f0a81093036d7c8098927b7a8a1fd0b7a0f48326173561c2f82a536fe187d3de

Analysis

max time kernel
899s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 22:36

Target
Quark.exe
Size 5.1MB
Sample260826-2jed5sff94
SHA256 f0a81093036d7c8098927b7a8a1fd0b7a0f48326173561c2f82a536fe187d3de
MD5 24f4a3a08ad3b4f2a051fbeeec2e0b78
SHA1 90460602c9e1da712c139cc2fdcf998d50d48c22
SHA512 3ac781e1922301071324a0b411d809797d7403a3ccdf52938241c8d4752dbcafb22cbc151572615aea6e3aa7109ec76c5053ad888a082b2dd0ced4e413447dbb
SSDEEP 49152:nBsW2jfZbGMzK4wkO3VD84lXOOPGcFbGVO2gi8J8wipijKfJMME9bbKJelrm088o:SfbSQ4lOOBdWebp
TLSH
T13436BE03F39582DDD41BC5748316A323EB73F44A1B36A2AB67C81E25AF57AA04F1D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4208	Quark.exe

C:\Users\Admin\AppData\Local\Temp\Quark.exe
"C:\Users\Admin\AppData\Local\Temp\Quark.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4256

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:240