salatstealer | 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8

user interaction
yes
max time kernel
147s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260130-de
resource tags

arch:x64arch:x86image:win11-20260130-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
keshka.exe
Size 3.4MB
Sample260420-szce2set3q
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 12 IoCs

resource	yara_rule
behavioral3/memory/4020-1-0x0000000000EB0000-0x0000000001B07000-memory.dmp	family_salatstealer
behavioral3/memory/4020-2-0x0000000000EB0000-0x0000000001B07000-memory.dmp	family_salatstealer
behavioral3/memory/4020-3-0x0000000000EB0000-0x0000000001B07000-memory.dmp	family_salatstealer
behavioral3/memory/4020-13-0x0000000000EB0000-0x0000000001B07000-memory.dmp	family_salatstealer
behavioral3/memory/2240-15-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/2240-29-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/2240-82-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/2240-83-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/2240-109-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/2240-120-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/2240-137-0x0000000000020000-0x0000000000C77000-memory.dmp	family_salatstealer
behavioral3/memory/4180-162-0x0000000000550000-0x00000000011A7000-memory.dmp	family_salatstealer

Executes dropped EXE 2 IoCs

pid	Process
2240	dwm.exe
4180	dwm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/4020-0-0x0000000000EB0000-0x0000000001B07000-memory.dmp	upx
behavioral3/memory/4020-1-0x0000000000EB0000-0x0000000001B07000-memory.dmp	upx
behavioral3/memory/4020-2-0x0000000000EB0000-0x0000000001B07000-memory.dmp	upx
behavioral3/memory/4020-3-0x0000000000EB0000-0x0000000001B07000-memory.dmp	upx
behavioral3/files/0x001900000002b425-9.dat	upx
behavioral3/memory/4020-13-0x0000000000EB0000-0x0000000001B07000-memory.dmp	upx
behavioral3/memory/2240-14-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-15-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-29-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-82-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-83-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-109-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-120-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/2240-137-0x0000000000020000-0x0000000000C77000-memory.dmp	upx
behavioral3/memory/4180-148-0x0000000000550000-0x00000000011A7000-memory.dmp	upx
behavioral3/memory/4180-162-0x0000000000550000-0x00000000011A7000-memory.dmp	upx
behavioral3/memory/3116-174-0x0000000000BA0000-0x00000000017F7000-memory.dmp	upx
behavioral3/memory/3116-176-0x0000000000BA0000-0x00000000017F7000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\9648ad46-55bd-a1bb-0991-0c1cf4bc4655	keshka.exe
File opened for modification	C:\Program Files (x86)\Microsoft\dllhost.exe	keshka.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe	dwm.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keshka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2556	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211729151602422"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4020	keshka.exe
4020	keshka.exe
4020	keshka.exe
4020	keshka.exe
2136	chrome.exe
2136	chrome.exe
2240	dwm.exe
2240	dwm.exe
2136	chrome.exe
2136	chrome.exe
2240	dwm.exe
2240	dwm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe
Token: SeShutdownPrivilege	2136	chrome.exe
Token: SeCreatePagefilePrivilege	2136	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe
2136	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2240	4020	keshka.exe	80
PID 2136 wrote to memory of 1904	2136	chrome.exe	82
PID 2136 wrote to memory of 2036	2136	chrome.exe	83
PID 2136 wrote to memory of 2036	2136	chrome.exe	83
PID 2136 wrote to memory of 2556	2136	chrome.exe	84
PID 2136 wrote to memory of 1900	2136	chrome.exe	85
PID 2136 wrote to memory of 1900	2136	chrome.exe	85
PID 2136 wrote to memory of 5092	2136	chrome.exe	86
PID 2136 wrote to memory of 5092	2136	chrome.exe	86
PID 2136 wrote to memory of 3148	2136	chrome.exe	87
PID 2136 wrote to memory of 3148	2136	chrome.exe	87
PID 2136 wrote to memory of 3980	2136	chrome.exe	88
PID 2136 wrote to memory of 3980	2136	chrome.exe	88
PID 2136 wrote to memory of 32	2136	chrome.exe	90
PID 2136 wrote to memory of 32	2136	chrome.exe	90
PID 2136 wrote to memory of 4192	2136	chrome.exe	91
PID 2136 wrote to memory of 820	2136	chrome.exe	93
PID 2136 wrote to memory of 820	2136	chrome.exe	93
PID 2136 wrote to memory of 2504	2136	chrome.exe	94
PID 2136 wrote to memory of 2504	2136	chrome.exe	94
PID 2136 wrote to memory of 1848	2136	chrome.exe	95
PID 2136 wrote to memory of 3376	2136	chrome.exe	96
PID 2136 wrote to memory of 1936	2136	chrome.exe	97
PID 2240 wrote to memory of 968	2240	dwm.exe	98
PID 2240 wrote to memory of 4180	2240	dwm.exe	100

C:\Users\Admin\AppData\Local\Temp\keshka.exe
"C:\Users\Admin\AppData\Local\Temp\keshka.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\PeerDistRepub\dwm.exe
  C:\Users\Admin\AppData\Local\PeerDistRepub\dwm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4180
- - C:\Program Files\Google\Chrome\Application\dwm.exe
    "C:\Program Files\Google\Chrome\Application\dwm.exe" -
    3⤵
    PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa360bc728,0x7ffa360bc734,0x7ffa360bc740
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,17723896742757228594,355810154127636084,262144 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,11181421766954667847,16962308476970639065,524288 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,14353573199546317129,13691659740516080844,524288 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,10601939417683914919,15462617763020655954,2097152 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,4450856088994399239,16874290127197725905,2097152 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,8058188073140384731,10208450393787846168,2097152 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4620,i,6918985180989018205,7525686852858194215,2097152 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,12618899733646315530,14362731566469800799,524288 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5552,i,11037996957357647813,5353957660873037543,2097152 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,10823156957794540430,8521348404649525149,2097152 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,12804387989988047513,11492375625536191400,524288 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4716 /prefetch:14
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,11226709364323484037,4376430053998894879,524288 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4728 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,1642615325353815586,1864000583123595817,524288 --field-trial-handle=1960,i,17531218288350728380,1695318221173616470,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3500 /prefetch:14
  2⤵
  PID:1936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ffa2977-0bad-463c-b3fd-ce6c2394045d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7ffa2977-0bad-463c-b3fd-ce6c2394045d.tmp
Size 17KB
SHA256 9336fc8b1b0a093e479c66a63fa27958d601744683dfd5ae19d06e92594da9cc
MD5 0ebaffd97ee5cb026dbd7c9ca39a94d8
SHA1 d32f41e4dd3bebd5472887097d7dfd8583750f9b
SHA512 9f5fd34ee2b5ff1e8f68560d05caf04aa78c30fab545aa02c36cb8e97677c91c001d22f3278084d6f2ee50f0284b15fa504162c99fb697ed7a94710b1360d5c6
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLkdLcifzOXODV0+ErU3OpHwDYAlL:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7pO
TLSH
T1B372FA676C4C9A374F94C6CCD81B7B4FADB9024B61D9886483FA9C2A03D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c599a86ca98bf706e98fb9a14114674c59f4e70f86fb5841e32fb651bdd66694
MD5 ffa9fcec9b9afc6b8c3b973bdac95860
SHA1 1b720623f1f16b7ccb902246efc8e72a32754a1b
SHA512 bdc92e8a0d28b8a5dbc889dfc02aad016466f03db1b9bc78992d7ccedacec7e1c1956882ae5b39c0ffa008eb753df63a6079d54740bca79904775ef9ba646f5c
TLSH
T13DE0EDBAC822AC3B08FD0B2A60554B86EB1007976A51854BBA3CC10D8FF132A01A59AC
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 529e84e9c9d5e05f9d63f9b8b351ae2bdbf1c913c7fdbc45dfd807830da3aa11
MD5 44f6ee5680fe0fba44acd12c52039749
SHA1 d0853b3f9ceef50030982a4df10a30833c02a028
SHA512 d27cd248797b35716fbf3978dff677dfbf042164f4ae0351ccaffd08fdaa34bc82798e6b2d4c3c9ebdf982b1441086a7b152ae445562259fd81720e82d52792f
SSDEEP 48:Tb9aw/aHLopFMavU1iBB4M30HOghmT4WQOpQVwqd:XPareMaZB40g04f
TLSH
T1A292019E2F302211C5F54772DAE2099A2E3D212CAB176A89E90864F38DD655FF4071B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d022582018fea8bca06cf45e4595b250ba1a3b4de4bbccefd0f1bc71fff996ac
MD5 fb0a90b39deff0e9fc44bef3de68e0ae
SHA1 54e3736d9ec3e4ca7fa1720bc3aaad35445587bb
SHA512 8fd957e0e3faf81ccd9b2727d7c2d6cc7ae85f0a10732aa05fa4b74d2fe70960142929ce98382a43da45c490a079b5fffc9dc0c959dbf3a29c6d560dfca309bf
TLSH
T130518EF793E8957D8911A6E4A6246E1FCE6D0D24031C3C6788D4AF0B53E2972D20074E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 866d374fb1cac5352dc7498c0b4a14ae0f7dde8b155aa6bed3eaac3a1d96140a
MD5 660fc8de2c880dbf83eaf99278cb1ef2
SHA1 c2343587dbb4f534e4db8f793ae2469ca25fd7bc
SHA512 93ce760005018c8ea8cc02e055f3da1a18c113538aad6b6e8d02d50e66ab1a3d3aae2ed97fb3d2eaa97590d316548da541f40d5748d3700a3dc862b7dafbe28f
SSDEEP 192:pRx8ruBf0pID5iUwv7dhAPRp2KW9ZHsb+WNnpHQHV2ikhcenJ23OMLC1VyIsnAUp:pR+ruBcQ/sp8XKHwpK2rhZJ23Olje
TLSH
T19352D72EEA14397B5CCBD21AF951B717E7F1102261901E84EAFCCA2C15E7ACC722741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 46860a9c9693b7869eb06341c437d4f96fcc8f0a91ef518b1f2dfa6af65dbaeb
MD5 f4078f4b4de6a9d4524b823b185c03ef
SHA1 148a2f3980ea224d7cd11f52016a856283be8cba
SHA512 25c8779f0dc010ac5d4fd04edf9e3b8f224056157c6b446496edef5ab4e221d996b6e438d768ba694d6c98b86ac64dfa5858940631ef1e3af13d31a840059b49
SSDEEP 192:pRx8ruBf0pID5iU+v7dhAPRp2KW9ZHsb+WNnpHQHV2qkhcenJ23OM1C1VyIsnAU/:pR+ruBcQ/6p8XKHwpK2DhZJ23Obj8
TLSH
T13B42D72DEA24797B5CCBC21AF961B717E7F1102171941E84EAFC892C15E7ACC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a2b31be8a2dfb3b5395628def11c8eb5506c77fa7c74b4a5b00a0dbc45e92c4c
MD5 11bd1808c481b4f0ed04bc73f34009dc
SHA1 8c8e7908aa7ea9012b66d05700966b089fbc9f6a
SHA512 8f8cb392e9faf72f3e26f4dcc4ad3848edf411774d56746b7472fc27ec5a1fc9eb4e1883405fec4cbdad9ccba493a6a949835b820ca0735c87d18b28f8d53c14
TLSH
T15EB01261E0019591C00742F4119A24883534DF108F06130153F0AA72A9263944124190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596047.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596047.TMP
Size 96B
SHA256 f84cd88d1e0d93f1b5aa4678b1b1765a2d770ff1f994881bb7b5014a5e4872dd
MD5 c5d5145775828b6dcb63be9a90037785
SHA1 6c6c523e026650524e0d4e897b3fd7d86161b319
SHA512 20164f56fbfd64b4f55f2ab725f3235dc5d06680b8db544cd7f8571c70ce352bcc1d73a05661a73540d49dfaa7ee2b47cb8cd78d703b9cd7fded47684ba07828
TLSH
T13BB00256C146A322D28203F42AD5D9D877A0EF25D693231792E01A66EC397A445365A0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b304101969c95b2b2cf73c196edaff588f8076f2145f5f1e4c4ccc433a2a24d9
MD5 e7a8574e95900a256939efaacf5d8fe2
SHA1 9d0bb13cb509acdfc1d2f0a12ece85cf3bf0345d
SHA512 590113a63781e75969c5ade7f9a068fb9aa4bc4bbf99ee744a0fa375d77047ffef20cb9be69cb69bddd7a2f302d14f47a63b96689ab4ac80cf94f1f26f35ed99
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2ODsGNHLVumbnEbXyuR:1nbZeMrv/hGtDsGNHDnEzyuR
TLSH
T1EED3A84B3A747002EDE59A721CE051BB5E3C716D8F55A5D428B620688EF2823B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 1aed949eb22d6a9240db25fcc6e6ec781db2e1bd14de721647a8fb1c689bf384
MD5 2024e3d2de07b8cc36b88ff8e9b1daee
SHA1 130f4973c399ee0cad394092ca3d15879dbda220
SHA512 9d2e514b2d2919f654ba9b7a5ef36444660ef7a19325c297d701bdd85c0bd54bde158619caa1724be4421037f0ead73abd955ee0161ba636886ed98ab4960718
SSDEEP 3072:RKGr8meOVKHWRzQQK4xPtv3iebGXGy4WZm0L++J3qUQm08KMWF0bFTcVHr6ze:kGr8CVKqnZo2ynZJL++JjcMW2VcVL3
TLSH
T1061412AAAD2B6D38D9CFD79D911B9C654CE194DFC518E58C30C2AF1A10FF244122FE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 30e1e36303b811b7ec33f4b3517ab40b35fd52d8318f5792312b2458f40c6b31
MD5 a5684025ac07c34705554001b5f0e1b7
SHA1 b3ea5658d6edd6246341ee62e955f9655fd0302b
SHA512 3c34a5013d355f5899a293a011b25d2326827cc863d14346d0b1ec6aa010cb8cde5136e9d6d08e214ef8d5c89c48cc5d2a6f645586b7342778318edce4cbbf6a
SSDEEP 3072:d4r8meOVKHWRzQQK4xPtv3iebGXGy4WZm0L++J3qUQm08KMWF0bFTcVHr6ze:d4r8CVKqnZo2ynZJL++JjcMW2VcVL3
TLSH
T1D01423CAAD2BAD38958FE39AD11B8CA544D184DF8114F29D21C39F2E14FF244222FD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 affc6d339ce89957d7fdadbbf5cbcd4fcbee82fef7cbcc2af1cc6f95934e92cd
MD5 1aee351bb4adb9758e8bf844795c29dd
SHA1 38d632eac014db4dc9fe55941bed0f3fc8e76269
SHA512 c14553b0443c15a6e11cf19d8a73cc148ceb25798f1b87143ff3155a489a15f372a13366c66cca7df20a8a7d2515c52b3b5bb7c92aebb3464f2fec9cb1194f59
SSDEEP 3072:A4r8meOVKHWRzQQK4xPtv3iebGXGy4WZm0L++J3qUQm08KMWF0bFTcVHr6ze:A4r8CVKqnZo2ynZJL++JjcMW2VcVL3
TLSH
T1741423CAAD2BAD38958FD39AD11B8CA544D184DF8114F29D21C39F2E14FF244222FD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 660b251cb9298fcc33f5a348897b71c24254d98910ebf06275568c63f4e0ba13
MD5 b5be89290da5f2adce68136c6fd7857b
SHA1 1a02edfa9c80e8e897a01b6415f4a5f381203d3a
SHA512 9f16e2f27b68e91046ec75b7633356beea6ab95c0e77b377588014d961965a93cb3a9206a091997d8976e2c074af33a73e806fa005b7834cf974e7b35118541d
SSDEEP 1536:XmP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:M++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1ED9302BD991E7C79536BC696A0079DAC8CD3DCCD111451BC30C76B0E18BA3A3A35B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm.exe

Path C:\Users\Admin\AppData\Local\PeerDistRepub\dwm.exe
Size 3.4MB
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_crlzlyv5.k04.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_crlzlyv5.k04.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/968-170-0x0000000006A40000-0x0000000006A86000-memory.dmp

Download

memory/968-163-0x0000000005EB0000-0x0000000005EC0000-memory.dmp

Download

memory/968-201-0x0000000007AB0000-0x0000000007B54000-memory.dmp

Download

memory/968-191-0x0000000007A50000-0x0000000007A84000-memory.dmp

Download

memory/968-166-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/968-165-0x0000000006510000-0x000000000652E000-memory.dmp

Download

memory/968-192-0x0000000070380000-0x00000000703CC000-memory.dmp

Download

memory/968-164-0x0000000006610000-0x0000000006714000-memory.dmp

Download

memory/968-193-0x00000000705D0000-0x0000000070927000-memory.dmp

Download

memory/968-200-0x0000000007A90000-0x0000000007AAE000-memory.dmp

Download

memory/968-149-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

Download

memory/968-150-0x00000000055B0000-0x0000000005BDA000-memory.dmp

Download

memory/968-151-0x0000000005510000-0x0000000005596000-memory.dmp

Download

memory/968-152-0x0000000005D10000-0x0000000005D32000-memory.dmp

Download

memory/968-153-0x0000000005F10000-0x0000000005F76000-memory.dmp

Download

memory/968-154-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Download

memory/968-161-0x0000000005FF0000-0x0000000006347000-memory.dmp

Download

memory/2240-82-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-83-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-14-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-137-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-120-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-109-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-15-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/2240-29-0x0000000000020000-0x0000000000C77000-memory.dmp

Download

memory/3116-174-0x0000000000BA0000-0x00000000017F7000-memory.dmp

Download

memory/3116-176-0x0000000000BA0000-0x00000000017F7000-memory.dmp

Download

memory/4020-2-0x0000000000EB0000-0x0000000001B07000-memory.dmp

Download

memory/4020-1-0x0000000000EB0000-0x0000000001B07000-memory.dmp

Download

memory/4020-3-0x0000000000EB0000-0x0000000001B07000-memory.dmp

Download

memory/4020-0-0x0000000000EB0000-0x0000000001B07000-memory.dmp

Download

memory/4020-13-0x0000000000EB0000-0x0000000001B07000-memory.dmp

Download

memory/4180-162-0x0000000000550000-0x00000000011A7000-memory.dmp

Download

memory/4180-148-0x0000000000550000-0x00000000011A7000-memory.dmp

Download