8aef6eac55c48be0295fabb745addccb935d8e3c613962d0c655f4c10205a9f8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 446KB
Sample260531-1mj85agz21
SHA256 8aef6eac55c48be0295fabb745addccb935d8e3c613962d0c655f4c10205a9f8
MD5 5328243f246f1d1125895ed440b087ab
SHA1 d21754a1031db1c0dcf1564589215eb880d44982
SHA512 b86bbfb506400bd29ae13af0214e5510927caf12c10b6c5d07c5a97bb754be7393b364dbbe42680da3b7e5a524d9e312df58b89c0701f2779caefe3b92289be2
SSDEEP 6144:SEl3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfzgFegvM2FQaCSWNIcroeXyb:SoNGG3U3ITEmUbqLEL2NuIcLCb
TLSH
T132A4AF15FAA814F9E177C17CCD634606EB727C5A0760ABCF23A489962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1904	SecurityHealthSystray.exe
1088	SecurityHealthSystray.exe
2888	GoogleUpdateCore.exe
5544	DeviceSyncHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1244	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5516	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247376008764478"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1244	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3892	schtasks.exe
4984	schtasks.exe
4724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
4460	chrome.exe
4460	chrome.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	GoogleUpdateCore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4460	chrome.exe
2888	GoogleUpdateCore.exe
4460	chrome.exe
2888	GoogleUpdateCore.exe
2888	GoogleUpdateCore.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 5036	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	80
PID 2144 wrote to memory of 4984	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	82
PID 2144 wrote to memory of 2608	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	84
PID 2144 wrote to memory of 4724	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 2144 wrote to memory of 4700	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 2144 wrote to memory of 3892	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 2144 wrote to memory of 1904	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 2144 wrote to memory of 3432	2144	2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 3432 wrote to memory of 1244	3432	cmd.exe	95
PID 2888 wrote to memory of 4116	2888	GoogleUpdateCore.exe	102
PID 2888 wrote to memory of 880	2888	GoogleUpdateCore.exe	104
PID 2888 wrote to memory of 3128	2888	GoogleUpdateCore.exe	106
PID 2888 wrote to memory of 4460	2888	GoogleUpdateCore.exe	108
PID 4460 wrote to memory of 2288	4460	chrome.exe	109
PID 4460 wrote to memory of 2112	4460	chrome.exe	110
PID 4460 wrote to memory of 2112	4460	chrome.exe	110
PID 4460 wrote to memory of 5516	4460	chrome.exe	111
PID 4460 wrote to memory of 2056	4460	chrome.exe	114
PID 4460 wrote to memory of 2056	4460	chrome.exe	114
PID 4460 wrote to memory of 3140	4460	chrome.exe	113
PID 4460 wrote to memory of 3140	4460	chrome.exe	113
PID 4460 wrote to memory of 1184	4460	chrome.exe	115
PID 4460 wrote to memory of 1184	4460	chrome.exe	115
PID 4460 wrote to memory of 4800	4460	chrome.exe	118
PID 4460 wrote to memory of 4800	4460	chrome.exe	118
PID 4460 wrote to memory of 3572	4460	chrome.exe	117
PID 4460 wrote to memory of 3572	4460	chrome.exe	117
PID 4460 wrote to memory of 4376	4460	chrome.exe	119
PID 4460 wrote to memory of 2532	4460	chrome.exe	121
PID 4460 wrote to memory of 5640	4460	chrome.exe	122
PID 4460 wrote to memory of 4780	4460	chrome.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_5328243f246f1d1125895ed440b087ab_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:5036
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240687015.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4984
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240687171.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4724
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4700
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240687312.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3892
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240687406.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1244

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:4116
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:880
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe4,0x110,0x7fffbb89c728,0x7fffbb89c734,0x7fffbb89c740
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,3703735332417138120,4676502642650274522,262144 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:2112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,5062884200033603949,9752789514634128042,524288 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,3821115846239993014,10459824776465116643,524288 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:3140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,16599132162907442516,4137426930133956468,2097152 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,7616763089273567432,12552051730038022598,2097152 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,13276604107130221225,18064282815415753457,2097152 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4380,i,15111455439676161354,2270734382804374011,2097152 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:9
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,11197277148514919459,878546021122682222,524288 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:4376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,3780080897583380370,15080333042756470909,524288 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,13116070518642043774,14587845219566274943,524288 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,1942741076580904284,3573257953119069017,524288 --field-trial-handle=1964,i,5581296594006735392,16183703970350547923,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:4780

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 457KB
SHA256 00bc0d875fd06da47f3ca1c6fff4231a58f1ada2de9293e4720116afed70bdba
MD5 92d1104ea7f089eaee5fe2edeb4ad854
SHA1 16243e43d9edeedd44d010411a2919b1bf9dfbdb
SHA512 e3b9788d163f09e228f724f1b2f40b129733bdcf48bd5ddf90fb94a63d411d7c0df0245efd4a2b8034d01e889771b4e0357f49c3927e6facdd0680091eb880db
SSDEEP 6144:+l3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfz6FegqM25laCSWNIcroeXymw:KNGG3U3ITEmUbqLELncuIcLCmw
TLSH
T146A4AF15FBA814F9E1B7C17CCD634606EA727C5A0760A7CF23A489962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 510KB
SHA256 4e26ebe0f5f357cf398b8224b7c20590112b4329b7aa8b15dddde0290b0775b3
MD5 f6add75baba3f507c4f777e6c8df0730
SHA1 9a6c1c58104c3c7eb518f5c1cfad328c4ce897e5
SHA512 fc5366fc28a56fa2b6f952ec47448824b0dbd32708bf900c9fc80516a6c5c7665a237b25db6bc92ca7f254728357d125d26eeeadd060f965a38a6354a85c92e2
SSDEEP 6144:Gl3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfzfSQFegBSqM2lS7SSaHHSkaCSWNIcrf:yNGG3U3ITEmUbqLELNQuIcLCfmDLYy
TLSH
T1DBB4BF15FBA814F9E177817CCD634606EA727C9A0760A7CF13A48A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ac0e687ab4b32c18c125232a0a7ed03359a0441f103d81e7278f5c1c7daa4f13
MD5 b831e22a260f3214749677577c72285f
SHA1 d0c939fff4b69d5ef2843d3e1a35cee49b545f0e
SHA512 d4fe6d7462c84778b3ec1f25102925037e744a8caa5fafd31c243b5c9b95899fc9ecefbcd00da99b8ee020a95eb1082fb7d88236e39146b0f4b9e2f2a61b0923
TLSH
T166F0F4BAC935AC6708FD5B5960644B07F754232B2B90899F3B3D434C8FB163B464581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 1f778110e9026e4c15ac557b09d3584606612b688d6ec6f21218ef55092cb12a
MD5 3b01b2b2b9451a1778da71e9dbd44501
SHA1 da53d45592d32390c2e51c790fe26ec34381e7bb
SHA512 f346dfbfb5098753ccf9983cd4e844a2aee50e9f7b57f46a1c3888f2d017c707de9fdadc40fc1dfd3bacfb3bce3e50c3379efcef7aa0c2fd65a92c1b92c158e4
TLSH
T13DD0A9083CC40083CB2403FC1C60083072692EF129613ABF03E860A39CFBAE470EAA4A
MD5 SHA1 SHA512 TLSH

Submit Download

8083db41-7215-4985-8fe3-5fd8d0bcfc44.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8083db41-7215-4985-8fe3-5fd8d0bcfc44.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6efbe058c200ff2edf6ca01d3a4da4b105f9609033469057872d83f3b187a28f
MD5 377cb026c7b00d31dac9d406e2d32c50
SHA1 070eec2cebb8c5070ae4cd3c0e215d3e03e08e47
SHA512 01a9250c145edaf78c575d5852f5378bbf9d4621ba814940606f066caad15ec29571f21cc648c5684e90189c4232784bfcedbd66da4cfe1df5a3ca905b71e1c3
SSDEEP 48:YALlhThqhIh/h0sIRstXLsBfsjfoKsQvos4KsczrschgmzscntsctcscPqzscXBo:DpMetKKweLvo2z7hZnlt4P8XxLcuNnK
TLSH
T113A19DF7C3D8C52D890156F4A715AF1FCE290A14432D3C6AC8E9AF4B93E2871D21669E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e0ca0bb741e6f9726b30e50b7cf100dffdda061f606247a662b06b98b1bc230f
MD5 2e3ffc3ddb77b9f260df114a0d62ffc9
SHA1 d663c1cd4b3b0921617a51db1564af478cd9433d
SHA512 86fbed174f20c9b5f7a47c5b47794d423c46573c46045f411dcf25de861e46b7970eab0e1e788c6b043dbb22d283d63bdad29e0edd9e2c2dcd3d2a8ea00d49b4
SSDEEP 192:CR+pjsHoHWsv7mpAPRp20ZPR9EHsb+WNnFOPWRe8V5VyIsnAUgtaJ:CR+pgH54aUXpawsP88
TLSH
T14D42C72EA928693B5DCBC229F9257B57D7F6102131952E84EBFC8B2C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 73405b5414b9f387126709ab473e8ac23fbe2f6d8c0517e8f65739c8ce0c1c48
MD5 2ccc6e3b60272f3569dc8df58a2c20e3
SHA1 d5e0a55ddc34b7f7faf6e4336b7cf3f44da10e4d
SHA512 76b1924a670dbf6e404fa6d281182e9571fd94d46e5cc170d41c01c182018cfe3f6b28404f8ebde3a13327f9c0359df7a6167746b3c9a94ef59de43516b8b3b3
TLSH
T1FBB012D0C4025111C01203F81542149C72589F10D70F2B0563E4793398251508454090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593251.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593251.TMP
Size 96B
SHA256 a359b9b01318ab10b59fe5a7d3d73ce2022519f1033b89addb20e58c5b09622e
MD5 ee01f5a9e462976cab75060fb603a864
SHA1 530792b3c3d3991589fa587fa8f606bd10084b02
SHA512 9bad4074f0ce4537b9fc6f99365f72782e5b59277b6de1aff2ddc82fb09dce23d4962deab3a0dbab46513f808174b87d7bf8cd5d8ccf377d80b9c6a98d830550
TLSH
T1ABB02280C802A202C20303B03882A8CC3233EF20CA03230AC2E00A23CC30AA00220220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ed765c9e8587f069081613fb50c3285ee95f2f58d07763eb7f2652a9868293f3
MD5 56f79147417bd12910af7dc4ee5c2f1c
SHA1 e15078847ce6646c52c38a949875051fe785f519
SHA512 e466d214db8e5b0d27173c0d56d5a309dea0ba209aee88e25426fb8d8d00669e943b7d0fa30eb5227023018c3e4d89b628cecc09cad41d6c7ff24ab04fe2b5ee
TLSH
T1D3A0021016D84821D90102B6229D5594E211AB50214EAB17609A9C569C9369C625E112
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 1fafb3fe302753361c03e5077e7482863c3d94cc844b25b0268a875888a0a1db
MD5 184e10827158adbebe8ab0ab2feff3d8
SHA1 3473892112085a7f489db08bdefae7b4bf6e0d26
SHA512 339847c2d8d3047bcc0726b2ef1ca7ee3b5fade5a227cd12ff00a8021b6e27e16207ba5da87f301b3d2317c0f55d3e243abd3003191b4a4ef2684194aa8f685a
SSDEEP 6144:LQVFm4vCuuwbzIUqSs1qKhm7Rkm1tYpBeh2BAo7:LQ2zwbzIUfIo9oBGcAo7
TLSH
T113341337AEDFDDB959742554614A050A3DE0D3938A20AE4AC8C65F057BFA6CC8F4EC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 8b704c1c7572b17063169ce2d74e2aa21c74dbcc44f64c414c35d416968e9584
MD5 e2a30d9b1c5ef6b9d528c79c34bfcf99
SHA1 132f1c6b323dd0f3feac44c5ed5b979187118eb0
SHA512 af16ad04a30e2d755d2ca8e023401201ba785b6619c34b73ef732b0fdcae6f72fb4768f2b900fd682ea9b82dce8d61d6212a88b5c16842221e3e440e38ecef4d
SSDEEP 6144:L4VFm4vCuuwbzIUqSs1qKhm7Rkm1tYpBeh2BAo7:L42zwbzIUfIo9oBGcAo7
TLSH
T1AD34233BDEEF9DB955B82569614E044B3AE0C7838A206E46C8C65F057BFA7C84E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 b598d02aa87b57afa3bf013ef8a90ff077f7412e288ab2de8363e93c640e56f9
MD5 6b4c8a29e4745829d1ccf9b4d55a6fd0
SHA1 d1395c7b88eaf6d3e949d99e8dfe23079af9de70
SHA512 fabe93872597773f95a650b3529f59cb2cea8283442115bdf7fff8acf48b08966a391093ac354a1c82c062ac943c8765ae6f00cc5c20f172a7be2c0595e383a4
SSDEEP 6144:U4VFm4vCuuwbzIUqSs1qKhm7Rkm1tYpBeh2BAo7:U42zwbzIUfIo9oBGcAo7
TLSH
T19B34233BDEEF9DB955B82569614E044B3AE0C7838A206E46C8C65F057BFA7C84E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9d17c377dd13085cc251b3a7baca1a2224eb4d43b0f97efa1df10b8b7d4cd20e
MD5 990dd09ba24f0e51403869edfa75e324
SHA1 58901d6233e284ec42e69c3ebf7136676205fb84
SHA512 b88a1f8873580c06f683fd393f81c5cb6e4a886be5da99e7f4c4b7ed4ccfdaf42f3a29e77d2a189ad5603f5b8fccdc94c2e20a2fdaaf1d7b7affdfd616d85d0f
SSDEEP 3072:3VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:38m7Rkm1tYpBeh2BAoi
TLSH
T1F4C3123B5E74E9375879BB0EB08E0A1F1EF149A6C920DA82C8D85B0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 501KB
SHA256 c3fbcd17e423ad6419e967082bbf3c17931de642dabd3cf917aabe0e8ab8f992
MD5 895c93355868f0f505c25d36fbcc86d5
SHA1 8d71378faea8332eee21be57bc008787d7594f08
SHA512 f5d3ee6f4ba97c736dde62e7f22a651706b3415baa452dc90c9726491b846a7509de324b03a178eabde0bbe149b76e5381248102b602c0c5fa1b764205259afb
SSDEEP 6144:hl3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfzQFegtM2dKaCSWNIcroeXyfmjLjLYG:vNGG3U3ITEmUbqLELsLuIcLCfmDLYG
TLSH
T127B4B015FAA814F9E177817CCD634606EB727C5A0770ABCF23948A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240687015.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240687015.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240687171.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240687171.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240687312.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240687312.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240687406.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240687406.bat
Size 250B
SHA256 de039a0fe08ed2738b52c529534921ef3535ca9e00209a3aad957ae53d7ef02b
MD5 86497b667df586cb63a912308f257655
SHA1 c9c3b23a1481e98631580dd18bccdab037b43b10
SHA512 3c27bf58efb76672fc33c470b86c8f90eb340d1d911e9a6b0ab88e1399ef0fd53b1c65f8ccbd6b03282ab3e9b35ed02950bb5efd09aeaab17e91d23398af6c4b
TLSH
T1CDD09743826BC2A50512A04302AD8D4C8465E8080F40B3A243EAE88D12A540CFA5AF82
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 468KB
SHA256 4cee710f0e1ffbe56cf15ebe2c1b367f8e1c4067bf2199b8add34e651ec58505
MD5 3b571788272d535c570ef144796686b9
SHA1 8c4edc24ed786945dc03c0d7dca4a30b76868219
SHA512 fb1c43e079c9a9a78b24809e2a608fe1748879c52045dd42201865054ca391abcbe15b3dbaf32845930265d94cf99993fe74263530d34304392786b5a609014a
SSDEEP 6144:Fl3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfzYFegNM2CLaCSWNIcroeXy/i6R:LNGG3U3ITEmUbqLELrGuIcLC/rR
TLSH
T1E2A4AF15FBA814F9E177817CCD634606EB727C5A0770A7CB23A48A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 515KB
SHA256 f36e784152e9ad6a95d10e29a235be931d6a271761e404b5947388b5ebe7dfa7
MD5 b10e8bb041f08507a97dee4608c9db80
SHA1 50d7945f7fe59edd240b626ea0fb6f968ed957db
SHA512 339e2334f1d4c349054f09ef7e88c63b451d297930af71b5e6fe6645126fe9fc9806c381462b709904025d9e8507d23299f0d10c8085eb6ee02a493abf7ecfa9
SSDEEP 6144:Al3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfz+FegPM2wraCSWNIcroeXyfmjLjLYdE:sNGG3U3ITEmUbqLELtmuIcLCfmDLYy
TLSH
T101B4C015EBA814F9E173817CCD634606EA727C5A0770E7CF23A48A962F236D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download