TLSH
T1C8667C19A3D50AE4D22BFA38CA668B33D772BC515637C30F0565E20A1F336919E6E731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk	ccc.exe

Executes dropped EXE 6 IoCs

pid	Process
4884	dllhost.exe
3664	windows.exe
5048	windows.exe
3928	SearchProtocolHost.exe
4244	SearchFilterHost.exe
2428	dllhost.exe

Loads dropped DLL 4 IoCs

pid	Process
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\windows\\windows.exe"	ccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows\\windows.exe\""	ccc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4216	svchost.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 4216	2704	ccc.exe	92
PID 4216 set thread context of 4884	4216	svchost.exe	94
PID 4216 set thread context of 3928	4216	svchost.exe	96
PID 4216 set thread context of 4244	4216	svchost.exe	99
PID 4216 set thread context of 2428	4216	svchost.exe	100

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ccc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ccc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241562607599627"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
820	schtasks.exe
4840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2704	ccc.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
4216	svchost.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	ccc.exe
Token: SeDebugPrivilege	4216	svchost.exe
Token: SeDebugPrivilege	4216	svchost.exe
Token: SeDebugPrivilege	4884	dllhost.exe
Token: SeDebugPrivilege	4884	dllhost.exe
Token: SeDebugPrivilege	4216	svchost.exe
Token: SeDebugPrivilege	3928	SearchProtocolHost.exe
Token: SeDebugPrivilege	3928	SearchProtocolHost.exe
Token: SeDebugPrivilege	4216	svchost.exe
Token: SeDebugPrivilege	4244	SearchFilterHost.exe
Token: SeDebugPrivilege	4244	SearchFilterHost.exe
Token: SeDebugPrivilege	4216	svchost.exe
Token: SeDebugPrivilege	2428	dllhost.exe
Token: SeDebugPrivilege	2428	dllhost.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3144	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3920	2704	ccc.exe	80
PID 2704 wrote to memory of 820	2704	ccc.exe	82
PID 2704 wrote to memory of 2484	2704	ccc.exe	84
PID 2704 wrote to memory of 900	2704	ccc.exe	86
PID 2704 wrote to memory of 4840	2704	ccc.exe	90
PID 2704 wrote to memory of 4216	2704	ccc.exe	92
PID 4216 wrote to memory of 4884	4216	svchost.exe	94
PID 4216 wrote to memory of 3928	4216	svchost.exe	96
PID 4216 wrote to memory of 564	4216	svchost.exe	97
PID 4216 wrote to memory of 4244	4216	svchost.exe	99
PID 4216 wrote to memory of 2428	4216	svchost.exe	100
PID 784 wrote to memory of 4168	784	chrome.exe	102
PID 784 wrote to memory of 4284	784	chrome.exe	103
PID 784 wrote to memory of 4356	784	chrome.exe	104
PID 784 wrote to memory of 4356	784	chrome.exe	104
PID 784 wrote to memory of 2508	784	chrome.exe	105
PID 784 wrote to memory of 2508	784	chrome.exe	105
PID 784 wrote to memory of 4336	784	chrome.exe	106
PID 784 wrote to memory of 4336	784	chrome.exe	106
PID 784 wrote to memory of 408	784	chrome.exe	107
PID 784 wrote to memory of 408	784	chrome.exe	107
PID 784 wrote to memory of 3748	784	chrome.exe	108
PID 784 wrote to memory of 3748	784	chrome.exe	108
PID 784 wrote to memory of 3952	784	chrome.exe	111
PID 784 wrote to memory of 3952	784	chrome.exe	111
PID 784 wrote to memory of 4160	784	chrome.exe	112
PID 4216 wrote to memory of 3248	4216	svchost.exe	115
PID 784 wrote to memory of 2972	784	chrome.exe	119
PID 784 wrote to memory of 2504	784	chrome.exe	120
PID 784 wrote to memory of 1720	784	chrome.exe	121
PID 4216 wrote to memory of 3156	4216	svchost.exe	122
PID 3156 wrote to memory of 1968	3156	cmd.exe	124
PID 4216 wrote to memory of 4736	4216	svchost.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ccc.exe
"C:\Users\Admin\AppData\Local\Temp\ccc.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "windows"
  2⤵
  PID:3920
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "windows" /TR "C:\Users\Admin\AppData\Roaming\windows\windows.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:820
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "\Microsoft\Windows\Shell\UpdateDetection"
  2⤵
  PID:2484
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "\Microsoft\Windows\Shell\UpdateDetection" /F
  2⤵
  PID:900
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "\Microsoft\Windows\Shell\UpdateDetection" /TR "C:\Users\Admin\AppData\Roaming\windows\windows.exe" /SC ONSTART /RU SYSTEM /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4840
- C:\Windows\system32\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Query /TN "windows"
    3⤵
    PID:564
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Query /TN "windows"
    3⤵
    PID:3248
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c start cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:1968
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Query /TN "windows"
    3⤵
    PID:4736

C:\Users\Admin\AppData\Roaming\windows\windows.exe
C:\Users\Admin\AppData\Roaming\windows\windows.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Users\Admin\AppData\Roaming\windows\windows.exe
"C:\Users\Admin\AppData\Roaming\windows\windows.exe"
1⤵
- Executes dropped EXE
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff940bc728,0x7fff940bc734,0x7fff940bc740
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,7767269741775773229,1486956315978409953,524288 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15338918003991181453,16549419925277166957,262144 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,3852535145993452862,6476179036806216444,524288 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1944 /prefetch:13
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,16157070605068748020,5303510107525630359,2097152 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,6964102743409063503,11830754593606063929,2097152 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,3861398774325860226,10831679429554921620,2097152 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,14125669050472260762,7784738023999960161,2097152 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,12857453050460057395,9113907024416397289,524288 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,5071345019979208545,6481521396374280349,524288 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,4760704459278475299,12251482626812748894,524288 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,17145898405531683334,3561167847745594233,524288 --field-trial-handle=2076,i,2638143231088459031,17419232128471119511,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1272

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 017b5c58f8d9226fdfc7556a402a7504e43d333f7737016da8556ebaf6b5f0fc
MD5 4bb2bb90b3c67df595ec2af12115b741
SHA1 436be50bd789747e2f56f426828fefe774800074
SHA512 69fb5ce5958efac1edfb79b9707fa00334f8e146ac4f90b1eee1bb1adf2a21389f9fb8e7db4c4abe2664fea3a64f1dfbe1cae347fe9d31c5ba2e1d13a630b6a3
TLSH
T1C6F0D1A6CD21AC3718FD171870640B47FB54136B2B81489B3A3D860D8FB463B868696C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f92ede86f5c72c9fcaeecc75c357d6a1bbacad0c2d65cdf6ebac3b77c018bf96
MD5 cdef345c6dad328388e4352eb34b3e00
SHA1 39258f23d6a752e1bbf816d09535369e45846141
SHA512 0d5361f298fb31b9eca47a17d58f7920e06908d04d1b1a0e73bacc93cb7590b75e95f33a571b4375e3bce2856bd39c15894b876d561b8eb326583fd06faaa184
TLSH
T1DF517DB3C3D8C96DC81152E4AB25AE1FCE390D14522C3C6688D4AF4F53E6D72D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fada158eb780aede47d53322843eb14df45d3c4a45009593434f9bdbfa30fb06
MD5 95fa87611cbe4974ec609a7bc4839474
SHA1 174952b2e305b30ca5b9bb951a83ab5f52f96b6b
SHA512 0e76b98f152b9c0804b370c744b5209797258a0096e86796ca9ca967ab78f20af8a992be00b84c41069a1c1691853ea75336108b98f877b3b79dbd83f719bbb7
SSDEEP 192:xRn/7CqvGu7v7+pAPRp279uHsb+WNnsL0SyeYmdVyIsnAUgraJ:xRn/uuD6UXkUwY0me
TLSH
T19942D72EAA50753B5CEBD35AF9267B53E3F5112621942E44E6FCCA2C05D76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5ed009cb85a348348ea3c8279a865fc9c5d541ddcfaff3c3339e0f8b5bb5af1d
MD5 e34381cefbed1cbd490700ee952f0731
SHA1 801e5012d8bdd1fa35b6a981995fcaa67b6133c6
SHA512 811e97f7f238c89235f17d9d9dac5aa0e5a01b570adfac4fb691f0f8cbbf95ca564ac81b4df0eceba0c98f60ce7a4a00d448d949e60a57f8f52ed611ec112a79
SSDEEP 192:xR6/7CqvGu7v7+pAPRp279uHsb+WNnsL0vyeYPdVyIsnAUgtaJ:xR6/uuD6UXkUwY0Q8
TLSH
T19442D82EBA50753B5CEBD32AF9267B53E3F5112621942E44E6FCCA2C04D76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 af1a7df680de0158bbd48c99a3ae492612402b70dcd168ef752621bd012084b3
MD5 0274355cacb62aeb814cfd95e039be5f
SHA1 90ec957be32adb07d0accebe68af334e44c9fe7b
SHA512 32db5b005a9d8f556b726c35aa3c6cf88c358b577c62d09bb8747b80c1ecb41b29cedc1abdbff77a8ec5c2e6a8543dddc0524f24980fef80d2d1fabf0370f658
TLSH
T1CCB01240C4015111C04303F4114318CCB1149F20960B970253E07A628827651C015070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596c4d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596c4d.TMP
Size 96B
SHA256 738f5089173880f0d9c7e0fe72057d4368c3bac1235a116417321e85379ffbd9
MD5 3ca60e2518148c6830514e8bc2aff520
SHA1 ff3a6ef26f659f3574659c24607189d205a05205
SHA512 e16e638759fa348aeb4818b9033aaafe2e8de8516d0fd09ad5b8438cf6b6a84e9f76216e63bce0f8dcd5047eb90d15c1c3700655d9b122b344d343d4a239fa4d
TLSH
T113B022F0C002A282C00303B02E80C0C830A0CF20C2032202A2E02A22EC282300020220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 80a7d96eae414b32e6af7da28cd85ac075ea9f6ca0a1bc3935d50291c09c8de5
MD5 e8a26b160d7ad32d849c4f4c2a231cd2
SHA1 72d9e242f78bcf839c7484c6467eacca3c580a04
SHA512 90d06021b8db8e449545b9abb7844ef13c02a438538ee44ba787a091a0d25708780fd49a881a04847fddd3db1ade4c9f6e23c72235d38acae7f78e38ad79f629
SSDEEP 6144:3/m/kPmN86MiPEURFgI1PTDJwCcmXKegIh6jh9Jvexh8:ucONRsipwCHHgVUxq
TLSH
T1BF341335680F3D5A0C7C7B73B24673468D62A3B76D0AB98D84CC8F8789DCC951B1AC68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 925ff22b38c36e0db59d3d177b4b5e7a876e4392ff33ab6c137bf130128e3232
MD5 b7e785923d908363c0cd8aab6a6661b8
SHA1 2452b7c01db28da31e0487a8b5e6e95e0bdeabe8
SHA512 657447c02f968796680d37ceb798ee9d919eab6a5f0f27daa012f050e3fcb48c844f0343322d7a4c22e895451838d455a21d0b9b0840827a0e9794098e20fd78
SSDEEP 6144:o/m/kPmN86MiPEURFgI1PTDJwCcmXKegIh6jh9Jvexh8:9cONRsipwCHHgVUxq
TLSH
T191342315681F3E56087C7BB3B54B7387CA62A3B56D0A798D80CC8F8789DCC91165AC7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 28c31a01f3bfad3e983dc0067e3352ca7c3c8b721c1d686e7cc726790060ada0
MD5 22cfe3fa94ec40765883ce67b599c58f
SHA1 af2315e263c03c291303b64f5e80889d757105f9
SHA512 de73ea67f17eec2a6b8289b1bb3248c1531122d73c0d4f1f70fe1116f4d5e24818e55c840f77e8a5c33e6a09b885d1ffd8916322f2fa254639971aa6bba8b3af
SSDEEP 6144:z/m/kPmN86MiPEURFgI1PTDJwCcmXKegIh6jh9Jvexh8:KcONRsipwCHHgVUxq
TLSH
T15F342315681F3E56087C7BB3B54B7387CA62A3B96D0A798D80CC8F8789DCC51165AC7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8619713f619897b89259aec9f44fbd9b5d083892f44ea3c4f665500cdf49a10e
MD5 9484d867b600fa2113e52f9e613a9e46
SHA1 8c9ae2fb259cc42d4b07d6afac90ad6e08f598c2
SHA512 dd30f3d5fd0a4505b2068f7df4708fd8cffd0470049fb22aba6b1334ce67f2401b1ccdb02e51eced3534f61b3c9aa63883c3fe9476637d1a41472f3c7a03a2fc
SSDEEP 3072:k8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:ywCcmXKegIh6jh9JvexhQ
TLSH
T1ADB3125A29273DA68CBC6EB37457338286A353A26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 55714a4d17f2dd52eed27140e60f277420c975af2aaa2861bef8d6948bb31c50
MD5 7d4492a5e4ec9e19b9a1e52bc50f6dc0
SHA1 54e9caf633b184085ca914976e6efbee0ae4641f
SHA512 d1a8fc09dd601cd6fcecc4c1c8ede4b8ab7e09081fd64dd29996bae022b23c40cf7510a3b34e413618ad5a38f8cf2c92aa37cccd0f1bdbad3c3f907ac9cac64e
SSDEEP 384:EJWJ4Vca12krtuVm+AglBOVjeQ8RJozighIjUXy7Wg5Pjm5q+GDa50ZQOYAV2cBA:Q+4VcWr1l8RJwig+jUXwJsq+GDa50ZQd
TLSH
T1DFA24C743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 7048b5d81341553ff7a7d3b0ed08e1b074e6ddf127cd70ac13a1ae2a5c01bf3c
MD5 0ccbec66c7cbda05350c610260f6cd4d
SHA1 b8f20e98436d09c350a79270bef3a766ad2ad789
SHA512 614e95580b75f1c46d39cc88a49a292fc4b49afc9162e4c63606065356c5df00d0a6df5b086e1ec79e9cf75ac6496669e91d09290b633d17ffe2ffd7eeae8164
SSDEEP 384:2JWJ4Vca12krtuVm+AglBOVjeQ8RJodighIjUXy7Wg5Pjm5q+GDa50ZQOYAV2cBA:e+4VcWr1l8RJyig+jUXwJsq+GDa50ZQd
TLSH
T132A24C743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk
Size 173B
SHA256 260c7fe06c1b3d5e053df1ad08222046a67d0e242743b8c863665f211f979035
MD5 7817d18da99a3d521dccf02d77f341d0
SHA1 bc16cf0aef63de4ff19a8364fe45f1f5b4a0ce3a
SHA512 ba3062a21e8808050138825f0078a6c96fd45681eceed491426666ffe4f3f09a24a61bcd2e1d08c2776efc21c36ba8a59cb42284dfe597da99ba085bd39f3cf3
TLSH
T1EAC0120003C68F6CC42303724B7F778CE174FE042A841709530602193811813D415445
MD5 SHA1 SHA512 TLSH

Submit Download

windows.exe

Path C:\Users\Admin\AppData\Roaming\windows\windows.exe
Size 6.7MB
SHA256 335ece5a7b777407207008ea7052a8e96fc56494d1d7422d5b5d5cdcf4cc3b5b
MD5 4530223e41575768248cff405c7b11f0
SHA1 4f8fb826fd24eee4c01633ddfd3530f2e9526cd0
SHA512 faa30477ec9cc195f48fb3dfe1f8404739b47cceb91272701c10def8791d5e808e6f1e5ec1ec0db06d1b391ff95f75d347b2ec9d810f79f635d798205d5fbaa7
SSDEEP 49152:ciTPMOfCI2CLXQzQpooN3UjvBUmuDbCQ+x52/wpfQIhgyzAhnsS9iO3TcfXzB20x:GO6IRguCPi1d62xYeOFzbZBxh
TLSH
T1C8667C19A3D50AE4D22BFA38CA668B33D772BC515637C30F0565E20A1F336919E6E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4216-20-0x000001FC62FB0000-0x000001FC62FC0000-memory.dmp

Download

memory/4216-17-0x00007FF78CA10000-0x00007FF78D0D2000-memory.dmp

Download

memory/4216-8-0x00007FF78CA10000-0x00007FF78D0D2000-memory.dmp

Download