0a7c4ce964106bcbef8b7d5ac78216f9f4d943d803dde7d05464c3819abd4388

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 648KB
Sample260809-kzk37athrb
SHA256 0a7c4ce964106bcbef8b7d5ac78216f9f4d943d803dde7d05464c3819abd4388
MD5 d448491be7f697882a52586d12ae6c6d
SHA1 a5038f1f1923b433be21ce3391cb31d1db2edb74
SHA512 c268d1eb09261c06a4d33c1177bec7f01f39e56cfc37ed24eebd97b8d5f135df3642dd3056a0d37b68758a7554fff55ce728f953712946812551c1083181d687
SSDEEP 12288:1NGG3U3ITEmUbqLELqMQrBhYIwCtCYu1y+nU5zX4+/0zIAiAQ1fZk:lAIAmUbqomhhrwCABdU5czIIQhZk
TLSH
T1F5E4D055FBA814F9E2B3C178CD634605EA727C9A0770A7CF239449962F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4132	SecurityHealthSystray.exe
4152	SecurityHealthSystray.exe
400	GoogleUpdateCore.exe
364	DeviceSyncHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4768	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2668	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4604	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307398013290583"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2668	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1656	schtasks.exe
4756	schtasks.exe
1124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
2544	chrome.exe
2544	chrome.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
364	DeviceSyncHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2544	chrome.exe
364	DeviceSyncHost.exe
2544	chrome.exe
364	DeviceSyncHost.exe
364	DeviceSyncHost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4384	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 3896 wrote to memory of 1124	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 3896 wrote to memory of 1052	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 3896 wrote to memory of 1656	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3896 wrote to memory of 2912	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 3896 wrote to memory of 4756	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 3896 wrote to memory of 4132	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 3896 wrote to memory of 4768	3896	2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe	102
PID 4768 wrote to memory of 2668	4768	cmd.exe	105
PID 364 wrote to memory of 536	364	DeviceSyncHost.exe	110
PID 364 wrote to memory of 4500	364	DeviceSyncHost.exe	112
PID 364 wrote to memory of 1880	364	DeviceSyncHost.exe	114
PID 364 wrote to memory of 2544	364	DeviceSyncHost.exe	116
PID 2544 wrote to memory of 932	2544	chrome.exe	117
PID 2544 wrote to memory of 3296	2544	chrome.exe	118
PID 2544 wrote to memory of 3296	2544	chrome.exe	118
PID 2544 wrote to memory of 4604	2544	chrome.exe	119
PID 2544 wrote to memory of 5016	2544	chrome.exe	120
PID 2544 wrote to memory of 5016	2544	chrome.exe	120
PID 2544 wrote to memory of 412	2544	chrome.exe	122
PID 2544 wrote to memory of 412	2544	chrome.exe	122
PID 2544 wrote to memory of 2936	2544	chrome.exe	123
PID 2544 wrote to memory of 2936	2544	chrome.exe	123
PID 2544 wrote to memory of 5088	2544	chrome.exe	124
PID 2544 wrote to memory of 5088	2544	chrome.exe	124
PID 2544 wrote to memory of 736	2544	chrome.exe	125
PID 2544 wrote to memory of 4524	2544	chrome.exe	127
PID 2544 wrote to memory of 536	2544	chrome.exe	128
PID 2544 wrote to memory of 3428	2544	chrome.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d448491be7f697882a52586d12ae6c6d_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:4384
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240730718.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1124
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:1052
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240731109.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1656
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:2912
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240731546.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4756
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240731937.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2668

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:400

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:536
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:4500
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff83e04c728,0x7ff83e04c734,0x7ff83e04c740
    3⤵
    PID:932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,16571986607761744807,5623937185940299145,262144 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,8428227150968365085,4300929729323443884,524288 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,9792424249123038461,629660027955254142,524288 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,5251958691029576638,14539247999635683086,2097152 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3299379517143640267,1510807710303927801,2097152 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,13025109830354741347,9989234220325084686,2097152 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,17333635297054630427,10741397857669682416,524288 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,6394001781731404839,12235044082913814855,524288 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:8
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,16108685620438167915,5032632494475999142,524288 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,9038298729711873579,12185913214391586025,524288 --field-trial-handle=1996,i,14899943316075264176,4809782550813910797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:3428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 654KB
SHA256 624cf14d265c5913115d722465485249b975e4c343e67c8615d081cac01e4376
MD5 c80632566403bfbb22f5c570f5fb2c86
SHA1 883ed74bbfe91f26fbad7a9bc9203f570532d176
SHA512 89bf8de368fc4a25785a5f9b736b38914e90338903bf554d85e14a20453fd3ce1e677168cc6f04577e37dc69786966dda040ac725df2915f23396b5552ae0dcb
SSDEEP 12288:kNGG3U3ITEmUbqLELwmQrBhYIwCtCYu1y+nU5zX4+/0zIAiAQ1fZE:iAIAmUbqokLhrwCABdU5czIIQhZE
TLSH
T13AE4D115FBA814F9E2B3C17CCD634605EA727C9A4770ABCB139449962F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1e55160c0a056b09c6c2ea969d3b83e6f52c03c1853d6cc38d679ae88d3c53c0
MD5 b10c14c43b17293278390324f7b77966
SHA1 d8e239e0db14946a4ea277421ae1b57e73690bc3
SHA512 f95cbfcd51c303ab779b8dc8370ea395788c0da2f647a5a819fd1414cb9add914a5ffc029d2954bbbac93a1780f046d68f2e1bf9742a50f9f350833d734608bd
TLSH
T1F1E0E5AAD931AC2729F95B6850500B46DA8013573B40894F3B3C9009CFB9636014681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 8c813a746c10ad99ac1a8415fa7ed93e7f637bfc29b4690a7dea8fc4cc699558
MD5 246b08a8aa0bffa5a2c32e811d9d9b6f
SHA1 71c2db616c4e223ab35d0b8c921ceedc82d6881a
SHA512 ec07d1487d3bfc3c0c4eb457fc679ee27f94db5544b7dc3293f4bfc150dfc2fff8b8fca9602226899ee504adea612f75aded54aba6e43862de1307e5546d8389
TLSH
T1C4D0A90E174014B6CBB80E713017AE0DF7BA3C14B2A2733BBBC71C911C5E54A96A9CB2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7360a3045bcabd8dbf69b016386bc0e0609d9507f59d57535b8eefadfa3ff27e
MD5 90d74715f44711bf8f87ca328d731022
SHA1 035527f9ecf84e1c68e37213b51c4785918731e4
SHA512 8eda230fc9b8a38cf529d9f45d5d3ada2836b742e83431dd9c2ab56a9fe3a6b903fa0a3f3f6e3eb4ca28886261e697db48f050ca52ed6afda4a42b447f9c9c09
TLSH
T1F58178F7C3E8853D891156F49B11AF1FCE291A24031C3C6AC9D4AE1B93E2872D21535E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 84640fb7902688d69205356192602bb8a31bbcc2ae94bfa355d6d283413dad8e
MD5 42f21742b7c6e0c82376226cfe22ba02
SHA1 fad453b21caedfdccaf671a9a62df6501b16a225
SHA512 552e5e4e7e372133b4fc96f36b0600e34608e7026b71c778cad94aebdf3814c5b521cc6249dd5e34286a574373ab563f270abade0d7cd197aa98192a93d89763
SSDEEP 192:/RNCxgJv78pmPRpIZ0e10M9DHsb+WNn1NP6T2KrkwQVyIsnAUgraJ:/RNCyJ4uXO5wzPE2Kr0e
TLSH
T12C52E82EBD10693B6CDAD22AF9627B53D3F6102261E51E94FAFC892C14E75CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d9038934870e60a817d44538435285366779cf1cc8cca856d23bb0ab3c1b529b
MD5 622911fb5f9a5b08780b4782c9a55d99
SHA1 ccb441d2b8f48e54ba82311bcf0d6072c052b3d4
SHA512 2419ff7e4dbabe18733418ac4f295f889e83eeacd218d9373a58afe5b92d0046f3ff9b9a298b9fe62ef9e2e22f44632a3e8ce5e7bc65e633ad75dcf0130e719c
SSDEEP 192:/RNCxgJv78pAPRp2Z0e10M9DHsb+WNn1NPdT2KrkwPVyIsnAUge:/RNCyJ4UX85wzPh2KrJe
TLSH
T14A42C62EBE10693B6CDAC22AF9667B53D3F6102261D52E94FAFC892C14D75CC312711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 643e40c5bfac4406bbc3899623e547b9054d2968d237f336ee587827efb5eef5
MD5 df9f956a825b51ae3f97ca341e1bb062
SHA1 c5090b20cc4358ac9fdd8beb1bc86dcf5dc5ca01
SHA512 33fedd8f8d79cf2ce871f39f6e10f645e2925158a2c5a7944ac2cc656454ce1bd52b45c096f5de0b6ea5169cb83f55e30b451896715ac0a28fa6ec320bbce2b9
TLSH
T128A0021403C80E41FC210B7124914348271089A35BAEC72744D8144599732545A0600C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 05180f0d34db12be07ea07affd0db45d25136e5e3f0d10401a205040d561fe24
MD5 8e96e8dc10839f832d9718ffb7e86fd0
SHA1 dec35fc83af963fcc1a91abbed4fceaafd925f2d
SHA512 a7ef052a56124b6fa28bb3775bef6cb1e35543206aacfbb2c608391a95faef4ec42a5eca1cd44fd25c1a05143cc6bfadbd5fcc826fadfc82d0ff0157f8a7383a
SSDEEP 6144:l1phxNPRW2PYddqmY7U52Fpm7Rkm1tYpBeh2BAor:vfXPRW4Kq97UAe9oBGcAor
TLSH
T1303423227CB5AD394C5DFE1D304E3D2E1EF28FE9D4A4AEC6D8846F0822AF9541C16974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8fff01be5bf9f51e28079f2f5fed9e3685a0224b23ab0a7d64704626576f768e
MD5 1dfb2c4ab9acbfda94ef4bbc474da116
SHA1 190e3f479a214e76607a0154952fb543859a0246
SHA512 97b78ab7a2fd3399c0a8e27a93a511ad20672fee7d4c0613a9aba5110fe2807ae3bd17d7c9ef77f7b33d954a1ba89c38800fe994c4d59b700ce30fc8e3e7140a
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:bm7Rkm1tYpBeh2BAoO
TLSH
T12EC3123B5D65E9375979A70EB48E0B1E1EF24DA6C930DE42C8D86A0473FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 96eb6d9f2d10516da7789b2d1862a7799e42e31107fa280ae64e49c84226b717
MD5 30752bfe4ef1a897f97eacb00a12fb0a
SHA1 8f8e447c64a88943cd09be6566f1ee6ce47964a2
SHA512 80f96d825b691c1ab8b9d842b3acadf7de8395335168067e52cbf8a25bd8e59c63935f66a69c7dab191ea48ae4a650ad0616bb783da371a300fd0e603f0d682a
SSDEEP 3072:GdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:G0m7Rkm1tYpBeh2BAor
TLSH
T11CC3123B6D75E83759B9B71EA04E0F1F1DF14DA6C920DE52C8D86B0423EA7CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 725a0dbf86aa5211b97c00a43e16a8dfb6bf52065787fa4f7ff319dfc5b038c0
MD5 ec6ba0b64b66d67a9580acb671737d54
SHA1 7a6a6942f1e1148b767f1a4602f7be2eadc60730
SHA512 baf48fbbc6cbc30f542249071070a36c6ff0fef25e1e2595186002d4abbda3dfa658688d196a4ac19fd809bfbdf453be039e406b0660dfecd991550833bc99ff
SSDEEP 6144:HbhxNPRW2PYddqmY7U52Fpm7Rkm1tYpBeh2BAor:HdXPRW4Kq97UAe9oBGcAor
TLSH
T16B3423127DB5AD390C5DFE1D308F1D2E2EF28EE494A4AEC2C8D4AF0827AA9841955D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 660KB
SHA256 622b30620f4676728195618bab4bd2ad4cd261fef29c3cca2d3bc17b9c713b17
MD5 0bc10e4d0d03b5703bf4347fa4549f7a
SHA1 b62931e0b8762265f3747ade2b74a6dfdf02e4fe
SHA512 154b27714f5ff4f3a60e03f6f4d0177d5a7f671eb40c1e33adcaf6111ab70fcacba69583ab27ecd3c18619a954785b280226dde01a2d83e93136146cdabeabe9
SSDEEP 12288:SNGG3U3ITEmUbqLELlAQrBhYIwCtCYu1y+nU5zX4+/0zIAiAQ1fZM:sAIAmUbqoZlhrwCABdU5czIIQhZM
TLSH
T110E4D015FBA814F9E2B3817CCD634605EA727C9A4770E7CB13944A962F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 690KB
SHA256 76087288ab73512f32e5ea7cbe5cce3dd9b04c52677d4f6b120cef4933bcd764
MD5 42b8b18a9d7c07ff9c2f7ccc931be8a2
SHA1 93565494fff23f181bced9fc4a8be272295813be
SHA512 ef49e7f0a00cddaaeb07945c94d3ac38bfa68a008a5b3975777628543f75c3ee86cb9a0bdcd8d4188c36f5aeb56a0177d31501436097f7143030f8f79d59b4d2
SSDEEP 12288:INGG3U3ITEmUbqLEL8eQrBhYIwCtCYu1y+nU5zX4+/0zIAiAQ1fZLP:2AIAmUbqoYThrwCABdU5czIIQhZj
TLSH
T194E4D015FBA814F9E2B3C17CCD634605EA727C9A077097CB239489962F27AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240730718.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240730718.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240731109.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240731109.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240731546.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240731546.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240731937.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240731937.bat
Size 250B
SHA256 2dd49932fe88dabbfda111f29eda45ec188bde05475e42731322bc0cc039e3fd
MD5 393a6f633e5f2ad8265d9419c1febc6d
SHA1 768dba8676b4e326b7e60e9eb5634e8937ea7a1e
SHA512 1cce91b5c4b5a13d78f02c6c2be6448887235c044d519e30771265c8493cdaf34543622f9d1ba489d4eaf51717cb5db052a2d7ba87366bb8816f16b8925291d8
TLSH
T1DFD0951781C5C2D40519A047016F144CC061F8042F413742D396C9082368404F556741
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 690KB
SHA256 30a218a4a0f30f5b2a0b0c552c9ffe7381706800dbd10283d43c3416f13cebf8
MD5 a26419a1b107dd79ad9fc0d460acbac9
SHA1 6bb222e4f2445fbc79b592c09e24c694af4bf5d1
SHA512 c93ad48a951ad1487c060e6f6fa7be0529156ab8d7dd3439322fcd276ae33f845e407babf6ec3789eebbf889af67b06a62fcece5752614d3cf1d7292bd7b60da
SSDEEP 12288:nNGG3U3ITEmUbqLEL5VQrBhYIwCtCYu1y+nU5zX4+/0zIAiAQ1fZnZo:bAIAmUbqoFAhrwCABdU5czIIQhZn6
TLSH
T121E4D165FBA814F9E273C178CD634A05EA727C9A077097CF139489962F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download