skuld | a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skuld.exe
Size 15.3MB
Sample260806-c678asfd78
SHA256 a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260
MD5 b71e222e7daf72a0bcddc27dcc9cb7f5
SHA1 b0fc85f0d14f02a15ec0d829bf23baea85ead7d4
SHA512 5f9b282b0e84e443ce90f2c1ff13224a4b9a1e60f100d60e0c974a36851a99fd2950eaa381dec3ba92d51ab955d5d52109feaf290e2d62c72d1cd3011dc2a48e
SSDEEP 196608:15+4UVyZ6jSvZ5n9pTY3kUGERodlqd0mdmM5WIOC:1rUe59OGGodlVlMcIO
TLSH
T174F68D43ECB556E9C099917AC6668612BB753C884B3163D36B60FB346F33BD0AE78740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery skuld persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detects SkuldStealer 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5fa-4.dat	family_skuld

Executes dropped EXE 4 IoCs

pid	Process
3656	SecurityHealthSystray.exe
3248	SecurityHealthSystray.exe
4560	SecurityHealthWatcher.exe
5608	SecurityHealthWatcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	skuld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Watcher Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthWatcher.exe"	skuld.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
15	discord.com

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
6	api.ipify.org
9	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2420	netsh.exe
3740	netsh.exe
5176	netsh.exe
3776	netsh.exe
4284	netsh.exe
4948	netsh.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6040	wmic.exe
2860	wmic.exe
2600	wmic.exe
2200	wmic.exe
5300	wmic.exe
4132	wmic.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	11	Go-http-client/1.1
HTTP User-Agent header	14	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2232	wmic.exe
2232	wmic.exe
2232	wmic.exe
2232	wmic.exe
4648	wmic.exe
4648	wmic.exe
4648	wmic.exe
4648	wmic.exe
2620	wmic.exe
2620	wmic.exe
2620	wmic.exe
2620	wmic.exe
2860	wmic.exe
2860	wmic.exe
2860	wmic.exe
2860	wmic.exe
2164	wmic.exe
2164	wmic.exe
2164	wmic.exe
2164	wmic.exe
4692	wmic.exe
4692	wmic.exe
4692	wmic.exe
4692	wmic.exe
3164	wmic.exe
3164	wmic.exe
3164	wmic.exe
3164	wmic.exe
2600	wmic.exe
2600	wmic.exe
2600	wmic.exe
2600	wmic.exe
4248	wmic.exe
4248	wmic.exe
4248	wmic.exe
4248	wmic.exe
2552	wmic.exe
2552	wmic.exe
2552	wmic.exe
2552	wmic.exe
5440	wmic.exe
5440	wmic.exe
5440	wmic.exe
5440	wmic.exe
4224	wmic.exe
4224	wmic.exe
4224	wmic.exe
4224	wmic.exe
2200	wmic.exe
2200	wmic.exe
2200	wmic.exe
2200	wmic.exe
5088	wmic.exe
5088	wmic.exe
5088	wmic.exe
5088	wmic.exe
1996	wmic.exe
1996	wmic.exe
1996	wmic.exe
1996	wmic.exe
5672	wmic.exe
5672	wmic.exe
5672	wmic.exe
5672	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	skuld.exe
Token: SeIncreaseQuotaPrivilege	2232	wmic.exe
Token: SeSecurityPrivilege	2232	wmic.exe
Token: SeTakeOwnershipPrivilege	2232	wmic.exe
Token: SeLoadDriverPrivilege	2232	wmic.exe
Token: SeSystemProfilePrivilege	2232	wmic.exe
Token: SeSystemtimePrivilege	2232	wmic.exe
Token: SeProfSingleProcessPrivilege	2232	wmic.exe
Token: SeIncBasePriorityPrivilege	2232	wmic.exe
Token: SeCreatePagefilePrivilege	2232	wmic.exe
Token: SeBackupPrivilege	2232	wmic.exe
Token: SeRestorePrivilege	2232	wmic.exe
Token: SeShutdownPrivilege	2232	wmic.exe
Token: SeDebugPrivilege	2232	wmic.exe
Token: SeSystemEnvironmentPrivilege	2232	wmic.exe
Token: SeRemoteShutdownPrivilege	2232	wmic.exe
Token: SeUndockPrivilege	2232	wmic.exe
Token: SeManageVolumePrivilege	2232	wmic.exe
Token: 33	2232	wmic.exe
Token: 34	2232	wmic.exe
Token: 35	2232	wmic.exe
Token: 36	2232	wmic.exe
Token: SeIncreaseQuotaPrivilege	2232	wmic.exe
Token: SeSecurityPrivilege	2232	wmic.exe
Token: SeTakeOwnershipPrivilege	2232	wmic.exe
Token: SeLoadDriverPrivilege	2232	wmic.exe
Token: SeSystemProfilePrivilege	2232	wmic.exe
Token: SeSystemtimePrivilege	2232	wmic.exe
Token: SeProfSingleProcessPrivilege	2232	wmic.exe
Token: SeIncBasePriorityPrivilege	2232	wmic.exe
Token: SeCreatePagefilePrivilege	2232	wmic.exe
Token: SeBackupPrivilege	2232	wmic.exe
Token: SeRestorePrivilege	2232	wmic.exe
Token: SeShutdownPrivilege	2232	wmic.exe
Token: SeDebugPrivilege	2232	wmic.exe
Token: SeSystemEnvironmentPrivilege	2232	wmic.exe
Token: SeRemoteShutdownPrivilege	2232	wmic.exe
Token: SeUndockPrivilege	2232	wmic.exe
Token: SeManageVolumePrivilege	2232	wmic.exe
Token: 33	2232	wmic.exe
Token: 34	2232	wmic.exe
Token: 35	2232	wmic.exe
Token: 36	2232	wmic.exe
Token: SeIncreaseQuotaPrivilege	4648	wmic.exe
Token: SeSecurityPrivilege	4648	wmic.exe
Token: SeTakeOwnershipPrivilege	4648	wmic.exe
Token: SeLoadDriverPrivilege	4648	wmic.exe
Token: SeSystemProfilePrivilege	4648	wmic.exe
Token: SeSystemtimePrivilege	4648	wmic.exe
Token: SeProfSingleProcessPrivilege	4648	wmic.exe
Token: SeIncBasePriorityPrivilege	4648	wmic.exe
Token: SeCreatePagefilePrivilege	4648	wmic.exe
Token: SeBackupPrivilege	4648	wmic.exe
Token: SeRestorePrivilege	4648	wmic.exe
Token: SeShutdownPrivilege	4648	wmic.exe
Token: SeDebugPrivilege	4648	wmic.exe
Token: SeSystemEnvironmentPrivilege	4648	wmic.exe
Token: SeRemoteShutdownPrivilege	4648	wmic.exe
Token: SeUndockPrivilege	4648	wmic.exe
Token: SeManageVolumePrivilege	4648	wmic.exe
Token: 33	4648	wmic.exe
Token: 34	4648	wmic.exe
Token: 35	4648	wmic.exe
Token: 36	4648	wmic.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1740	4844	skuld.exe	91
PID 4844 wrote to memory of 2232	4844	skuld.exe	92
PID 4844 wrote to memory of 4648	4844	skuld.exe	93
PID 4844 wrote to memory of 2620	4844	skuld.exe	94
PID 4844 wrote to memory of 2860	4844	skuld.exe	95
PID 4844 wrote to memory of 3776	4844	skuld.exe	96
PID 4844 wrote to memory of 704	4844	skuld.exe	97
PID 4844 wrote to memory of 5004	4844	skuld.exe	98
PID 4844 wrote to memory of 3248	4844	skuld.exe	102
PID 3656 wrote to memory of 5548	3656	SecurityHealthSystray.exe	103
PID 3656 wrote to memory of 2164	3656	SecurityHealthSystray.exe	104
PID 3656 wrote to memory of 4692	3656	SecurityHealthSystray.exe	105
PID 3656 wrote to memory of 3164	3656	SecurityHealthSystray.exe	106
PID 3656 wrote to memory of 2600	3656	SecurityHealthSystray.exe	107
PID 3656 wrote to memory of 4284	3656	SecurityHealthSystray.exe	108
PID 4844 wrote to memory of 5608	4844	skuld.exe	110
PID 5608 wrote to memory of 2004	5608	SecurityHealthWatcher.exe	111
PID 4844 wrote to memory of 4248	4844	skuld.exe	112
PID 3656 wrote to memory of 2552	3656	SecurityHealthSystray.exe	114
PID 3656 wrote to memory of 5440	3656	SecurityHealthSystray.exe	115
PID 3656 wrote to memory of 4224	3656	SecurityHealthSystray.exe	116
PID 3656 wrote to memory of 2200	3656	SecurityHealthSystray.exe	117
PID 3656 wrote to memory of 4948	3656	SecurityHealthSystray.exe	118
PID 3656 wrote to memory of 5088	3656	SecurityHealthSystray.exe	119
PID 3656 wrote to memory of 1996	3656	SecurityHealthSystray.exe	120
PID 3656 wrote to memory of 5672	3656	SecurityHealthSystray.exe	121
PID 3656 wrote to memory of 5300	3656	SecurityHealthSystray.exe	122
PID 3656 wrote to memory of 2420	3656	SecurityHealthSystray.exe	123
PID 3656 wrote to memory of 4344	3656	SecurityHealthSystray.exe	124
PID 3656 wrote to memory of 2916	3656	SecurityHealthSystray.exe	125
PID 3656 wrote to memory of 4116	3656	SecurityHealthSystray.exe	126
PID 3656 wrote to memory of 4132	3656	SecurityHealthSystray.exe	127
PID 3656 wrote to memory of 3740	3656	SecurityHealthSystray.exe	128
PID 3656 wrote to memory of 6032	3656	SecurityHealthSystray.exe	129
PID 3656 wrote to memory of 828	3656	SecurityHealthSystray.exe	130
PID 3656 wrote to memory of 5960	3656	SecurityHealthSystray.exe	131
PID 3656 wrote to memory of 6040	3656	SecurityHealthSystray.exe	132
PID 3656 wrote to memory of 5176	3656	SecurityHealthSystray.exe	133

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1740	attrib.exe
704	attrib.exe
5004	attrib.exe
5548	attrib.exe
2004	attrib.exe

C:\Users\Admin\AppData\Local\Temp\skuld.exe
"C:\Users\Admin\AppData\Local\Temp\skuld.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe
  2⤵
  - Views/modifies file attributes
  PID:1740
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3776
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:704
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:5004
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:2004
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:5548
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4284
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5440
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4948
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5300
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2420
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:4344
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:2916
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:4116
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4132
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3740
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:6032
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:828
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:5960
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:6040
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5176

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
1⤵
- Executes dropped EXE
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 15.3MB
SHA256 a48d13c8760ba533fef095ce3c303b81662f684809138fbaa4310edea6d4c260
MD5 b71e222e7daf72a0bcddc27dcc9cb7f5
SHA1 b0fc85f0d14f02a15ec0d829bf23baea85ead7d4
SHA512 5f9b282b0e84e443ce90f2c1ff13224a4b9a1e60f100d60e0c974a36851a99fd2950eaa381dec3ba92d51ab955d5d52109feaf290e2d62c72d1cd3011dc2a48e
SSDEEP 196608:15+4UVyZ6jSvZ5n9pTY3kUGERodlqd0mdmM5WIOC:1rUe59OGGodlVlMcIO
TLSH
T174F68D43ECB556E9C099917AC6668612BB753C884B3163D36B60FB346F33BD0AE78740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download