4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe
Size 850KB
Sample260910-vs87jsvzcw
SHA256 4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382
MD5 368507f6c63a2d5e232fe479ab5210ea
SHA1 07c9d746cb22eca0fefe6c2956bc46ed0dbcc756
SHA512 4f3ec6a5c015d72c42bff2b383b79cd5425f8adbc7571e1272c708564b27587d980957c12dbc3fb38a10bb9c22e2293a25e014a805053a9d02fb59a52e4a9ccb
SSDEEP 24576:YAIAmUbqo8DuIHXEWnHhwwp+eheLnnrKfp:Y5A5uomu2qwp+cGnrKfp
TLSH
T14B05F155EBA414F9E277D17CCE634505EA727C5A0370A7CF23A48A962F23AD08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5540	SecurityHealthSystray.exe
556	GoogleUpdateCore.exe
5128	DeviceSyncHost.exe
3548	SecurityHealthSystray.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2792	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1912	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4448	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335342396247006"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1912	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2448	schtasks.exe
1684	schtasks.exe
2120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
3168	chrome.exe
3168	chrome.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
556	GoogleUpdateCore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe
Token: SeShutdownPrivilege	3168	chrome.exe
Token: SeCreatePagefilePrivilege	3168	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3168	chrome.exe
556	GoogleUpdateCore.exe
3168	chrome.exe
556	GoogleUpdateCore.exe
556	GoogleUpdateCore.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 5264	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	94
PID 4616 wrote to memory of 2448	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	96
PID 4616 wrote to memory of 3944	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	98
PID 4616 wrote to memory of 1684	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	100
PID 4616 wrote to memory of 4896	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	102
PID 4616 wrote to memory of 2120	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	104
PID 4616 wrote to memory of 5540	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	106
PID 4616 wrote to memory of 2792	4616	4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe	107
PID 2792 wrote to memory of 1912	2792	cmd.exe	113
PID 556 wrote to memory of 5984	556	GoogleUpdateCore.exe	123
PID 556 wrote to memory of 5008	556	GoogleUpdateCore.exe	125
PID 556 wrote to memory of 1248	556	GoogleUpdateCore.exe	127
PID 556 wrote to memory of 3168	556	GoogleUpdateCore.exe	129
PID 3168 wrote to memory of 4848	3168	chrome.exe	130
PID 3168 wrote to memory of 5816	3168	chrome.exe	131
PID 3168 wrote to memory of 5816	3168	chrome.exe	131
PID 3168 wrote to memory of 4448	3168	chrome.exe	132
PID 3168 wrote to memory of 4308	3168	chrome.exe	133
PID 3168 wrote to memory of 4308	3168	chrome.exe	133
PID 3168 wrote to memory of 5760	3168	chrome.exe	135
PID 3168 wrote to memory of 5760	3168	chrome.exe	135
PID 3168 wrote to memory of 5088	3168	chrome.exe	136
PID 3168 wrote to memory of 5088	3168	chrome.exe	136
PID 3168 wrote to memory of 3088	3168	chrome.exe	137
PID 3168 wrote to memory of 3088	3168	chrome.exe	137
PID 3168 wrote to memory of 5940	3168	chrome.exe	138
PID 3168 wrote to memory of 5940	3168	chrome.exe	138
PID 3168 wrote to memory of 1384	3168	chrome.exe	140
PID 3168 wrote to memory of 5652	3168	chrome.exe	142
PID 3168 wrote to memory of 2448	3168	chrome.exe	143
PID 3168 wrote to memory of 5648	3168	chrome.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe
"C:\Users\Admin\AppData\Local\Temp\4cedf87196fee7d44845e300c6120a28a361cd0b298b0cb8963e770c6211b382.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:5264
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240661625.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2448
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:3944
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240661968.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1684
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240662296.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2120
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240662484.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1912

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:5984
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:5008
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0d29c728,0x7ffc0d29c734,0x7ffc0d29c740
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,11006901970734958863,8647810916414281397,262144 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:5816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,5916527032963567494,11253667155656704442,524288 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,13924905450964960928,4710168960969740432,524288 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4207212684491365131,850990960248371048,2097152 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,18066577413354618684,3013240276067505982,2097152 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,10388372801807772328,3987758005777421236,2097152 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4480,i,14314399915608602522,17606364527978127688,2097152 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:2
    3⤵
    PID:5940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,3820297262276024355,13143615058749926884,524288 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:1384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,9600058175614765070,9949725302483969315,524288 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,4880977113388177316,5450375323689570850,524288 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,10873805342097360257,7866083817994863080,524288 --field-trial-handle=1964,i,3408226921401443957,11075654617300134868,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:5648

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:5128

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 908KB
SHA256 157f6d8a713908b7c1e5daf8ff6706ac38cf589132ecd58d8ecd3bceba4a9d01
MD5 745a39f9f07801e68be08863575f5419
SHA1 f51225ecdf98e7badb37181d7ce279b459bd70f9
SHA512 835fa5c5892b80be2f594e5ef0e8ea50b5781ba132759d6f64e1b65d15bb7269bc75130d111f44d0f646a0566cf6065162b2d448670047bd9aeb63d736d22910
SSDEEP 24576:oAIAmUbqoL/uIHXEWnHhwwp+eheLnnrKf919:o5A5uoLu2qwp+cGnrKf919
TLSH
T18715F155EBA814F9E177C17CCE634505EA72BC5A0770A7CF23A48A962F236D08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 307e33044343d26d5f5fb0b65bcb7fc704a7e8e0b1bd87c8315432510c635c55
MD5 0c494602a1778303187a91109734ab87
SHA1 99962417648d7be933f607d763dedf09f68b156d
SHA512 c339a470d31ac5c516a5fe31544c4386710dc0a7aa16006ef34ce4d30f3867a6169fe773b40892e07d53fedc9d00e0242d0f1fc87489658744341cf51fdc5f6a
TLSH
T171E02BADC965DC370CFD175D51500745E65463173740554B3B3C89194FB533E5746C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 fda4fa365d17c14645531d9c7593ab0574aa851b0de220464c0f9d09a015cf84
MD5 bf1f5ca9156f2b88d49749d6d2c4eedc
SHA1 4090fe3cbe18f448d84c3082182905795c3609e6
SHA512 fabc8515a981e28acee80cdf9b0244fc1bb1be747f1111ca3c165bf408e3ac751bd580a93f0478a953ff93dc420235bc01dc41898999ca1cc6b7ec4b2dd3310b
TLSH
T130D0235C64C01B11C73031F0151338F43375C9AC554C430AC1B4CFE5962739159350DD
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 29ab823087c4fbbfb8f6c75ee31781d19305c6ea4c800f6a67069f24470a5b49
MD5 3a7a3f252cdd4287de7d481dff3afdee
SHA1 cfc2050902debfaba0457de91d9e3d1f1154b3d2
SHA512 0be7695fa0da60e4874c64f559565b6d9824094ab597ae64b3285bf567f4e2c40322a773d093dd339d69fad94518be4f9825aff2bf6140f36651907de106ed3e
SSDEEP 48:YALlhdrh5Ph5gh5Oh5Uafo7XYEdKsXrsZgmzsctscqzsRBsmFsOhcsF4su3a:DfrfPfgfOfUaaIEdFUHPxRFpuK
TLSH
T1B2818CF7C3E8862E891156F4DB156F1FCE290A24431C3C66C8D8BE6B93E2871D21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cca58e20efda45e921bca0cd44e6c80c288d94bd3e4932358d6a0e95d88779d5
MD5 cac276771c0e9e182927e0319815df5d
SHA1 9ef353963d07a1316d2e80e106e12c5aa01e9170
SHA512 16ebf36429ebab4f92157f331b72ae2149213c87972458f13914263f054c6e20eb8aa1fed7d469061c0f0cf370e9d1615a4bbd925e657c84ed04044f86161cb1
SSDEEP 192:5RNYRIyAh4dZ/3v71hpAPRp2FiTs92Hsb+WNnL6PIP2zeVZZheHjVyIsnAUge:5RmRxAhofBhUXGQwGPS2YZZhSFe
TLSH
T10942C56FA910697B6CDBD21AFD627B93D7F1102121E52E80E6FC892C15D7ACC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f4e6c249d5ce4851de0b44e05816dd8015a86ad104651171622b92823ee354fc
MD5 d7bd1f037ba90a1490ad6633fadea3b0
SHA1 17b70e3441324f12b115545e9c9fa68db56b4de9
SHA512 48f541a2469d66ba0299fc31b6632df1ae810ac82f81c657b1c1b460148de97521ee3ac9dc7bddb3e2df929de1fb9501bd6249115c05ffa285e20de7a3c4e4ba
TLSH
T128B01290C0029112C00303F411521488B254EF1C961E170153F0A962882529080242E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d26e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d26e.TMP
Size 96B
SHA256 669ff71021fec2ceb7c982bd75c1a2655c7cd4dd941421f6e31d92375ec8f523
MD5 c52ffd1f22f83c867a4860c69e1dc881
SHA1 704d84d1bb7be84459b4b5ac40cb1f4a3bdcd095
SHA512 cf66725494f53c83813c8d894c0e6c958623edabb20e5c0175c69dbc944302880b4366a717140d2afd649863047d7637de7f2aaf33a49fa2300b74e526be05d6
TLSH
T166B02200C002E282C08203B0288080CC3020EF2CCA23020A82F03E22CC20B3202308A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4b8e53c39031860b87a8d12b2d978f20b9898d7d5117da5404c79a0de544c0fb
MD5 55477e8c97a6e82b994988efeaee9a86
SHA1 b6bb13b34fd5412ac1ade2699befaf9616c14661
SHA512 1115bb311f05fa54a8677fddb602b70f0e3063c8383921a32c75b9dfbded988b44d3289f9da2df4e9eabf53a931caee8c632f19d1841e750533af1065bf021eb
TLSH
T1F1A0027B52F90802DD18477511815294633089543905A6134DF2E0648A5715565570BA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 941b7e90aaae3d074eba476b659e0f699b0fe707779f9de97297805b9c4a2d45
MD5 d6d682e55d79e81d322628cb26031e5e
SHA1 d2ea7f690360eec427bc373d5b8dd7ca6da5af6d
SHA512 31eb1ba705b975ecab325ad5a46a09c1c0646ddbe4aab6fa7b0c7d18c7c6783c6fa03e445b6d5b953b4abb1b2dd67ea1835c609972122fdac6148cb2f8574de5
SSDEEP 6144:f1YAs0GZu+ZZAKvP7MNm7Rkm1tYpBeh2BAo+:2blZAK37j9oBGcAo+
TLSH
T1E23412279D25EE3BC6B8EF6B704D281F0EB069D3D950DAD991C8174876EB7C94D02A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 552da83dca0cac5d00182ce2889bfc2304ecc77c8900cba86446ceca3ecc4c9e
MD5 80dbca3104ef5f83e717b6ca5d44941c
SHA1 8f77564e5e4f0a67c48b7e685c43e6cc18e4e4ce
SHA512 4cd57e98485ddb7104b4dc2ea9589e5e48f0138399146eabbd9acbe3181ecb98ab2f7c90002e0a55ef3a8100aa08a4195af7e644bcecf29061e32a4143999774
SSDEEP 6144:nYAs0GZu+ZZAKvP7MNm7Rkm1tYpBeh2BAo+:YblZAK37j9oBGcAo+
TLSH
T12E3412279D35EA3BD5B8EB6B708D2D0F1E7068D39450DBEA81C8174876EB7CD0942A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9c12f11f32f06821d3d10e5189278d3ef54d7b32a050c625e13f7b70bb0d3112
MD5 d4d64b4b48b0aa66cc306d507a115dc6
SHA1 56ddac25ff51265e1a47dabfd720517145c47f26
SHA512 29837433e2f10a7cbad4005f81a0273b9a4a312e8c41ba4a2a4927d56e97ea24fdfb31adf1adaeded7c4f5da4d9ec4af227579730b6bb381fc8b5f8b62fa24cc
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:em7Rkm1tYpBeh2BAo3
TLSH
T1D4C312275E71E9375D79AB0EB08E0B1F1EF14AA6C930DE92C8D85B0437EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3b91f72ef9dd99fb37888f1fc55c4e59eda1e1ab3ec1a11e71060ce9dc742684
MD5 a85b8a34147f57e06ad56514401aebb5
SHA1 35a76857afa83b537de898c228cf79e0b61a3ab9
SHA512 0839e1a6c3f2b5552fff87b81e87a702244d8ad9d43f75e21d219abfbf48ecd0728b115392133cf38d8ea6a5266e47ee0fdaab603bc73d41660fa99650548de2
SSDEEP 3072:XGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Wm7Rkm1tYpBeh2BAo+
TLSH
T1C8C3123B5DB5A9375DB9B75EB08E0B1F1EF149A6CD20CE92C8D45B0823EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 898KB
SHA256 342d5572d3c23ace82b149e67c09e7b29381819faafa7c3784c0b7d234bb2f37
MD5 3d777685688b2c50665de0bbe2e4571b
SHA1 4c55dc5aeb8ce129c335cc0594fcaffb17e17d7b
SHA512 802c58ba4c7a98a869200a06d56a4b574d0bccb407ba3181627c95f0b5b72fa43a4d4d9d0ec2755f525345cede2c02de5cba335078ec3f1d56edae800ea11316
SSDEEP 24576:LAIAmUbqo3huIHXEWnHhwwp+eheLnnrKfRza:L5A5uoRu2qwp+cGnrKfQ
TLSH
T16C15F155EBA414F9E1B7D17CCD634506EA72BC5A0370E7CB23A48A962F236D08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240661625.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240661625.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240661968.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240661968.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240662296.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240662296.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240662484.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240662484.bat
Size 229B
SHA256 037dee79f9dec45642adbe35b6c0583fc0344f164a273744e9c7c9e026537f76
MD5 ed4bb053ab157f92a6a5c308aa10f058
SHA1 d1af49cbca575819376745434813ecd40880b73a
SHA512 b9c7b469691c36089129244d32c0b3c691cd69833a4f78de018228fce228e6abaea162706a4e4b6aef010ad3600a81b9974b245e87ea7523ff2261e3f8778bcc
TLSH
T1C8D0973F828882280308D986403EA24C84A8E82D2B80B3A34D10440C1205D1EA5833E0
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 904KB
SHA256 d8f2a20ee1ed484174fd9d83a9484ec585155d754b79fd6c35de1f5475116f42
MD5 b71af3435af7f1eeea3ba26b6adc5137
SHA1 c818ae5cebb6758e7ff34eaadad90e2e9510228f
SHA512 e4b65289abd2ee641499ec09aa788b21fa51002e032bd44f342812cc4c0888289f63520bfcffd8c94fe257f8fc25452091480fef8597ccef806a31d82ed655e8
SSDEEP 24576:JAIAmUbqom+uIHXEWnHhwwp+eheLnnrKfv22l:J5A5uohu2qwp+cGnrKfRl
TLSH
T1AD15F155EBA814F9E1B7C17CCE634506EA727C5A0760E7CF23A48A562F236D08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download