1336fa3e126c13bd5e5659945f11db88e2980d0e58f4471f059be69563502720

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 830KB
Sample260809-eqrlqahk21
SHA256 1336fa3e126c13bd5e5659945f11db88e2980d0e58f4471f059be69563502720
MD5 619e54a1cb9ed8813fd4375a86f17ece
SHA1 084e4a3274e51e61078e6e68d06fed25cea36781
SHA512 31e46c27760d440ca2ec50853bbc33f9900f82107507e76ff3e584fc4f93d41d6304fa27bae26782c87c28ea27e345d936591dad669036ba893b85bc38f1ebd1
SSDEEP 12288:LNGG3U3ITEmUbqLEL0PI8oFr6kH/kQaztw6IS8vLwgmeBLmQSTe+ECk:vAIAmUbqooPI8ojH8Lz58TwgmKL1hRp
TLSH
T16A05F115EAA804F9E173C17CCD634606DA72BC9A0760D7CF23A44A962F33AD59E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
312	SecurityHealthSystray.exe
4448	GoogleUpdateCore.exe
1460	SecurityHealthSystray.exe
2504	DeviceSyncHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1540	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5004	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2112	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307221848243303"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5004	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5080	schtasks.exe
2068	schtasks.exe
4900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
608	chrome.exe
608	chrome.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1460	SecurityHealthSystray.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe
Token: SeShutdownPrivilege	608	chrome.exe
Token: SeCreatePagefilePrivilege	608	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
608	chrome.exe
1460	SecurityHealthSystray.exe
608	chrome.exe
1460	SecurityHealthSystray.exe
1460	SecurityHealthSystray.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2796	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 3672 wrote to memory of 5080	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 3672 wrote to memory of 640	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 3672 wrote to memory of 2068	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 3672 wrote to memory of 3496	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 3672 wrote to memory of 4900	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 3672 wrote to memory of 312	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	109
PID 3672 wrote to memory of 1540	3672	2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe	110
PID 1540 wrote to memory of 5004	1540	cmd.exe	114
PID 1460 wrote to memory of 2636	1460	SecurityHealthSystray.exe	121
PID 1460 wrote to memory of 4152	1460	SecurityHealthSystray.exe	123
PID 1460 wrote to memory of 1856	1460	SecurityHealthSystray.exe	125
PID 1460 wrote to memory of 608	1460	SecurityHealthSystray.exe	127
PID 608 wrote to memory of 2164	608	chrome.exe	128
PID 608 wrote to memory of 2112	608	chrome.exe	129
PID 608 wrote to memory of 1808	608	chrome.exe	130
PID 608 wrote to memory of 1808	608	chrome.exe	130
PID 608 wrote to memory of 2544	608	chrome.exe	132
PID 608 wrote to memory of 2544	608	chrome.exe	132
PID 608 wrote to memory of 4328	608	chrome.exe	131
PID 608 wrote to memory of 4328	608	chrome.exe	131
PID 608 wrote to memory of 4184	608	chrome.exe	133
PID 608 wrote to memory of 4184	608	chrome.exe	133
PID 608 wrote to memory of 3820	608	chrome.exe	135
PID 608 wrote to memory of 3820	608	chrome.exe	135
PID 608 wrote to memory of 3504	608	chrome.exe	136
PID 608 wrote to memory of 3504	608	chrome.exe	136
PID 608 wrote to memory of 4740	608	chrome.exe	138
PID 608 wrote to memory of 1856	608	chrome.exe	140
PID 608 wrote to memory of 3996	608	chrome.exe	141
PID 608 wrote to memory of 3808	608	chrome.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_619e54a1cb9ed8813fd4375a86f17ece_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:2796
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240683750.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5080
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:640
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240684093.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2068
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240684468.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4900
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240684750.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5004

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:2636
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:4152
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9bed3c728,0x7ff9bed3c734,0x7ff9bed3c740
    3⤵
    PID:2164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,9732715893928192756,14066918413211413323,524288 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,16875385874854004808,16547615962045212521,262144 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:1808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,16668395397023499105,6752883646665791712,524288 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2492 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,5656787675762733024,9894990641162052347,2097152 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3064,i,11390561688639491503,10152104669542525577,2097152 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,12824623909508642215,7289767891391891487,2097152 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4516,i,16238740237406522149,577848750714363488,2097152 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:2
    3⤵
    PID:3504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,13464793281603631528,5091781846528871193,524288 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,650040559987722454,5831290731767443279,524288 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:1856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,408361824216531355,6425659428383493723,524288 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,6375011608719584679,11969591713166649370,524288 --field-trial-handle=2068,i,17310403555851657501,15295993629960210244,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:3808

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 859KB
SHA256 e105e6c1d21eed503738b4e327fec57251cf5abdb8aaa2837591fcb677cf0914
MD5 54731b282252dbc11252674f3e50e6f3
SHA1 ee9a3635b2390ae516a14721097ce065634be20d
SHA512 a1ab1d17e7ed9ed7c9307884d20f29dd82cae77aa6e8a986b6f59c50e826398005ddd49f91072e256f2c628ec4a357a158b6cb731550a29b6d00de7845b462ea
SSDEEP 12288:bNGG3U3ITEmUbqLELfaI8oFr6kH/kQaztw6IS8vLwgmeBLmQSTe+ECjwoo:/AIAmUbqoDaI8ojH8Lz58TwgmKL1hR2E
TLSH
T1B015F155EAA804F9E173817CCD634605DA72BC9A0760D7CF23A44A962F33AE1DE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 909KB
SHA256 b94fd83eeef756dcb304a58eff0c8d980f4146601d9bd4f5cc5881ae7d49bf0b
MD5 578d63b51e6de0695c1720143a0d37c6
SHA1 2920430f99255592425c04b29d676a1a1e5ca903
SHA512 e97ae19ec9de41c0b85cc55679c34c5e04d0407e28c1ed820b3627f5df741e5660991343d1106dbded3c22115a8acfece797029cc67615ebf4628edc7533b59c
SSDEEP 24576:JAIAmUbqorXI8ojH8Lz58TwgmKL1hRUtD3j66:J5A5uo7I3rug5ZLTRQTj66
TLSH
T1C315F115EBA804FAE173C17CCD674605DA72BC990760D6CF23A44A962F23AD4DE3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 453b717c27b30af1ff5895f740b71513314a840d3dfc4b979a1d5b22d0b9b317
MD5 c72d28472997cd134de17f0e93ccd439
SHA1 ee681cf98ac1bbb87624115fff7be7c8fca129cd
SHA512 499ca7efde8e15e37634d1177e480b3c4f67ef722e66af9d212e411dd0bd96a5355a6cb015104da0c4ae2ea229ec8dbe44bb0624fe1692f187001d15f0574714
TLSH
T1A1E02B99DC21FC371DFD572D50944B46EB6063971FA0895B3B3C82188FB56A702C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 bfe7b3da514e03aa710e0a2a0c12112612f1eb50bd192065e348516d19413836
MD5 78cd82c94868548a1cd69e0952340a4b
SHA1 a5d710f52208d09b97c8339f1aeef5548f8f4736
SHA512 332b1ae895acddba7248aea1cf07385849b360a1eddf688560362d44ba608227e64fd2eb2ada1210d6e78a2f550bf495d4951413497ca3e4c1d9e2af4b03a242
TLSH
T1BDD0A71130701041CBB00B71DF17BD003B2A3F148215A31F48C17C4498EB55A42D8CD2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0345f249ff5d454e8cc2d20b801c6691fbc11a3e65c7884dbb423bbd009963df
MD5 2b96774c4704ed867f5f900a186aa2e3
SHA1 07e94cc9b31dd7c268ef5dc8be949477e054df1d
SHA512 46fbefde7cc910b1a689c76a5d75b2346e1f2a2ca4be429e326fc801ad9fbaa11bfc1f2ee169110cc0c084358300738354eae1f2444d242ed0f8799f7dfa2774
SSDEEP 48:YALlhuhBh1hehYaXYfo7EdKs1rsggmzsHtsFcszqzsYfBs54stFsdZ3a:D4/LQ6aIaEd/hUmHEetkK
TLSH
T14E819EF7C3E8C62D890156F49B156F2FCE291628432C3C67C8D4AE6BA3E2872D11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91005a8beff997c19075887d0b47b9f9308e21d03ae0d89100f3db6bff287e8a
MD5 d9e2e7447eae5dd6ba9e865e2348f742
SHA1 79b1b159fc6dbd919aa60966f5f2b3a4da518db1
SHA512 a56a26377959d408e0e746827af63d0d4812090ac2d8e663d42204bdfb9431ef73cab55baf580c7545eaaed8c28d8eb43e1ca9b76e7db1555edec0678367305b
SSDEEP 192:IRO+rQvq8MW7v7ApAPRp2GST+9qHsb+WNnJoPkqRZEQkw5VyIsnAUgtaJ:IRO++DkUX1kwWPDRZP/8
TLSH
T10452C62EFE106D3BADDAC225F9527763E7F5202621942ED4EAFC892C19D75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 10d6df867039e53ce9db2bfe08f3e639397e2ee6f2e98d599f0d031af9cc704f
MD5 90c9eee021e4d6fdd6547b3bb28e3a5a
SHA1 fa5a46a4b4ba4275827a086ffff9d76a85e41975
SHA512 ff12704575e8a8dfd8b0ff7c65145aacce7d01a5152b7640518f92a5532a885fa9382b3fbd26971741fd7789cff06df954adce6268a4f297d89588b409fd0fe1
TLSH
T14DB0124184316101C10B06F431C36488B114DF149A0A170A43E06927A825161C0240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59285e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59285e.TMP
Size 96B
SHA256 f05ee99940c1705a958f8bf9e24b2a4332de84b4fe97db6ae5b35d5bacb1c4d0
MD5 e9c803e0036b2b59fa888467b9adfad3
SHA1 18415b6c095a70251031167d9a6ea9ec1c777d0e
SHA512 636f18ae8625e0577ef118699f6123c341541274b872ce03573c1f9adb8ad9d22480c4769d815e20e29216b93db29814fcf9b1fdc06891921ff9fcdfbd147ada
TLSH
T1E4B022C2C00A2202C00203B02AA0B0EC30A2CFA0C2030E0B82F20A22CC2A22000200F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ddabb8d67cf96525b7cfad9883013e3543f8abc1f82545223fdbc55d902b49e6
MD5 0cb019c1c44aae9df8cff8037e8cb539
SHA1 85cd2f169c2abbe4e73b16f14fe50d49568e994e
SHA512 f519a32d3e24bcd3c68e4a6eeb7b659675d5b3ee825be9e00d787a772aed0607d3cacf561f88d38d91b5279dd2469059692d784a45e65135e29883cae8e3a772
TLSH
T19BA0026003E04801FA841670A4D253C0732199101235A35F81F044558DB634089525C0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f3f93a3cd09cc8481e9131b6bde6d87abb6fa8ff7a3c5ae3f975c421cf2a4ad2
MD5 946e153e7c1515579e4faca8e4307178
SHA1 83e3ba85051a5b47e84862953956cfe74c2f6cfb
SHA512 fbd7364fdf4c306d551f7d4dd152ed09183bc2f0a0657aafbfc553dd946638c57d598e6606effd2dcbd03e8deb8605acb7b1c252c144cd16862960d44a68d4a3
SSDEEP 6144:nhxNPRW2PYddqmY7U52FZm7Rkm1tYpBeh2BAok:hXPRW4Kq97UAq9oBGcAok
TLSH
T1B83423126DB4AE394C59FE1D318F2D2F2EF28DE594A4BEC2C8D49F0827AED841551D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 283KB
SHA256 4bae547b75905a5d543000fa49d07e9e499816df413917fcf43f84c38b19396a
MD5 3bf9fbae5f79df8e8846d4b2fb43207f
SHA1 65383cafe010b798d8c025a1f34c586ac71cd1a4
SHA512 15a0139c3b656aa5d53fcc07c2c2654481ace343630cdae5b30986a42dc0958d8f2027486b481f45c0080c8b0104c0449cd1a2ad174472268b22e0c7aa913008
SSDEEP 6144:7ilyKdWUZJXzhxNPRW2PYddqmY7U52FZm7Rkm1tYpBeh2BAok:7DKdW01XPRW4Kq97UAq9oBGcAok
TLSH
T13F542332BCB0A9784C6DFA1D304E2D1E2EF58FD5D8A4EAC5DC886F0826AFE545452C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 95b16589403e76b0ebfbb01dc8c74d6ca91336cf7c258a6b408ed49b4cbf7d54
MD5 74c22e05d1effab5c2745d5a99fdc9da
SHA1 70aaac47998516ed915a079d0933b83fb017ed66
SHA512 89485bdb7e2e5e2887695604c08b5a52251a3a4dc0aee5a8996d11a85fe84293f9ff7a9dc8402a13fd6df39b86bbb8d3864ac722f0459cd98b64f249f89264c8
SSDEEP 3072:AIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Qm7Rkm1tYpBeh2BAog
TLSH
T150C3023B5D75EC3B5CB5A74EB08E0B1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 005a24101a7b7cf95d67ce3000a26bc44e691151be2d3ffe9e41a1c3e7ca87cb
MD5 19ddc9a11137dcf3e76b62e5a9b8d58b
SHA1 630434107633c4d5ac478c0a92d284f650853db0
SHA512 a6983805b660e146024e19699422b22998ad2ed5e3156251f5dc25e89e21f39a02cae1dcef3faefcf10d4e9299ed03f88b8d36838b1a5d5b628152f2adafb67b
SSDEEP 6144:4hxNPRW2PYddqmY7U52FZm7Rkm1tYpBeh2BAok:AXPRW4Kq97UAq9oBGcAok
TLSH
T1863423126DB4AD394C59FE1D318F2D2F2EF28DE594A4BEC2C8D49F0827AED841551D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 852KB
SHA256 571a2a0347b46534d95bb2327e83752f5a94041d785fbc847a07647865d044b4
MD5 4fbeff8554396acfa37b998987d9dabb
SHA1 e55464e174e1467c459f9c0a1fb38d5cc61a775f
SHA512 6deb630f34ac4f9a7baa707951d22d109e2ef20610a786dc394633561663ba96d8db65ea85981725133d73ff05cdf6f3a13d7511c25ca8effa3a7aea85ab5758
SSDEEP 24576:6AIAmUbqo/aI8ojH8Lz58TwgmKL1hRvk0:65A5uoSI3rug5ZLTRvk0
TLSH
T1FC05F155EBA804FAE173817CCD674601DA72BC990760D7CF23A44A962F33AD19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 877KB
SHA256 b75d55d00c3a9fe450db57281fa72bf6d1a6b230a227ee381871f0ad7a93a8a0
MD5 82866f37cdb1d5f509a7bb1125e304ed
SHA1 3c24853b8ea7f7dc628b017b9f7487a81635e0c1
SHA512 786640ce87c5d212225972799ad16cc04e37dd1eb4b6d7883df70fdfab030e345e387f3f93386940c141dc15304d231596e3ca95cf1237edfe9e3964987213b2
SSDEEP 24576:8AIAmUbqoWVI8ojH8Lz58TwgmKL1hRUtl:85A5uoGI3rug5ZLTRQl
TLSH
T10415F115EBA804FAE173C13CCD674605EA72BC990760D6CF23A44A962F236E5DE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240683750.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240683750.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240684093.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240684093.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240684468.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240684468.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240684750.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240684750.bat
Size 250B
SHA256 5db8083abc88fc4aaa639b592944c59ab67ca488479f02f3337630fda69e8134
MD5 8465ff4f42f5d9e148d27ca7ca1ae55c
SHA1 a651484a6615b47227b2b1f3558af1a46501ea3c
SHA512 2f3c328c9954a8d064948f3a84102489f7d9c68f11a2be1a500a6e5e11079c23a54f97e9b3cd21e85f43a5a82cd5df43f5cdc737530111e02d45c3e04cd12680
TLSH
T1DDD09723828AC3E4080AA482816D8A0CC0A4EC8C0F40379283E8D94C225B808B06F79A
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 852KB
SHA256 6b9888b4f16801489d0ea56dfe0e19863fd517aac8509033c34206905e67d806
MD5 0822d7a7668f22add2800ab9d875b8cf
SHA1 b38f2363508b01083a2c4ecbb7323fd98360608e
SHA512 88a46bd7f81457b20648e5aa5240848268c2ea16175a6d77bf723604212d60085c37a0cdde3cfcce9a5b76bf765d16b3d356c24ec2b6795eb7b665d348288f97
SSDEEP 24576:2AIAmUbqoQ6I8ojH8Lz58TwgmKL1hRUtz:25A5uonI3rug5ZLTRQz
TLSH
T12605F114EBA804F9E173C17CCD674605EA72BC990760DACF23A44A962F33AD59E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download