196f3cb14f1e89fb80e0325174d820cc2719396786db35466220524040545761

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 660KB
Sample260809-cnpy1astet
SHA256 196f3cb14f1e89fb80e0325174d820cc2719396786db35466220524040545761
MD5 29e72c3e70fe64565c37b0e08a0d1ee6
SHA1 03307c32ac7f8a22ef9f67c6e44d247fae964cb5
SHA512 789b8605c3445879a8ab185a50274f4104b471615abb5cc8f02469431ce8351eb9605dbb932ef88ad7993ca497b208b8d9c8d5f2354de461bf269a2d19c7f67d
SSDEEP 12288:PNGG3U3ITEmUbqLELfq/2wE35Oq6j92VmT7yvl5IB0M/CqcWt:zAIAmUbqoLi2wXj9hT7m00M/CBWt
TLSH
T16FE4E115FBE814F9E273857CCE634602EA727C5A076097CB13948A961F37AD18E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2440	SecurityHealthSystray.exe
3512	DeviceSyncHost.exe
948	GoogleUpdateCore.exe
1640	SecurityHealthSystray.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
840	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1540	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
972	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307152564239796"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1540	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4496	schtasks.exe
2320	schtasks.exe
4304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
3988	chrome.exe
3988	chrome.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	SecurityHealthSystray.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3988	chrome.exe
2440	SecurityHealthSystray.exe
3988	chrome.exe
2440	SecurityHealthSystray.exe
2440	SecurityHealthSystray.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1564	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 4932 wrote to memory of 4496	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 4932 wrote to memory of 2884	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4932 wrote to memory of 2320	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 4932 wrote to memory of 220	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	102
PID 4932 wrote to memory of 4304	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 4932 wrote to memory of 2440	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 4932 wrote to memory of 840	4932	2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 840 wrote to memory of 1540	840	cmd.exe	112
PID 2440 wrote to memory of 3448	2440	SecurityHealthSystray.exe	117
PID 2440 wrote to memory of 864	2440	SecurityHealthSystray.exe	119
PID 2440 wrote to memory of 3024	2440	SecurityHealthSystray.exe	121
PID 2440 wrote to memory of 3988	2440	SecurityHealthSystray.exe	123
PID 3988 wrote to memory of 1056	3988	chrome.exe	124
PID 3988 wrote to memory of 972	3988	chrome.exe	125
PID 3988 wrote to memory of 4104	3988	chrome.exe	126
PID 3988 wrote to memory of 4104	3988	chrome.exe	126
PID 3988 wrote to memory of 1564	3988	chrome.exe	127
PID 3988 wrote to memory of 1564	3988	chrome.exe	127
PID 3988 wrote to memory of 4864	3988	chrome.exe	129
PID 3988 wrote to memory of 4864	3988	chrome.exe	129
PID 3988 wrote to memory of 1344	3988	chrome.exe	130
PID 3988 wrote to memory of 1344	3988	chrome.exe	130
PID 3988 wrote to memory of 4860	3988	chrome.exe	131
PID 3988 wrote to memory of 4860	3988	chrome.exe	131
PID 3988 wrote to memory of 4108	3988	chrome.exe	132
PID 3988 wrote to memory of 4108	3988	chrome.exe	132
PID 3988 wrote to memory of 3092	3988	chrome.exe	133
PID 3988 wrote to memory of 1992	3988	chrome.exe	135
PID 3988 wrote to memory of 4164	3988	chrome.exe	136
PID 3988 wrote to memory of 3332	3988	chrome.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_29e72c3e70fe64565c37b0e08a0d1ee6_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240680468.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4496
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:2884
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240680796.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2320
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:220
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240681125.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4304
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:3448
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:864
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:3024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff806c3c728,0x7ff806c3c734,0x7ff806c3c740
      4⤵
      PID:1056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,4340449407130324854,9118300771083562094,524288 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:3
      4⤵
      System Time Discovery
      PID:972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,8589410374383451331,9606783682490241373,262144 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
      4⤵
      PID:4104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,7476279065140925036,17027608671654660954,524288 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
      4⤵
      PID:1564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,528612086624785923,11164002067011637364,2097152 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,18225188152533830266,3278180658607197485,2097152 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:1344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4252,i,17686101387708495649,4100276507028475834,2097152 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4476,i,18096965678480594895,13989323064987959779,2097152 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:2
      4⤵
      PID:4108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,11514688044115809913,13813296488150732176,524288 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:3092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,12252583638656359476,9681997214402193364,524288 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:8
      4⤵
      PID:1992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,16159119885338384020,7857650741434526658,524288 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
      4⤵
      PID:4164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,633910170208802635,5783826109196509219,524288 --field-trial-handle=1992,i,5087160817327807438,11652850095686200458,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:8
      4⤵
      PID:3332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240681328.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1540

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:948

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 698KB
SHA256 32ac832db19dc8fdf72f99dfb0a6051b08787e8375bc394b1fd430ddfb170aaf
MD5 13a13ae206115a622918e707f757c995
SHA1 1e52de7191bf40e1ec583d3c514067958f3cb432
SHA512 d1fd2de989ca002a24de31cd9976351a87fa6ee5dabbf60bf7bbd00983276b601a2e1c057fc4f5042abe63363679e6f51c9a0c82e884157c83cdd8a936514557
SSDEEP 12288:mNGG3U3ITEmUbqLELWh/2wE35Oq6j92VmT7yvl5IB0M/CqcWq88f:QAIAmUbqoad2wXj9hT7m00M/CBWD8f
TLSH
T1C0E4E115EBA814F9E277D57CCD638602EA727C9A0760A7CB139449961F33AD0CE3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 730KB
SHA256 f8b9875a5ca737692fe82ccdfc0c1334fdd108c5c3baeed608a0716ced80bd11
MD5 a8a7bb8b5e28d2417d14b84e50c70469
SHA1 ec522ec6b44c9822d2025b2a698102486c34a5de
SHA512 32d9a3e3b5cc362c2b978a0d3b4d97a07c60b9ea2066b7de47b01c4ee5e2eff243964e1b5687cdc6389e34fddc3d58e4b05d45c78d5ceddb42fd80623dd6c023
SSDEEP 12288:XNGG3U3ITEmUbqLELlv/2wE35Oq6j92VmT7yvl5IB0M/CqcWjHlap:LAIAmUbqoxH2wXj9hT7m00M/CBWjFw
TLSH
T1CEF4E115EBA814F9E273857CCE634602EA727C5A076097CB13948AA61F33AD1DE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 15b4ae437defe8d26c01c8b499f30d7b95542e553a4a31364cba57b5eabf4585
MD5 2681b784f898289cc5b11abab5bfbe0b
SHA1 237050d51000d74533444f1246335bbba5c8948a
SHA512 22037815b99d7d9672205a075cd5e9429e8247971d2e24c3ad1dde1e8438a3a6c69a3b6fe657bc53a20f5ba9f557d23c1e6250bd374071c7f2b24413d72cbbe0
TLSH
T12EE0ABE9C920AC2B1CFD032824180707E34023672B40882B3A3C92098FB86370886C1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 7d46a582e82032d4f73db197d4d78d080275b1952ecd6f38bb2bb9b10f8ea681
MD5 326db9b4b67e58c922e5ae1ee0a34b64
SHA1 87fef1c426d845a9fff7b5eb658d070dad6761c9
SHA512 b4df5a8f4386816484d9636230b4deb9537641af7a595acae7e10142b12deff889695f49dc0a7ea2e79fe8eddc10fdd8e2608e59e1f0afe599340406825c3315
TLSH
T1CFD05E111A00071DC31B0BB174825C543F75614992305A620DDB0CB8397B8690AC5553
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 cbb0d711bffd9bc72aa369144481c56fb0634eb70217e3fe09fe578bf54e4581
MD5 7355a4b933cd5e72c3feb289d984d81e
SHA1 ffecf70b3fe9cdd9297d694bdcd432cdd8b029ae
SHA512 ab59262b1d3b58b658b7975c68a55ca2cac6467356061ae1d77689eeb417b1177ec2e830570d461e7c45d97038abbb86035086eb464f666bea2e97cb41ce66ea
SSDEEP 48:YALlhhvh8oh5hLYyhpaXYfo7EdKsNrsZgmzsdts6csy1qzsaBsrF4s4mFsd3a:DXvWoDnraIaEdP4C5G6QF4mKK
TLSH
T1CD81AEF7C3E8852D890196F49B15AF1FCE2A1A14432C3C67C9D4BE2B93E2972D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b475164720f6acdd9ba3aa2c2567d77d886ba15e1507d1e9a196fccb294d4590
MD5 a6758968fb77983e3e5f63d8c6401c3e
SHA1 2523dd5940c9c0bc3af90a6f00eb13309afd18e4
SHA512 8930a97ac7972043de2e44b1bdebafdf868bee9fc341112ac95cc24bed8258d0cd13169cc1887f08ff35496d25eacc7e3c784de3de0d82fe5dd9d9306b68af56
SSDEEP 192:wRYZ2rKDXaW4JFv72ympAPRp2MioZn95Hsb+WNnwaPPrJmvMkwETBasVyIsnAUg8:wR22rRQUXp7w5PdmEkTBaI8
TLSH
T17952C72FBA2025779CDEC21AF9127753E7F5103661942E44EAFC9A2C14E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e699b89916353c3a7fe32f808e4e3006869f101ba475c92348956f3b0e562c56
MD5 b760dc2d72ec11fecb16f2d8486fcc0b
SHA1 471a0c9a1722bc5a5cd47fdcc6ee810199833997
SHA512 ae1246025cc8eb2a947a1275848b0467ca251010965501dc527fe3559705ddab21a3fc109bf3221a4bbd7a53441e964c1077c97e1c72e103c9b01fe02f7c0d50
TLSH
T115B0124080019201C00307F411461489712CDF109A0F270243E069368C352508514061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a25.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591a25.TMP
Size 96B
SHA256 aa10feddc837c64d0d7047f5acc894a9002e00cdc76c8c21b27a4fdc01508281
MD5 6f6c36115d3557b3a9b3136f063c213d
SHA1 d5cb8f7e472d7cc54af7f7c6e0e0372207030512
SHA512 596b8bcf472b63411fec8ac21320dc635d9b5c9da27501c55c984caf6bb167025b1d46b27f5623673e8377a38a6b162921a0474d6402a56d60e02bb25305fcf1
TLSH
T125B02280C003A302C00303B028CA80C8B0A0CF20C30302028AE03E32CC3A3300020030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 cb26900aa92082c82ca881beebb8515ce4b8991cb040ee02cb5e8de93772437d
MD5 a2ed64ac865af56e3351abc16de551d2
SHA1 77d7a087598e34e9af85c60903db266fd0fac784
SHA512 f42c794180f40ee26083eedfd7506991a728fd68216f307fdb2bd53856fd6e63def6844802e44e8ab95dc3f42f00d6327fdb9eb9276329ca8fab1b404b94e493
TLSH
T17FA0021A87E10BA2F91153741495278877519C1005B5E61340D40499B8772446A01881
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 3e98184a7fac2496242c3d4348be6688bd0ed441fd9b61deb92a4275fe2fd3dc
MD5 2e45cda75611de6b5725f8ec2d7dd0a8
SHA1 cd1b5d005cc81ade41f54adfb27d53205f0a5dda
SHA512 4e08777d79a15ea484d0af8f3c003740dcb0cc22457196f1342f2624662a5a4b4847591cdf7411b1ad47b3cc1a1854fd105bc72ae64096d64c5f906383c79279
SSDEEP 3072:BcXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzI7qfd7NtZL8cHQRZEQ6SpsC:BHhxNPRW2PYddqmY7U52FkqZ/ZLW3ExC
TLSH
T198342332BFD61F354C8ADE6836432D2E6FF649D890F4A781EA396F4F2843C51645289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 dc28dd5a6de51e6ff4ad20466950f97d894e2d71ae1bf83cd2f97e5b4d676d19
MD5 cc05bd69d3eab0aad2d3d0d6a8f418a3
SHA1 eb49585e8a4b331094b928e3b9492d2363e081b4
SHA512 ff647f3c2dd10fa6ca473e256098b5f2fa8d9a721e6685bd8054defd4360a784afb6b6767eb36e2f20088e8b0966a4a477ccf9104da4cd28521972449081f6ca
SSDEEP 3072:2cXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzI7qfd7NtZL8cHQRZEQ6SpsC:2HhxNPRW2PYddqmY7U52FkqZ/ZLW3ExC
TLSH
T1AC342332BFD61F354C8ADE6836431D2E6FF649D8A0F4A781EA297F4F2843C51645289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 285KB
SHA256 f37545d4d767517e2b48a71be78a1250aeac7f32f1b7ec3d6cc0b8738f735ea6
MD5 5ec7ddda048b6cf983781263fddc1758
SHA1 6bb28d68fd37420153d9e5b060557a19d049a5ba
SHA512 e02de41a08518d074b71ed6638db5ab18f87d60ac5bf2ced513b6ff11212dd10ea576ea01a27ea9a434517b75d3c8038cffa57ab84de4dfaeb5c3185fdd5e025
SSDEEP 6144:jRbeInoZULVrhxNPRW2PYddqmY7U52FkqZ/ZLW3ExC:jJeIn6SXXPRW4Kq97UA+qZ/piQC
TLSH
T13B541232EBD71F344D46CD2836173C1EAFF68ED9E0F8AB85E95C6E5B1847811A84249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f14a6945cceabe61ceca47c7ce5c72299984e947787e4ea93f39330de13a2761
MD5 bb09c9c131c600f972d28ce9880d838e
SHA1 a8ab79e328b9beaa91beed6e3a755cf93d3cf312
SHA512 6a6e7769e4c679e78c0c86487bc805127267290f0a2d901205a695ed13e77bf7ef55ee839987e7d451fde4e3bfe5710708f6fa7e8896426749e6cff56c3c53ee
SSDEEP 1536:TqQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Tqfd7NtZL8cHQRZEQ6Spsk
TLSH
T100C30237DBC21F339D96CB60B9530FD6A7B644A99034D301AA6D77BF6C83891644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 683KB
SHA256 2ec8563c2a3c7d8615eae741e6f24feabaf9509954e79b7bb97dae580c18660e
MD5 4d9366bbbc4e4a774d94bf9840681868
SHA1 6d3411b14b4f08c07a3536be269b6b316bdb8037
SHA512 aaa02be815a0d663212fe53103d9eefa583df0889bbf2a3c2ee034729668e7171730463299f0fe1d1ba115f4660a0d49e6012acd6a70f86ca910025875d32809
SSDEEP 12288:mNGG3U3ITEmUbqLELZw/2wE35Oq6j92VmT7yvl5IB0M/CqcWz/:QAIAmUbqoNk2wXj9hT7m00M/CBWj
TLSH
T1B0E4E115EBA814F9E277C57CCD634602EA727C5A0760A7CF13948A961F33AD18E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 751KB
SHA256 0e7a988647568b6e6d657cdb9843738b4466f4770331ef8150c0ab48f6bed3b4
MD5 36c41e44e798bf4e53963a9a493f6c98
SHA1 7ae7240bae71eae2cb5baf703dc29e54aed55883
SHA512 e4a4db24e4b8ce0e2769256ba997a90a7fc5efa3a7bbf8d04034ee1bef39285365b38882ca57c05f7c82064ecf00c165cc1957d552c7b089e01d85dbcecccecf
SSDEEP 12288:MNGG3U3ITEmUbqLELak/2wE35Oq6j92VmT7yvl5IB0M/CqcWjHhk6l:aAIAmUbqoOg2wXj9hT7m00M/CBWjBkk
TLSH
T1E3F4E115EBE814F9E273857CCD634602EB727C5A0760A7CB13A44A962F33AD19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240680468.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240680468.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240680796.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240680796.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240681125.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240681125.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240681328.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240681328.bat
Size 250B
SHA256 b60286059d740bb0acedd5fca3fcbb792ccf6b069df080db3a72a166deca7161
MD5 456edc00d1d2a5dbe82916897611739e
SHA1 4d6f957289fdc0095c7e3f48ee8af0c9bdaedaa9
SHA512 fbc8b444876c34f9fff90a71a67e31e1c653cdf1cd903f547123d2aa74a79c8d9d15becdc4fa390f4e7a4770a51aaa3fec195488e20bc874d9a0a0132f37be06
TLSH
T100D09743C3CBCEE50506B99242DD590CC8A5F8880FC0738283EAEB4E235A018B09BF81
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 713KB
SHA256 cc432d307f7f9b5f2368602fd61fc3b22cf5d655eb70e88baa223ec17dd068a8
MD5 cea745d0347ac84288c8cf1bdc29cba9
SHA1 7dcf79add350bf53237c181726913f82fbb70cc2
SHA512 44c72da35766b24e3e472bb66c9110ad441f88f52595aa3a242b48b55573cacb0f26a0361ada8a30fcbc7b1a2745528c8002bdb5684a02c3819c59e2966bf32e
SSDEEP 12288:UNGG3U3ITEmUbqLELcE/2wE35Oq6j92VmT7yvl5IB0M/CqcWjHk:SAIAmUbqogA2wXj9hT7m00M/CBWjE
TLSH
T1AAF4E115EBE814F9E273857CCD634602EB727C5A0760A7CB13A44A961F37AD18E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download