bfd09180ff97722e6ac0f6ba03dbc59919481d6c42afc7384f5086362dff4605

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 712KB
Sample260709-efcd2scv3n
SHA256 bfd09180ff97722e6ac0f6ba03dbc59919481d6c42afc7384f5086362dff4605
MD5 15385bde7361b86bd7fe3e99da788b0d
SHA1 051b0e57cf4f509aff6ddb1a591b5af4618c4400
SHA512 5ac4295a9772fcb2a3525118e2f73e8c9d534970175fec74b01061c62d3ca248d0a747678bae72e3fa69590fed449a66784f57c7066d483451f471f443b88970
SSDEEP 12288:NNGG3U3ITEmUbqLEL1DIgD/dn9BDL/3ka49WURkjVT/YaFYzNLEqaX:NAIAmUbqoBDIgD/dn9BDbRTxMqYzNLE5
TLSH
T182F4E115FBA414F9E2778178CD638906EB727C5A076097CF13A44A962F23AD09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2256	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
1476	GoogleUpdateCore.exe
4160	DeviceSyncHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1448	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280427960764537"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1448	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4852	schtasks.exe
5036	schtasks.exe
2976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
1184	chrome.exe
1184	chrome.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4016	SecurityHealthSystray.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1184	chrome.exe
4016	SecurityHealthSystray.exe
1184	chrome.exe
4016	SecurityHealthSystray.exe
4016	SecurityHealthSystray.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4936	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 4736 wrote to memory of 4852	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 4736 wrote to memory of 1924	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 4736 wrote to memory of 5036	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 4736 wrote to memory of 3504	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 4736 wrote to memory of 2976	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 4736 wrote to memory of 2256	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4736 wrote to memory of 1272	4736	2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 1272 wrote to memory of 1448	1272	cmd.exe	106
PID 4016 wrote to memory of 3956	4016	SecurityHealthSystray.exe	119
PID 4016 wrote to memory of 2036	4016	SecurityHealthSystray.exe	121
PID 4016 wrote to memory of 4712	4016	SecurityHealthSystray.exe	123
PID 4016 wrote to memory of 1184	4016	SecurityHealthSystray.exe	125
PID 1184 wrote to memory of 2564	1184	chrome.exe	126
PID 1184 wrote to memory of 3712	1184	chrome.exe	127
PID 1184 wrote to memory of 3712	1184	chrome.exe	127
PID 1184 wrote to memory of 4444	1184	chrome.exe	128
PID 1184 wrote to memory of 3500	1184	chrome.exe	130
PID 1184 wrote to memory of 3500	1184	chrome.exe	130
PID 1184 wrote to memory of 4544	1184	chrome.exe	132
PID 1184 wrote to memory of 4544	1184	chrome.exe	132
PID 1184 wrote to memory of 2404	1184	chrome.exe	131
PID 1184 wrote to memory of 2404	1184	chrome.exe	131
PID 1184 wrote to memory of 3856	1184	chrome.exe	134
PID 1184 wrote to memory of 3856	1184	chrome.exe	134
PID 1184 wrote to memory of 3988	1184	chrome.exe	133
PID 1184 wrote to memory of 3988	1184	chrome.exe	133
PID 1184 wrote to memory of 2328	1184	chrome.exe	136
PID 1184 wrote to memory of 4640	1184	chrome.exe	139
PID 1184 wrote to memory of 3872	1184	chrome.exe	140
PID 1184 wrote to memory of 388	1184	chrome.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_15385bde7361b86bd7fe3e99da788b0d_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240682375.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4852
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:1924
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240682703.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5036
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:3504
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240683062.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2976
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240683265.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1448

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3956
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:2036
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90878c728,0x7ff90878c734,0x7ff90878c740
    3⤵
    PID:2564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,14519791296082286215,76557796444017504,262144 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:3712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,18013146691366064985,2442267876647884692,524288 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,6432957114328804341,10051297856655701600,524288 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2844,i,5378052247235275520,3997703463371567585,2097152 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,16165005476427544198,15320193906124593677,2097152 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,7179767769308631703,7215817910807143635,2097152 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2448 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4392,i,5251014446547452659,7259644911816000599,2097152 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:2
    3⤵
    PID:3856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,383537010992535775,8153322737080420541,524288 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,7314799182655076951,6331537626139137913,524288 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:4640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,12312060497201635141,15519591308742947661,524288 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:3872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,16030746357382477117,13488075808684603267,524288 --field-trial-handle=2004,i,18301216563561551968,656739831300274947,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    PID:388

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:1476

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 761KB
SHA256 1377a853a0cc2535573c8c65b8bb88064f2206672b8e5ba19334a130185c2992
MD5 14e65f254132a9e5099b4a7e882dc2ac
SHA1 17af24f5056e8d1d08a6ef9a555b381c66d55832
SHA512 16510ccfd61a085a1a619fe8d127754bbfc81367123e517df9ea552ba61671f4305246ebbfe011517cd849399ac757f9ad48afd3a7121b38634d4fe869a02ff2
SSDEEP 12288:2NGG3U3ITEmUbqLELur/3ka49WURkjVT/YaFYzNLEqa/Thv:gAIAmUbqoK7RTxMqYzNLEqa7hv
TLSH
T17DF4E115FBA414F9E2778178CD634502EB727C6A07A197CF13A44A962F33AD09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 731KB
SHA256 093229dfc9d630b2d463d10e52b024996676cb852858afbeecd20bc56d04bbe2
MD5 3c5e52f5a32f779b0f990081ca1d817a
SHA1 f6071f49b76bce268a191b752b2b0f7bc07f609a
SHA512 36ff0cf250d011822228b1775053a573a1ef6e73d87ce79c61f7aa131c0ab718fcd1781d8e89016a1b7c192f754019eb0199bc665e2e01f78b33481da84a3166
SSDEEP 12288:rNGG3U3ITEmUbqLELZh/3ka49WURkjVT/YaFYzNLEqaeJo3:PAIAmUbqo1dRTxMqYzNLEqaeq3
TLSH
T14FF4E115FBA414F9E1778178CE638605EB727C5A07A097CF13A44A962F33AD09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6288b3cc7ed676839134956590064101492b3d278d5949652c2dea5324a0b3b9
MD5 bb2392ea4dc9d2a998a5ef5e71273674
SHA1 f31e353bf2f25ac0cc86a999e7776449581b6067
SHA512 70d665fb9b14821dd742a4083f600cd4b10eaa13bddb696407018d24457180b410e4001b956dbaf825dce32dd24ba07a197951de10967c168ab5332ff4c21caa
TLSH
T12CE02BEACC22EC6B2CFD471D50900685EA20139B2760C45B3B3C964CCFB476706C589C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 efc193fb545958a55e481f36870f02ad2d96df63654eb3fcd2ec44b64253e145
MD5 098a2fa18d49726aaba4c4a8c351b1f5
SHA1 475e6675f4ab94d1fae76cc22cd8e4ffbfae42b5
SHA512 561783dbbdf1d3c2a349b0083ac093977ef773099c100c7ee03e1bf129647db12742023a4e3a98e206995bbd63fe52156307c32aa4262abaf37298f01ca1549d
TLSH
T191D0A98033812272CFA302F3526A8C882B2E3C3BC164A36680D400EE08FA2D804F0270
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b960763c93a22bb6cde462446f319e00a8df4f33276ec9209ab9689f019f9b8a
MD5 ea940f5375a38b66d67eae73a2c6816e
SHA1 d994ec267f0dd05ec256dd6af63a233ca7902afa
SHA512 253c3ce0edbb19fa4349e6ccdcb760d2082f1b699941cb0494c956946cdfb55effa996a98722f7c02938c193d4151e75c11e7534935fb5dde5772f91f415c4c0
SSDEEP 48:YALlhWGhWJhrXhWQhW1aXYfo7EdKsJVrsJ6tsJjcsJCBsJFqzsJC4sJjFsJAgmzY:D8G8J5X8Q81aIaEdd5CYkAJR3K
TLSH
T1D1817AF7C7E8852EC94196F49B156F1FCE690A14431C3C6AC8D4BE1BA3E2872D11539E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a79c9ca7f60a2609f5c0eaa9885cb7212805bfa78a903741d4d44fe3eca09ca2
MD5 2fd69236a70f97f78aeb9ba837ce73d8
SHA1 bf251c5a033e38f78d44477e952de8d7d487ae87
SHA512 8b5fead9742507a138867e621f8bfe7df7d169726d3dd7c2d4eca0ca8c69e7cc40850b22a612890d82efeaadbc71b9b189de1d768739e55df972810ed9801c61
SSDEEP 192:IRdc/DYM8fpqv7ApAPRp2GmQb9qHsb+WNncCPgp2JlOeELVyIsnAUgtaJ:IRdcLYXmkUXJkwZPI2JlYN8
TLSH
T1E352B72AFE11693BACCAD219FA567763E7F5203521943D80EBFC892C15EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 33eef92bb387a64a0c460149b9e868b285bfbc2ea06b9f15670d788bc3283588
MD5 a49d6ee23d0aee41a3c486fab3ad25f3
SHA1 1c4034cded174c232d1870ad1bc1c45851be62ab
SHA512 fe1afebccf8f7be61a4c76bf3a18294af9a9e23b53b812fb705a99ac48aac44933144f67326651f60ecbd3aaffe5f29a897b53ea42d148d23b12d1a200e4539e
SSDEEP 192:IRdcCUeX8fpqv7ApAPRp2SmQb9qHsb+WNncCP7p2JlOeEFVyIsnAUgraJ:IRdcxeOmkUX5kwZPN2JlYze
TLSH
T1F652C72AFD11697BBCCAD219FA567B53E7F5202521903E80EBFC8A2C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 735f971ebf15bdd9c0aa3c6c04251b3d7b59da376fd4600f443bb83728b319ea
MD5 db4b1f39d0f3f2fb88ca719a89b22451
SHA1 3cbb6410b324a17cc3ceb742fdf1c2b6447b8c46
SHA512 6b7800499f9b561fd698708235eded9151ed6c810f51f69fc608fe315e5905cecf5f4a302c47748b31022896b7c1e569bdf8ca3036e02ae7e5fbe5239dfc3d84
TLSH
T1A9B01291C2015561C45302F4215254DC71149F209A0A270553F0A9768829A918034060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592495.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592495.TMP
Size 96B
SHA256 43fe29ca18edc1e3e3ee0e983f1e145e8e1731c23eeef751a9a1b756ef57178f
MD5 e49b06a0f4e84db7de741bc2071e124b
SHA1 1d84fb219f5d5d3c67f139f25fb62613c347dc2f
SHA512 36ad15fd1d50d0ddf0f9de0ad3b02143b6d3f60e8ac0266b183ac63d184b85303ebc86fb85ec5ec24c2acd54936765b66ed5af8aa2cfe6dd326b1892c72e0916
TLSH
T1B2B02202C202B22BC08203B02CC080ECB220CF28C2030202C3E20EABCC232200330830
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ac2aa00a657e7e4306b260447e906205144746f1844aff996742f7ca33ad2a89
MD5 959eaa32343ceab8f9d9581df17eeacc
SHA1 a0108058c5b224c7732de6d35bfcb83ed57a364f
SHA512 0a270fe3dd710a2094a5fb0367aaf10682fda55d61888e925546ea9344e5f585e8923214d98eed44b4d2f810b87e69367f6ab63d2c428dfd0ee16eea010cb496
TLSH
T135A0025407C49871C805067354CA225836117C9E691AAF4761DF92CE8D935CCE719013
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 35532adbe07ffda12b9138e3751961dd73ce5b2278dedd5619055230f06f1d6a
MD5 9b28098959a27b7a0b12e3e467f460f2
SHA1 fad41a620c90623e952d41d4dc82f364fd0e99e5
SHA512 68af330782a0b6bd15f8dd47325af000a56b5fa752fa54baca42f834c36bbb5ccc9da89d5b5db16ec10fc2b9fc4731a802c6290f750cc37bcce3c03476573293
SSDEEP 6144:1cKUIgXsnK7utyfNKm7Rkm1tYpBeh2BAoM:22gHutk9oBGcAoM
TLSH
T166342277BE79AA7558E99B2DB2CA0F1E1CB0D1D3DE28CD0254E8750447FCACA4A09D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 6a4715befb14e200f6ce7aa5fee575fc3642f655d6c1c1fdd3afb0e32e43421e
MD5 6c7553f17a2e4eb1f0eef6ce5ce76f3c
SHA1 086ec194eb5d6936c8371dd6721ebe60c033ebff
SHA512 3b3ca687b2011a4665775047bc2df05aa6b5b8f4595b60261f6914640551782a2a7e0cff3fdc1d76756b6c3e981c05c18fe92f3166bfd9548dff7659f8f4b317
SSDEEP 6144:zJcKUIgXsnK7utyfNKm7Rkm1tYpBeh2BAoM:e2gHutk9oBGcAoM
TLSH
T18534237BBD35A97558E99B1DB68A1F2E1CF0E293DF28CD0668D8740453FC6894E09C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b3df3e98dfaf162e0acb509e0432d5ed86c37b418bf064f1c99c0cfe7a85bd37
MD5 65adcfa661b022303476f037d6d26535
SHA1 c5c2c6368d6ca6f25c23de7bc40ddc361627d26b
SHA512 5086cbebb651b182049a16009d309e45a5703d63a6af4fe652177b765a06a6a20a5dc47e9463c905bcde0efc0be6b28e3ad1c9aca8b573969d615780fd7c522a
SSDEEP 3072:ApGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:3m7Rkm1tYpBeh2BAog
TLSH
T1A4C3023B5D75EC3B5CB5A74EB48E0B1E2EF149A6C920DE9288D85A0437F97CD0A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 c08d94e8a42401c38e577e12b886551c808baaaf4cfce235212248818c7b8353
MD5 5626e70d66b8e463a0d2b1507111f9ad
SHA1 6f9887cbbdf1dbd47d34a970b0638ece21fc18c6
SHA512 2e816789dd137f7e4fc7311eace1ee2123c51e20844fd2119ecc7076685e75b4ae76051e472dfe9f93bb6dbc58e2ffbd591cb2a351b55e371592dcd9ec879b0e
SSDEEP 6144:ccKUIgXsnK7utyfNKm7Rkm1tYpBeh2BAoM:/2gHutk9oBGcAoM
TLSH
T13C342277BE79AA7558E99B2DB6CA0F1E1CB0D1D3DE28CD0254E8740447FCACA4A09D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 740KB
SHA256 66c1642002bedb831f97a2bc366c8b8fabdb0241ed8e0e39bcfbaa73bee5663c
MD5 3fc603717c6853f5105ea24b3b33a0ce
SHA1 eed5685f2d0d3c238ad08267301a3ae85d94b75b
SHA512 2183d551b00319109a19230f84f3c1423ba9ddd66bbf3509d8bc6d9fe46a52414dced61613728730a7cfe99e51f8ec482eeb373c59e208ce41f21387d98148ed
SSDEEP 12288:GNGG3U3ITEmUbqLELFw/3ka49WURkjVT/YaFYzNLEqaxBc:wAIAmUbqopkRTxMqYzNLEqaxG
TLSH
T16EF4E114FBA414F9E2778178CD638906EB727C6A07A197CF139449962F33AD09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 753KB
SHA256 3d4f901e385af9ca786d1ddda4425293bc72c476ff56703c9de70a955b9ac955
MD5 3b6562d57ac6e7eb70610f33c66797ee
SHA1 09e614cc8f1a7ecefde6950aede5406122436f93
SHA512 9b30cd67e4104a544f908783b1ef482521f7d42a7ac11c591938f80c6a7d64c2f46f9575b76799a83a0387c4b0b7307944f2ea7883fb406fa4a2c8860036d09b
SSDEEP 12288:GNGG3U3ITEmUbqLELFw/3ka49WURkjVT/YaFYzNLEqaeGbUoBO:wAIAmUbqopkRTxMqYzNLEqae8UoBO
TLSH
T16CF4F154FBA414F9E177817CCD638906EB727C6A07A097CF13944A962F23AD09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240682375.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240682375.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240682703.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240682703.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240683062.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240683062.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240683265.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240683265.bat
Size 250B
SHA256 9e51434d7cc57d60a9aa6a2c4e762b0423efc3969c07db486984d9f16db21335
MD5 050ec7e7bd503ba8e987761302578abb
SHA1 1cf6dda9666aa6ccfc3f42384926082b0a332ab6
SHA512 bbebeea7d68d6b9ae652f02cbfd2c97c30b904df54a3b368bf5ec367e39ceb60466b960ff914e78bac55a5dc2036bb0c18c55804a1b0ed4a323d77d87b29061a
TLSH
T1C0D097C7824AC7F1040AA182416C480CC0E8EC0D1FA077A283A9DD29135600AF46A3C1
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 722KB
SHA256 b2f1ba701429990c7125912b93bf0eb8c378074540eec6869edee20fd6e30aac
MD5 7fe331f2eb534aae364c893cac4fc6ad
SHA1 c95c46257081b92825e80e47f4bd89deb9aa1132
SHA512 1ccf3fc9085e9445ae9aa1f7d3c414841b1637f07466bdc4cc39e53df7a0b1529b6b343d477cec511d983c083e23bbede3132647f952af541d156353916e8458
SSDEEP 12288:WNGG3U3ITEmUbqLELc0/3ka49WURkjVT/YaFYzNLEqaeE:AAIAmUbqogwRTxMqYzNLEqaeE
TLSH
T1B7F4E115FBA414F9E1778178CD638906EB727C5A07B097CF13A44A962F23AD09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download