5c589b14d68d78bb1ff3e25a8db47299ba7f168fc204c76270edef54680d8d19

Analysis

user interaction
yes
max time kernel
78s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b.exe
Size 37.5MB
Sample260905-tx31navyft
SHA256 5c589b14d68d78bb1ff3e25a8db47299ba7f168fc204c76270edef54680d8d19
MD5 88cc889ed3b47b0fd26f46ea2913cac9
SHA1 3217a8599c07e5b30c15cdb69c093dd7c3ba76ad
SHA512 35fcb3cd6a8cfcbbdecf83c1b567faa46567e8b53d3dd8e3c8e56ec8865eda5e15df65a42096497b116a7f7d0223d986b6b7dc28e4bece9e86fac3f96334f10e
SSDEEP 786432:ryqw9eNUvZTkZKjpeVZ/QrBk+f+qxkt9nfkcWmX3:69GcZdpeVVQryqetd863
TLSH
T1C58733D77CC062A4E1DA4A21628BD37D5092B9570EDB5C0D26C63D436F309EA2F0EDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
116	728	chrome.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	adwcleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	adwcleaner.exe

Executes dropped EXE 1 IoCs

pid	Process
3716	adwcleaner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2012	b.exe
2012	b.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002461d-214.dat	upx
behavioral1/memory/3716-228-0x0000000000340000-0x0000000001C9D000-memory.dmp	upx
behavioral1/memory/3716-382-0x0000000000340000-0x0000000001C9D000-memory.dmp	upx
behavioral1/memory/3716-383-0x0000000000340000-0x0000000001C9D000-memory.dmp	upx
behavioral1/memory/3716-413-0x0000000000340000-0x0000000001C9D000-memory.dmp	upx
behavioral1/memory/3716-414-0x0000000000340000-0x0000000001C9D000-memory.dmp	upx
behavioral1/memory/3716-418-0x0000000000340000-0x0000000001C9D000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adwcleaner.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
728	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330992637880864"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3716	adwcleaner.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4716	chrome.exe
4716	chrome.exe
3716	adwcleaner.exe
3716	adwcleaner.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3716	adwcleaner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	taskmgr.exe
Token: SeSystemProfilePrivilege	4196	taskmgr.exe
Token: SeCreateGlobalPrivilege	4196	taskmgr.exe
Token: 33	4196	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4196	taskmgr.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeBackupPrivilege	3716	adwcleaner.exe
Token: SeRestorePrivilege	3716	adwcleaner.exe
Token: SeTakeOwnershipPrivilege	3716	adwcleaner.exe
Token: SeBackupPrivilege	3716	adwcleaner.exe
Token: SeRestorePrivilege	3716	adwcleaner.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4196	taskmgr.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3032	4716	chrome.exe	97
PID 4716 wrote to memory of 4740	4716	chrome.exe	98
PID 4716 wrote to memory of 4740	4716	chrome.exe	98
PID 4716 wrote to memory of 728	4716	chrome.exe	99
PID 4716 wrote to memory of 1628	4716	chrome.exe	100
PID 4716 wrote to memory of 1628	4716	chrome.exe	100
PID 4716 wrote to memory of 2100	4716	chrome.exe	102
PID 4716 wrote to memory of 2100	4716	chrome.exe	102
PID 4716 wrote to memory of 4780	4716	chrome.exe	103
PID 4716 wrote to memory of 4780	4716	chrome.exe	103
PID 4716 wrote to memory of 4132	4716	chrome.exe	104
PID 4716 wrote to memory of 4132	4716	chrome.exe	104
PID 4716 wrote to memory of 4036	4716	chrome.exe	105
PID 4716 wrote to memory of 4036	4716	chrome.exe	105
PID 4716 wrote to memory of 4684	4716	chrome.exe	106
PID 4716 wrote to memory of 4684	4716	chrome.exe	106
PID 4716 wrote to memory of 1048	4716	chrome.exe	107
PID 4716 wrote to memory of 224	4716	chrome.exe	109
PID 4716 wrote to memory of 224	4716	chrome.exe	109
PID 4716 wrote to memory of 4680	4716	chrome.exe	112
PID 4716 wrote to memory of 3716	4716	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\b.exe
"C:\Users\Admin\AppData\Local\Temp\b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2012

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb59bec728,0x7ffb59bec734,0x7ffb59bec740
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,18091194906887770413,6058398372653379081,262144 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1532,i,2013012761891239738,5523919405924869782,524288 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2424,i,661006033526910923,9322650103275344591,524288 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,1501027535012601753,13961232925743576570,2097152 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,18042518469763587052,7337216469351714270,2097152 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,3354518230784831773,4447607463560033072,2097152 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,8358997642313493781,11469917826121730292,2097152 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5040,i,12597553166978344693,11585866673491009454,2097152 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4892,i,18295912234241913922,16135795744642231542,524288 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3984,i,718946809620002284,2021576824352284358,2097152 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6020,i,10924153853979567699,15397556649774600322,524288 --field-trial-handle=1948,i,15222824815386054626,2938141017696703097,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4680
- C:\Users\Admin\Downloads\adwcleaner.exe
  "C:\Users\Admin\Downloads\adwcleaner.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" winsock reset
    3⤵
    PID:2056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3756

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4488

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3184

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b4392c1e30e279c7c273210b747fb303e46ff364e0026a32f292f7ec18a7793
MD5 c73e1aa2c645385cee4e502e80b0dd29
SHA1 b6c7ce8b456deb56a4399a0a9108c16aa100b4d4
SHA512 122c27840283c8fd5405e3d593229d36612a9e46ed6d30a250d54354b2046dd6e3462cb228faa50ae6590d82ef0e68d5479e2292e9c4d30244d03befed42d0f1
TLSH
T1BFE022B9C862EC3B18F90B5DA0101786E794139B2A41C94F7A3C810D8FB1B3A8985D6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 9.2MB
SHA256 7108ed065682eaa24b007c54fd994648c868bfe86a0a61648319e9707da73965
MD5 94d193c0e9de9800a82bc70caf5c31c7
SHA1 ac37e67a148cf50c1ce38ff228b2d1160fd1f631
SHA512 a533cfb96c4081f914db72d582058a93d9dea63e1e895a5895e7b8c7737c089b529b9485360a6faf098164eb1493d25daf95b2e4ba1a7ea8d5d36b7f52a983f1
SSDEEP 196608:Rhd0iNL9rwxqxa+QAmDmFTxQaaMAQmrk/nasQ5OrORMg4cYNkyru1CRz07:Rhd0iYExaQFFafQQkCsrO4cIk8u1CJ07
TLSH
T111A6334D62B9A2D2DF2DC5B15072E808B28B4E542720F333ED20B455FBF778A39564E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 39c6c93d1b0978c7bb6863b240068e5944c6b9a0336bb1f6cd596b64cdd7eb60
MD5 d610eebfe38898cf2a95f7e0f90ca621
SHA1 4dedc9df6e63e7a48ac7c73315ed639a75ae681d
SHA512 fec7e51c7edeb544e73de366b322a035abc6fb0bdc39d96725c8b809452b2ffec320db4fbf8a1538421566bbea470475345f5c3f9a8926e2b10675d19dcb720d
TLSH
T1BB1189C1AC86108CEF40A1B6BBA51CD50439F43FB00E17578AE4CF34FE63ABC1060189
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 bdbcdc5a9e387e9fefca21b20d1620f6c2688635ac874323c6324a9477c0bc80
MD5 b8634755e5e9a96d4f7205c256709e3a
SHA1 a6281bc974ddba8e6c95f57780e5ed84771abda8
SHA512 2a07a8d6a084c59a4e104cc5d23d7b4ba9707e215d31e3ad0ade82a022bc192c1d972b6713fcb368e1658263569e519ebe8d7cbe92d2b890fe82825dc937817b
SSDEEP 192:DHpKTEaIadm6aOq0xrxzilNPqDaP1wmz4uYLwNVPZgq38OFHmV7:DHpKTEaIad1aOq0xrxzilNSDa9wmz4uy
TLSH
T10E026AF7C3E8CA6DD91155F4AB196F1FCE2E0925476C385B88D4AE2B93E24B1D10068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 6322f3487ec5bf1e140acfdc556a19f27a47bfa359250ee8992968fd31f689f6
MD5 9963b515251af3773709a20917beac02
SHA1 5f8d65179ff343725a375dcce1e4a2c3938200f9
SHA512 58abced204ba48f21f572d7cfa7c39245728c7a3af7494157f90fdc944c6e782a085542272b5feb7843f0f0fde4052608142d36c91dfbc4d4065e78e3a988452
TLSH
T1B4416DABE27F746711BA487B5D44B8091DBDB4321283B8F4DB56826CB0868F34A12857
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b43a6b6f0fe02abf64c157c32c956fca1853758170e49c16d24167cad4a342e2
MD5 3243c6e5db4870dcf330bb4309652097
SHA1 ac45bf913f40e3451c35c0147bd37a48f50dcb60
SHA512 17eb9c18df58a4347c036eefbbd70b17c080b581ea5d9be6b1325382613371ec11e1ea299ee59658ec9d0df394cf18104f052df20369cdf72589ff93038b1d90
SSDEEP 192:TRUcBzpkpCnMl2v70pAPRp2dAUir9+Hsb+WNBvLAO42g2X+fF2KoK0kwAaOVyIsH:TRUmzpcCgUXJ8wxje2OfF2xFgaG8
TLSH
T1BA52C83EAE206A3B6DDEC21AFA517727D3F6102125D51E84E6FC8A6C19D75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d89658970a6952600ecdfdb12ea29ad0053319b0088ff24ca95003f8f0428fb9
MD5 628aadfee6487bc87a51bd93d58edd0d
SHA1 d9e599bdcc6f311069346f948a50ac22a3a86c9a
SHA512 b17d3605cdd59c58b954b377e65848f2cf5d9af6f03284e5e0d3ccacd600a20162f70df258dd9af83a79174fd1239b0666d19eebb3ab4d8f645aa52a6ab738af
TLSH
T121B0120184015200C01305B41602149C61049F19D50D570143E4AA728C25061C019550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aaf1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aaf1.TMP
Size 96B
SHA256 44a412fb086f20dca5c7ad4e607df700107f5a688877cf3c398fc9ca1fa0b297
MD5 c195d1dc92452b606801df9adc42cbe0
SHA1 6c0371ff70975e431625dc12a5590946b4ea3098
SHA512 617e7bfb843e72ebafbf7a188a2349d139333084605b43d644a92db38f18e9260a5b42f89ba7034210a98965f8c311577a718f05cf2139cb3900ec70ebd40851
TLSH
T173B02200C002A302C0020BB038C280CC30A2CF2AC303222382E00AF2EC202200022020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 963448dacc7bcc996dc8fe91ffb9c11714b1466743e3b31f6f80e1c6772dd518
MD5 b1ebcd5ff5e4c7d33d3762af38f6a7a5
SHA1 070da63f39a08e93f6084ca886506472191fcb1f
SHA512 25d8b89b49b7065924ebd2ffcfae040e770d921a31a2b275a5bd2547cd49f8a7be9e73923ed962900c52286780cbe9d08e5134b3e892310214c4626e3d1bc836
TLSH
T112A002F442907660C1192FB1EA6102F41748EF2006071E0196D182B9CD616824201210
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 8d511f0263d448194181d30dd69c6d2db5e93cba2f19a9336e7c6002ff4aa84e
MD5 6f5aabb586849fcfc216214315bae544
SHA1 3834b1262e0723fb3ce354dd167d9705d81c0058
SHA512 7da3ef2cc37498bad9d029bfe30d8565c848484da7395f7af9b4e238cd5aab1d7179eaae836af8d70a9e22d4156d1597d577f91c90253a97ef1fdb229fe03e95
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2421RVumMmW5:1nbZeMrv/hG52smW5
TLSH
T146D3A94B3A747006DDE68A722CE0517B5E3C716D8F5591D528B620688EF2823B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4c88171598dfc50738a51db46afa143bb64aed6486feb6fce8b7449c759de729
MD5 09d9a444068783ae8b281adad28b3287
SHA1 56225d06429488be55609e1e015e6a2c74c62f06
SHA512 ae2779f7934401042b53934524b763be90ce3771d2e0490517e4399087d5a299ffd18cfc1414d181c237cfb4846aa11f21717dcd2052079a4a33c75eadc07977
SSDEEP 1536:b7LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Vqfd7NtZL8cHQRZEQ6Sps3
TLSH
T17AC30237ABC21F379D92CF64B9130FD657B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 ac35b5a3973e32a00060fd383ba1c907ed389a556e19c0ca420b97c2c2ce98d9
MD5 b4feb2aa1c4188e9c853907f87727e58
SHA1 c1411ec6b1d848e2b4a45d7b5213915e2c90761d
SHA512 51ca6f5c2893ef9fed1b4d7a9c6d67b928bf2af9c0dbcdada4d43120a5bd3f63aafa50df410114b6c0e7d4b96d0b955b85914843e8e3e6e07c3c7c1cbf106d48
SSDEEP 6144:PgyHdua++A6CsEoU/+Zn26tbt/qZ/ZLW3Exr:RHllCjWZN/qZ/piQr
TLSH
T1F1342373DFC50E33AD86C7F8391B4AC6D7F204D2A0689240966676DFBF93DD224069A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 16f2c07b30bc46693b7821a450662bb0ee008ee3743ceaa1001fac6c271ce214
MD5 0f16ecf4c57dfc7c105f29039cdf28aa
SHA1 8b966ac8264bd05bd7e7306a9fe3bf6e1cec271e
SHA512 5faf0a4ab1842d5bcc90901454a4118aedd109d31dc0508fa7bde3d4a504c7e06fb089c15bd540cf2bd5d02290ed165b824c8c16a629d11dbb1b43885a673525
SSDEEP 6144:igyHdua++A6CsEoU/+Zn26tbt/qZ/ZLW3Exr:MHllCjWZN/qZ/piQr
TLSH
T1E3342373DFC50E33AD86C7F8391B4AC6D7F204D2A0689240966676DFBF93DD224069A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 30KB
SHA256 e743847527ce198145cdff5b6242cc9b0aa8e1d0af55375d6a2ab505819e6321
MD5 d6522859859a37987ba91aab064e5fd4
SHA1 59a9a40e8a1c2528c6b2e0bf53ebfdba6c10080b
SHA512 4500d4d9f2037abf2e641f49b6b65b7a5cde5189f45ee0473832931d2d6e174bb766c00ba12818126b6afbaaf7249520b08a16ddee6d401a13960b66a140e050
SSDEEP 384:ev0oeuyRGwPNyQ62JP39ceW+i3+aXqaINfcFpJYxWwlzMaefQOVjeQ8RJoT:eYuyRG4P39cj+i3+aXqaINfclY2l8RJs
TLSH
T167D20A342AF51725F3F28F758AF59AAA683B7862AD10DB9D0162034D0537E53C970F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2012-0-0x00007FF610A00000-0x00007FF6129F4000-memory.dmp

Download

memory/3716-383-0x0000000000340000-0x0000000001C9D000-memory.dmp

Download

memory/3716-414-0x0000000000340000-0x0000000001C9D000-memory.dmp

Download

memory/3716-418-0x0000000000340000-0x0000000001C9D000-memory.dmp

Download

memory/3716-228-0x0000000000340000-0x0000000001C9D000-memory.dmp

Download

memory/3716-413-0x0000000000340000-0x0000000001C9D000-memory.dmp

Download

memory/3716-382-0x0000000000340000-0x0000000001C9D000-memory.dmp

Download

memory/3872-420-0x000001A650F40000-0x000001A651040000-memory.dmp

Download

memory/3872-458-0x000001A652340000-0x000001A652360000-memory.dmp

Download

memory/3872-440-0x000001A651D30000-0x000001A651D50000-memory.dmp

Download

memory/3872-425-0x000001A651D70000-0x000001A651D90000-memory.dmp

Download

memory/4196-10-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-2-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-9-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-8-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-7-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-3-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-11-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-13-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-12-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download

memory/4196-1-0x000001F0C96B0000-0x000001F0C96B1000-memory.dmp

Download