db51677e579c29e8d37e302101bcf9a2e91414bcd94d079afb75b0d6170bff22

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 521KB
Sample260720-zh2ryaev4p
SHA256 db51677e579c29e8d37e302101bcf9a2e91414bcd94d079afb75b0d6170bff22
MD5 13bc73d007799dc13d93cb03b5ed96dc
SHA1 b1d8132911fb734bb2cc4fb36f0b009fc43424b8
SHA512 2c730366279f680f0ffb925a4b16c32f582587209f9bb4ce4d26aef55317932db73c6d5668ac797dab2b15543e8ae2aa3ff4a4dce78d1847e4c82a0094d6b3ee
SSDEEP 12288:KNGG3U3ITEmUbqLEL0xghDi237Jp4RFAfhBq:UAIAmUbqooxr2Fp4RFYG
TLSH
T1ABB4C055FBA814F9E273813CCD634602EA727C9A0760E7DB13A489962F336D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2336	SecurityHealthSystray.exe
3928	GoogleUpdateCore.exe
552	SecurityHealthSystray.exe
4648	DeviceSyncHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3264	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4112	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290538776793354"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3264	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4668	schtasks.exe
3952	schtasks.exe
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
5060	chrome.exe
5060	chrome.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3928	GoogleUpdateCore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5060	chrome.exe
3928	GoogleUpdateCore.exe
5060	chrome.exe
3928	GoogleUpdateCore.exe
3928	GoogleUpdateCore.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3420	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 1764 wrote to memory of 4668	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 1764 wrote to memory of 1832	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 1764 wrote to memory of 3952	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 1764 wrote to memory of 4008	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 1764 wrote to memory of 1756	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 1764 wrote to memory of 2336	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 1764 wrote to memory of 4408	1764	2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 4408 wrote to memory of 3264	4408	cmd.exe	110
PID 3928 wrote to memory of 3936	3928	GoogleUpdateCore.exe	119
PID 3928 wrote to memory of 3136	3928	GoogleUpdateCore.exe	121
PID 3928 wrote to memory of 2960	3928	GoogleUpdateCore.exe	123
PID 3928 wrote to memory of 5060	3928	GoogleUpdateCore.exe	125
PID 5060 wrote to memory of 4868	5060	chrome.exe	126
PID 5060 wrote to memory of 824	5060	chrome.exe	127
PID 5060 wrote to memory of 824	5060	chrome.exe	127
PID 5060 wrote to memory of 4112	5060	chrome.exe	128
PID 5060 wrote to memory of 2400	5060	chrome.exe	129
PID 5060 wrote to memory of 2400	5060	chrome.exe	129
PID 5060 wrote to memory of 2312	5060	chrome.exe	131
PID 5060 wrote to memory of 1788	5060	chrome.exe	132
PID 5060 wrote to memory of 2312	5060	chrome.exe	131
PID 5060 wrote to memory of 1788	5060	chrome.exe	132
PID 5060 wrote to memory of 1652	5060	chrome.exe	133
PID 5060 wrote to memory of 1652	5060	chrome.exe	133
PID 5060 wrote to memory of 2316	5060	chrome.exe	134
PID 5060 wrote to memory of 2316	5060	chrome.exe	134
PID 5060 wrote to memory of 1904	5060	chrome.exe	136
PID 5060 wrote to memory of 4904	5060	chrome.exe	138
PID 5060 wrote to memory of 3540	5060	chrome.exe	139
PID 5060 wrote to memory of 4900	5060	chrome.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3420
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240680328.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4668
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:1832
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240680671.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3952
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4008
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240681031.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1756
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240681265.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3264

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3936
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:3136
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0f6dc728,0x7ffc0f6dc734,0x7ffc0f6dc740
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,5994240805579323837,14549302579599219715,262144 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,16430639579353145322,2724242592309818055,524288 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17087425315672787359,17164323048091316435,524288 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:2400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,3091392961127862819,8319085801084086192,2097152 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,9560839629811745385,5748578271686908800,2097152 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,9135353546462937888,1532413954405820578,2097152 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=296 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4456,i,3033253459781592070,17948564817877678233,2097152 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:2
    3⤵
    PID:2316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,16064209578664779541,17999900334618044527,524288 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,395973214597077781,8878485535425232619,524288 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,17105976805608925663,8265502997810914739,524288 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,2234604129260609169,7765533339331012551,524288 --field-trial-handle=1984,i,12866504598961703549,15543795843696979526,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:4900

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:552

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 540KB
SHA256 facbb66a8a89abd2aa6bcd69158f3fd3a20d5c92687f27e17ec1def269625187
MD5 58df96647cec27d854dd6a6eb366b4f9
SHA1 1cbbd39456f3affe258e9f0522ad05605dfb4f3d
SHA512 666ce21bd4706a8d5bccb6901e6d1359dde27595d40c988259a9818a99b78117fe48d980ecd7a0f5511f8221df66a03bb103999b39f4343492a715b123fe0a40
SSDEEP 12288:ZNGG3U3ITEmUbqLELZighDi237Jp4RFAfhB+AgY5:JAIAmUbqodir2Fp4RFYCAr5
TLSH
T128C4C015FBA814F9E277853CCD634602EA727C9A0760E7CF13A489962F236D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8b709a03b180e4117cc02c1499efe1ecd148568d5a63bc6f7d7dae44ea0aacc6
MD5 0e2ffd0934f9c054c7c03d239332b705
SHA1 f836acdb6d88a9bc8e84cab05a1f162d228d795b
SHA512 799fae2f65254d19440770cc2317217a794a68bc8777578e63a25e1eb8bcd68a3728877dc2d0ac746aa95c8c12ffa12fc29ef587d133138bdde66129eb8864c1
TLSH
T13AE02BAAD921EC771DFD472D50500746DA21136B5761845B3B3C850CCFB1677068985C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 0c64d34ee2f5749f629f3d5f86fa680eb5ee3f170f8847950819e27eded0caeb
MD5 9de41cd1bbca1e692c03b68f23d483e7
SHA1 67ae67448df99b843d1573d155bcd92af9ff0479
SHA512 e6a8a186b9622cb5efda2d350af16dff82b59b91bc1be1e30bc5e85aa350f37df07a4301fb2729a52a38d09f6c64c8ef5f79292f36425ca47aa18cd77a9d8ad4
TLSH
T17AD0A71001514107DF64337E4D91DC59F618ED25000C17F3D19C73A50DE7EDD602854D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d9e249aec38b65f3b725d45cd1053a43773ae3f80fd8857ea9c451b8f4f7fac8
MD5 10fd36a296547a73703bf0cefb2bde9e
SHA1 4b26edb4002f7d5753e403ae7b676b3d450d9020
SHA512 66370ddc85d1605149caaa8feb562fbf37d0642b8f4e149c56b82a6acd38278ef18117ee67325f3a127fd1a5516090a4476b061edc20af43fb8881a079926867
SSDEEP 48:YALlhVhahYhgyhEaXYfo7EdKsLgmzs4rsLtsjcsxqzs6BsC4sWFs33a:DDkCrKaIaEdRjiUFaRWYK
TLSH
T1D881BDF7C3E8852E8A4166F49B217F1FCE2E0624031D3C66C8D4AE1BA3E6871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 86ba838f575de322cd41c2bef9db9cbc6ebba17983b6ff3c2fa1552eca73a5de
MD5 d72b6d2768048e9f6616abd4784714a3
SHA1 248d37cd7f455070c1e28a50b5a09089ab94ad01
SHA512 163f3049e1cc8483aa3ec11566d0c5823c786549c8dfde93cc565925f6f7d0d02fe7b2eda7f749707411be42df66006b4ed129f3452a766a9214601f163f2009
SSDEEP 192:IR92AyE8ahUAv7ApAPRp2GnoZY9qHsb+WNn7BPqleQqs8+VyIsnAUgtaJ:IR92XoTkUXkYkwVPUqs828
TLSH
T12452E72FFA11697BACDBC225F9217B53E7F6103561952E80EAFC8A1C14E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 15521934929086ff6d9894a7a6e13c7c2909c07582e47919393758c56d5300e5
MD5 b449d7c13fc5678cc1c559afe50fb975
SHA1 50d4d92ad116d10fe0ba6d098f8a1e6145b63d2f
SHA512 ad20f9da7fba38dbebad78f0889491018897a1e7b10d49ac2d04cc330990cfcb2936b8d48a9e46a4964ecce70b94daf84e116cca278e4e9336ac663a2da836ea
TLSH
T130B0124180035101D00202F4198718887124DF10D60A2701D3F46923C825690D024150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b3f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591b3f.TMP
Size 96B
SHA256 5ab052bbf5ce013ee7c47c3ea55935b1a82ae12d56937538fb54ec2a8de43958
MD5 f155c08147dc457aeae7b2bf366055d3
SHA1 f196331c041d6b4dd03bfcd664a1f1bfe6e94a14
SHA512 c434b38cb6cfeaaea8034cc6c56f79890df2030928c83e29312d949e42df9328b02622a918d522396bf77d67bf81d49e5bdf5a9a79d67d57fbbc5323c9d791f0
TLSH
T1E0B02283C0022202C00203F02C8080C830E0EF20CA030A02E2F02A3BCC30220083A82A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b967ed3e380c2cc2871fd2659401b4f0a7cd6644e1208848fda768acf412a071
MD5 c0a7e609ba28d567b4a51aaac2924604
SHA1 0e985243beffc4c733fb54f94b948aa583ae7a1a
SHA512 f5dc8408b3ad81e4fdd05939a598a02a935a322acfa1cb79522e122906697f88c80cfc9bc2458ccc6d49a86cb56a25f6883fa0aad6b3a2afcaf6feecf655a7ac
TLSH
T174A0021052C95C2ED80413B316AA81403A90EC502609CB17B5DA0168CC9675DE54D06B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 060d67a1bad4fe96d248877bbaa3a542d0fc4d783d0cc94bbac2e03aec3cfa57
MD5 b372a8e2215d764930851514836e72b7
SHA1 ea3b059c43f1b80a7d8c6dbaa871c605e9d51053
SHA512 9b808bcde8f566c5b7720fdbe14d692b12ff613d9bdf9c735b0198d5a7f9152a9213e6236d85bcda210ea9505c5d24a7cd59add63f817e0773a4cd9afed9b36e
SSDEEP 6144:YGztnCgW0B3EkWUCD4uJyGm7Rkm1tYpBeh2BAo6:5tnn3EkC0uJyx9oBGcAo6
TLSH
T11C341236CD0D9D7A3C38F61FB4CE171F26B25D778A64EAC2C89C5E0953E8E89124946C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9d800a1c5248a2f61c0e10d339873101b671956a043711d5c45179f60fd6d401
MD5 96f67aedcf05e46518f1a5c4a35810f3
SHA1 ebda954fee25c882301443652a6003869e1f4b57
SHA512 03dccf72dce8f54ad643b0c5dae71f4329d1cf00439b7d180c657c04f1e097e780415ae58df31dc99a68e1c80bd88f244f3b5f954716e1f42f02b6fa685fa11e
SSDEEP 6144:rrGztnCgW0B3EkWUCD4uJyGm7Rkm1tYpBeh2BAo6:Atnn3EkC0uJyx9oBGcAo6
TLSH
T13E342236CD099C7A6C38F61FB4CE261F1EF16E37CA24E9C5D88C6E0553EDA48154645C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6db7f6c490d2d1b696faf110cfbeb2fa20af58bdfff5ff9fffef19865df72fa1
MD5 243279fb57d88752bb089ed6b2dd411e
SHA1 8e9174db0fad9d729b997ba0df74fb9ce61b1037
SHA512 4de201482db537e691ac504caa67d9c6896edd473e56a2be476eed417ea67116315933ede37bc832a37ec2c169ba1b3b59ec992d1ead8d2e24b47711e65183eb
SSDEEP 3072:ytGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:Rm7Rkm1tYpBeh2BAoB
TLSH
T15FC3123B5D64AC3759B5A75EB08E0B1F1EF249B7C920DE92C8D45B0423F9BCD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 803c84580ea8140bde4b81e60bd33e03e9e4ffab8d7d926e2ed9817241d33493
MD5 85676e454a5d3e352614c71b1349b0b7
SHA1 6c226d54910f6da9f818d7d61b5d93cf3a225c31
SHA512 0e748f9c46d45954c59958c602d39365c4a4433afab0b86b8c540f0c55473caf7beffb074042fc541449c2522577ff4b160791ef15eec21c7abfaadcadfd6604
SSDEEP 3072:AQGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:cm7Rkm1tYpBeh2BAog
TLSH
T168C3123B5D75EC3B5CB5A74EB08E0B1E2EF249A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e304fc8738e561bf7ee0a8c9cb25c4bfe65af8470291e45b7bf72e3cda168b13
MD5 5e374ca0df5ab1693f4046a92df01ab9
SHA1 867eb05ddef173c179797db27be6dc15f9be56bd
SHA512 ec70513990e907ea60f0752c9698016047063f4755d3d4eac13fccb7e1b58cd53d861742a2191c34b28e287054619c35ee1b3f9cfd3d212972ccf8ad5784dc3c
SSDEEP 6144:PGztnCgW0B3EkWUCD4uJyGm7Rkm1tYpBeh2BAo6:Itnn3EkC0uJyx9oBGcAo6
TLSH
T119341236CD0D9D7A3C38F61FB4CE171F26B25D778A24EAC2C89C6E0553E8E89124946C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 531KB
SHA256 483428776514ba73a92653907480c53375d63460862ad26be679023c98248c6d
MD5 b650b0af0b4a271fb43c9b0ca39931b5
SHA1 40918877455db3d91202251e6aae943f29cb02f9
SHA512 87e5c5363cf6e31c33aac6e3114f36951d39597d48c2fba43cebaa3cdc1d63506b6b0d35dfba06b5f924ab15dc0208c9da96d45b806dfcd4ea7650a7c19310da
SSDEEP 12288:zNGG3U3ITEmUbqLELMAghDi237Jp4RFAfhB5tK:HAIAmUbqo4Ar2Fp4RFY9k
TLSH
T11CC4C015FBA814F9E273853CCD634602EA727C9A0760E7DF13A489962F236D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240680328.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240680328.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240680671.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240680671.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240681031.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240681031.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240681265.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240681265.bat
Size 250B
SHA256 71f51b3f8edc1cfcb7e790674cb9b041f183901eb6e5b92997efe7716f211a26
MD5 82659b6de5468d58132ddce6ee6e9989
SHA1 fce570b6f7bc878c6a2fad98a790f051fa0a4a2c
SHA512 df3491c12ecb6c36b388778cdbfbe1bca388210d7ed330e327b6855e77af3208f21343cb8b5607e544d6494cdf390e9092abd31e08d85fc82987576a783e798e
TLSH
T11CD09793829BCBE40902A04345ED580C80E6EC4C5FC473A2C3A8D948164402BF8AAB83
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 577KB
SHA256 8f7097ce41097d9247643fd87abf6eb42d2c89cd65a07055c8fba5ff4a5b27f7
MD5 b48ae0a30d1ec12913a76de4f5d40ecf
SHA1 97bdf68546b9ad244d8f11e61ec20c2a2bce01f0
SHA512 0dc3ce3506241acc0fb31dfde39765d9176c5f257a5e710a99e987490d7b92aad7c6aa37ecee1121117ef81632f5f765f73c8ff1b6ff1acf98bbc9c5f26bb240
SSDEEP 12288:pNGG3U3ITEmUbqLEL3SghDi237Jp4RFAfhB9Zx0VL:ZAIAmUbqojSr2Fp4RFYxZx05
TLSH
T190C4C015FBA814F9E273853CCD634602EA727C9A0760A7DF13A489962F236D19F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 577KB
SHA256 89f8d1297ed0d1546f60611660cf5c7e78359f4600bd1b258aa1d2058cb0c80a
MD5 65f6454fc3e2fdc80670a6ba7316b41b
SHA1 4075149ab3a3d4dc5850619dba4363fd65f82aa4
SHA512 0e1a2008153a79ae882c4139e1720bd6ee9a7770ab564e8381f8dc40fb4a411c9f16aac43f012fb1ab2ff46f15baf74e8de150bce61d97b6b050e711ac5823ad
SSDEEP 12288:fNGG3U3ITEmUbqLEL/dghDi237Jp4RFAfhB5tmcleAo:DAIAmUbqobdr2Fp4RFY9+
TLSH
T1D0C4D015EBE814F9E273853CCD634602EA727C5A0760E7DB13A489A62F237D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download