88c8efb9ce993ae0ac8808a6c792d853a4b9cfae873d7e6365400977a07b448d

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 826KB
Sample260809-nvgrraac49
SHA256 88c8efb9ce993ae0ac8808a6c792d853a4b9cfae873d7e6365400977a07b448d
MD5 683e6047b3de01080f70cd35442983fc
SHA1 1c75831c83d1db299a6b8c71363b42a8450aa4c5
SHA512 8792b47ec19eaebf982e353becc6ee305e94a99b94ea2a19170d01a894031f40f9fb1dc5082304d05a09ce70f275330371f60958e3526ddbf2422f05511c9276
SSDEEP 24576:ZAIAmUbqoB4j/EDOVjvlPiuF/cv922W71n:Z5A5uo6/mOXPlkvs22n
TLSH
T17A05F155FBA414F9E277C138CD634601DA72BC9A0770ABCF23A48A961F279D19E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4268	SecurityHealthSystray.exe
1032	SecurityHealthSystray.exe
3960	GoogleUpdateCore.exe
4456	DeviceSyncHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1344	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1944	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307494164028908"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1344	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1396	schtasks.exe
3168	schtasks.exe
3948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
1960	chrome.exe
1960	chrome.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4268	SecurityHealthSystray.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1960	chrome.exe
4268	SecurityHealthSystray.exe
1960	chrome.exe
4268	SecurityHealthSystray.exe
4268	SecurityHealthSystray.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 3564	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 3476 wrote to memory of 1396	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 3476 wrote to memory of 548	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 3476 wrote to memory of 3168	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 3476 wrote to memory of 4804	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 3476 wrote to memory of 3948	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 3476 wrote to memory of 4268	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 3476 wrote to memory of 2528	3476	2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe	108
PID 2528 wrote to memory of 1344	2528	cmd.exe	114
PID 4268 wrote to memory of 3624	4268	SecurityHealthSystray.exe	120
PID 4268 wrote to memory of 2192	4268	SecurityHealthSystray.exe	122
PID 4268 wrote to memory of 1828	4268	SecurityHealthSystray.exe	124
PID 4268 wrote to memory of 1960	4268	SecurityHealthSystray.exe	126
PID 1960 wrote to memory of 4608	1960	chrome.exe	127
PID 1960 wrote to memory of 1944	1960	chrome.exe	128
PID 1960 wrote to memory of 2792	1960	chrome.exe	129
PID 1960 wrote to memory of 2792	1960	chrome.exe	129
PID 1960 wrote to memory of 2928	1960	chrome.exe	130
PID 1960 wrote to memory of 2928	1960	chrome.exe	130
PID 1960 wrote to memory of 220	1960	chrome.exe	132
PID 1960 wrote to memory of 4324	1960	chrome.exe	133
PID 1960 wrote to memory of 220	1960	chrome.exe	132
PID 1960 wrote to memory of 4324	1960	chrome.exe	133
PID 1960 wrote to memory of 1876	1960	chrome.exe	134
PID 1960 wrote to memory of 1876	1960	chrome.exe	134
PID 1960 wrote to memory of 5052	1960	chrome.exe	136
PID 1960 wrote to memory of 5052	1960	chrome.exe	136
PID 1960 wrote to memory of 1628	1960	chrome.exe	137
PID 1960 wrote to memory of 2812	1960	chrome.exe	138
PID 1960 wrote to memory of 2812	1960	chrome.exe	138
PID 1960 wrote to memory of 1828	1960	chrome.exe	140
PID 1960 wrote to memory of 1828	1960	chrome.exe	140
PID 1960 wrote to memory of 5052	1960	chrome.exe	141
PID 1960 wrote to memory of 5052	1960	chrome.exe	141
PID 1960 wrote to memory of 4648	1960	chrome.exe	142
PID 1960 wrote to memory of 1064	1960	chrome.exe	143
PID 1960 wrote to memory of 4648	1960	chrome.exe	142
PID 1960 wrote to memory of 1064	1960	chrome.exe	143
PID 1960 wrote to memory of 1452	1960	chrome.exe	144
PID 1960 wrote to memory of 4868	1960	chrome.exe	145
PID 1960 wrote to memory of 116	1960	chrome.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_683e6047b3de01080f70cd35442983fc_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3564
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240693703.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1396
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:548
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240694015.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3168
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4804
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240694343.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3948
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
    3⤵
    PID:3624
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Google\Update\CrashReportTask"
    3⤵
    PID:2192
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
    3⤵
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Google/Chrome/User Data/chrome_update_manifest.html" --disable-infobars --hide-crash-restore-bubble --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa08b7c728,0x7ffa08b7c734,0x7ffa08b7c740
      4⤵
      PID:4608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,8803268024873960086,18249701620072247564,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      System Time Discovery
      PID:1944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,9801538592586160136,223736239899195031,262144 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      PID:2792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,3214152822390445630,10689576757796310384,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:8
      4⤵
      PID:2928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,12984500903686405308,1567359037974856759,2097152 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,6444174355079916738,5342644237132777301,2097152 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,4960166688353882371,15436267745466241861,2097152 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3892,i,3669579243565299201,793053885357129242,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:8
      4⤵
      PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,17815458348127441378,17278909607780408716,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5164,i,9099966874703773108,4894577193906612789,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      PID:2812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,3931307598007448578,14900779492948349860,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      PID:1828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,15009439276314174941,3595681411596417020,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5420,i,4879949021699762453,7393473916044173531,2097152 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:4648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5460,i,8406886582070690401,9873447306492126460,2097152 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:2
      4⤵
      PID:1064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,15573541991286563188,6049633322427633370,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
      4⤵
      PID:1452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,5605971705994953659,8166303759659313820,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
      4⤵
      PID:4868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,397270366039787152,17344428767561785462,524288 --field-trial-handle=2064,i,10218397720231140240,4344627307349295170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240694546.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1344

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:3960

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 861KB
SHA256 8d181203b1524929e2283b69efb6508daa11cd522c1b562ca0317176bd386976
MD5 a37e9ac03c3c17256c3d36a3bc5d5658
SHA1 b7800dcc2df4b4f358dd25f1529527e66ad1db69
SHA512 eecffb4f38acbd88b5e319f871d69231611f90548e2af8c64c54c459bb176f3a7fcbe1588530d94a5c60eec6f06fc3dbad43dfa543a8f37bc60d46b84c87023d
SSDEEP 24576:HAIAmUbqo4tj/EDOVjvlPiuF/cv922W712Yt8uW:H5A5uoK/mOXPlkvs22ztjW
TLSH
T19115F155FBA414F9E677C138CD634502EA72BC5A0770ABCF23A48A961F239D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2f301945f46498ac70a4cedf22485270065a380ac660e4a45809723bc7839838
MD5 04e3e0d2e9bb25ee74d1db4d0871eb8c
SHA1 20eb22d42816daac1ff6933c20aff35267cf22ce
SHA512 925971bdf512a675176e82ea875c124489da99e1e80358408c64a83064b1b9f09cea485360c80acf35e8fb78be818e6f470c01defa3be2e3944bd79a18927595
TLSH
T1E6E02BB9C961FC2B29FE1B28A0558756E620639B2640494B7A3C950C8FF1A3A9655C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 4b63743086a27add02393e11457fca87a8437797a396770201389439bea6644c
MD5 5071cbe7605cb4bf802261702fa4d416
SHA1 189efed05fe1a09b033ddea32a1f8ab68da1d351
SHA512 a2963122e68007150faea7707615e54a06b7f83eff1b2fb9d7f2305d46edf11959aec6851219cd39907b7e992912a914502a21b3a50fbd340640b55c960824e9
TLSH
T10ED0A74F1D155155C37805B86503FDC1F7643E19D9245293C5CE0F486E3E638E3D599D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e08c756b4c47440d73ef35b35d33ed513b54eab5074735501e5d561f15763ae4
MD5 9e27d30cd49a6d925a1baebef7bab7cf
SHA1 65da6ffe150e0efec9a3fe67d21591d5fd93c330
SHA512 91323e556c85acdc675a40c05d913810c398dae58982b1f3b07252cbc4c51e880713ee4086cd7fa914edf7e8037da6b9349b21686382365245467046a671a7f0
TLSH
T15381BDF7C3E8812D894156F4A715AF2FCE290A14431C3C7AC8D8AE1B93E2872E11535F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 15e6ef39d8a03cfbad8cf2cd6af66cc23da1ad4db0cebe78eb3e63e342a8c50c
MD5 e9c6f1dff35e9154a21777040a7d8b58
SHA1 d96957885b285cb5b0bc07a6115e8d18e6dfcf74
SHA512 07144e847e1fd9b8a01278284542a4acab250c0ab3c72537846c0082b1df30c862f3b460f2d1591400cfadc4b0004619179442f267324ae37a468e78e4630b22
SSDEEP 192:6RwqHm1t6Xv72vAPRp2+vxp9THsb+WNnUQPBueZzaV8cVyIsnAUge:6RwqGaC6X/FwzPnaVje
TLSH
T17142D62EA920797B5DDBD219FA667727D7F6003135E52E80EAFC892C14D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f5be4bbd8bad50ccecac3adaa34ae672422e4efe265450e9001e54f4359ca797
MD5 ef21dfc1fadba867c8716106faf05642
SHA1 bbf745c380f9444afc76fe4f2a0662868321c5aa
SHA512 1d52a5ffa00454e052bd90f008e5d95f9047bdf2ccbc2dd7ff69182f104d80c28246f8fda887c2eaf40d0100bdf78ddc9a541b791f13418500e4a9e7c28f3a22
SSDEEP 192:6RwqHm1t6Xv72vrPRpH+vxp9THsb+WNnUQPoueZzaV8lVyIsnAUgE:6RwqGaCbXsFwzPyaVOE
TLSH
T10C42E72AA920697B5DDBD219F9657B27E7F5103135E02E80EBFC892C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 0b760729a83a34d990e9c4622580a18121131359da55f0474731abba56ab045d
MD5 60b21b31158802341faa39a8c8b59ec5
SHA1 6e63acf60ab0f26e61ce114556ebdb581616ecb1
SHA512 d75bf2a216a3f1af5863ded491a13f889f477b413673fcbe4afc436a54104dc479c91c806846e66776f86fc54e0a6f46c5e8e7fd859b71c7574012fd432881c1
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3z+HGNIB3WhmbKoUvM:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHK
TLSH
T15A52F967688D963F4FD8C68CDC167F4FADB2019666740C2897FA9C08039A7CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 40beb2da739b1bdf145a2c05ae18fca3547a401bc365a5a267cdaba1b9db75f3
MD5 4639acf325705d636f2f2da7a25f10ed
SHA1 aa602aeccf687b28a4709aa3028eff1ecfb34f09
SHA512 0f1328c448a7d38de7765d6bfbd0356c00681bbf22ec16dd3f707ff36372bf47a467636f87a39da9eae6d4b35d971eb731cec011fe08ed32b6b57d956e93a7c9
TLSH
T100B0016CE6C41E47E84517B610E251C436205D606A269A6B9DA8B0A586322A48E9202A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8274ef6c79fa0ea86710bfd66f36e1d6456adb5ad0f22b7849bf53260343cd11
MD5 fedb4e3268dde8870d55a6ed006d870c
SHA1 94c68aeb69424c429de9c9fff574a407e4ba168b
SHA512 5c61994695a29711d6d7e90be57d588633ea198a7eb3ec9876a9c950d844d19c9abb5f6cd6083fa19ffed413c0580a9e5e1937fc65838bb30b8832479e9af68f
TLSH
T193A0021051D41411DE4047B0E46636593256DC6626925743A4AB5856B86F9C0D665540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 006e568868225cbd2b8069e23167c32e0f2af534fff1153bc8431b83f5afc2a9
MD5 64186457e0f4a4159808023c49959321
SHA1 ac041d19d38ac45e68975cd4c6f7ded37467eccb
SHA512 ccc913bb258fd3d61986469303acf31ad50a209f554ed473bb33dc6d0698d3f640991004187ce023cbdca3cacc4de21971dcc95acc1a608f3dccbe61283265ae
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 567ee0d0c3083e69d712d74520faba16d8ddc75fd732a342552e483b0b7821eb
MD5 ae652e2d84e35b529bec655e777d811e
SHA1 65261c700b224c9557077d48cc28c53fedcaed62
SHA512 b02b7cc7cc5a962393b6565d8b490600ae0b2ac2640ac492f369a5266dbbb6885b9370e72cfe1d746b733fe6ee7543e1c609533d8a40aa43bef343d00769aea2
SSDEEP 6144:A11G0mu/uQb4kBwv3oyQVmodMvF7b8wIEm7Rkm1tYpBeh2BAoV:Qnmk1b43AyMJiiwIn9oBGcAoV
TLSH
T1FF3423639F7149B32964970FD10F1B2B1EF25A599046CFA7DCB0AA4C23DEF884A5D920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 dd1a2fbc27e23dcfdc30c4e440907a61415c1811fb14f73baf7003382cd2e899
MD5 5ab2bc1a0faf74c0bc67f775e4d61758
SHA1 0b2fa78f9e18e365cd28da2c6a582d551efbcab8
SHA512 73d9a651fb07e24ec2b1e7855401eafe683865fb942228a0575e8dc46d4318900db5dae7347b6d44f313414e3bec0e2a61b4fd30b7f6a7e121fcee1def2c4cf5
SSDEEP 6144:m81G0mu/uQb4kBwv3oyQVmodMvF7b8wIEm7Rkm1tYpBeh2BAoV:7nmk1b43AyMJiiwIn9oBGcAoV
TLSH
T1C43423736F7149B32864970FE20F1B2B1DF26A5BD045CF56DC64AA0823DEF889E5D920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5a54fdb2fa973a62567eb3118d92558f54087945f14495e31c4125d72763deb4
MD5 7316edd5d24ea775db2ee64717eb20f3
SHA1 be8742c27223e99b86bdaa3bd1a8890a315d6aa0
SHA512 21f6a2a755206767afb8d634710ce21cd2b1cd6fed3e96a4aedfc4e9680f7b00c70114e4a743686c257481b9cc66463b519c193416f21868ec0ab95f18a5400a
SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:9m7Rkm1tYpBeh2BAom
TLSH
T178C3123B5E71E9775979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC0A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5f3e419b7538cc562800b765913abe06c1f9a70d861c3cd9b36c65ae1c6aecc4
MD5 a2b4266cb6aebab980e0f13cb19059db
SHA1 c0284d6a0f60d1d0c4da613da66949c498f1d6c9
SHA512 fab5c4c439ff9a248717cfcb3416ebfad9bac4cf3cc834fd46eb7a7c79412fa0fc7c3488b91af0fcbfc7cf18f2b7e869508d63ec97ff0d954bc3ee8bacab3b89
SSDEEP 6144:X11G0mu/uQb4kBwv3oyQVmodMvF7b8wIEm7Rkm1tYpBeh2BAoV:lnmk1b43AyMJiiwIn9oBGcAoV
TLSH
T1C93423639F7149B32964970FD10F1B2B1EF25A599046CFA7DCB0AB4C23DEF884A5D920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_update_manifest.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_update_manifest.html
Size 129B
SHA256 29b7922b5b77052d66d3a2f2c41abd2950cdc75fed16864176686682e6f01c2e
MD5 0712e1c968c20bb4abf679a8d8c00239
SHA1 b4f8857995fc333f39cda7ac1d8a9c08fc672da2
SHA512 7bc972d922a79ede06f5efefacf970388424716ad8944dd71bdd3595afcee35d3e080d0f27fde26286decc5a9b04394f107e851be9ed8af86462d14840318bf5
TLSH
T10AB092FB6C00E46EFAE0B6808DD2776D6CA992882CC6C84920C4342A854866BCD0ACD9
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 850KB
SHA256 efa37924231d77102a5c4d4b20c69a3170068c4e79d32087a74ca70d97f20507
MD5 8a2d4da118b7213f6fe77fc32d5a4e1b
SHA1 b07501565c997df618ed448185711bb026ccc58b
SHA512 9f3fbc4c61dfce5f69ee0739b6163d030215df12ba355fe12756473eca7b991dff97f87b6fac3e5cda06029a13ffff9010e87e5473fbe8e37b44c8024d4c8df7
SSDEEP 24576:iAIAmUbqoKRj/EDOVjvlPiuF/cv922W71/Hc:i5A5uoE/mOXPlkvs22vc
TLSH
T12D05F155EBA414F9E277C13CCD634602DA72BC5A0770ABCF23A48A961F279D19E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f05bca7-5aac-40d1-91f5-8c04f8c6e0b2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1960_479445557\8f05bca7-5aac-40d1-91f5-8c04f8c6e0b2.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1960_479445557\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240693703.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240693703.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240694015.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240694015.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240694343.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240694343.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240694546.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240694546.bat
Size 250B
SHA256 078a588263e0df86bab72c560db560660264e25590c2423e9e4c25b6e0b2474a
MD5 5447b13ad73f60d9c7c1fcf414281851
SHA1 71ec589f825bef8323497801f2418c2613e94ead
SHA512 b81cd5afd984f8792bb36019c538b691502951ce18ab53f99a2afb322da80cff485a6726ab25f11b25447653f937c78c2ac6c28027d16a987454c12e6bf77e2a
TLSH
T192D09752D3CEC3E30A1AB483006E594CC061F8080F80378383DDC89D1369448B596751
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 834KB
SHA256 ab1691c958618e265284bf0f5aa37c3573bb3fa860f124e5d105ee5587335eec
MD5 070599ee7757441dceffd7253e37bf78
SHA1 1252bfbbc17088a8bc1c73d4077e0991f5113339
SHA512 881dc1c16b91eec388f445d307d209d1b655e8f141677eb709d70197a89d34f3aa53870c85bbfd8bfe6a71d44e64bb9359f1564091608c0c2a9e01cccb547b7d
SSDEEP 24576:8AIAmUbqouWj/EDOVjvlPiuF/cv922W71Nr0:85A5uoX/mOXPlkvs22l0
TLSH
T1C105F155FBA414F9E277C138CD634602DA72BC6A0770ABCF23A48A961F275D19E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download