258e1591a2b8aea6ae26a68c9d6bf426c9f5b54e5762dacfcffb0357561a8d57

Analysis

user interaction
yes
max time kernel
427s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cool.bat
Size 661B
Sample260421-211zgagy6w
SHA256 258e1591a2b8aea6ae26a68c9d6bf426c9f5b54e5762dacfcffb0357561a8d57
MD5 f937f7e1834eefa446f69daa4cd69f9e
SHA1 182799685d0ef626b23fb24e3e7b2a57be9ded00
SHA512 12bb3ed9e933fbaa0380c336fd0450bab83342fd229060c163fcd737c9309aa7f5d9e89dec2bc1b84288ec17d9c6df6a1ba597f60360a142622266dd433387ec
TLSH
T18601F65E4E8C9D2E4DC21F2347883792E814102D72C577F26E64D15D9F0FD62B6A6740
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
114	raw.githubusercontent.com
112	raw.githubusercontent.com
113	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5-safety.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1248	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212862587120995"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2776	powershell.exe
2776	powershell.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 2776	4080	cmd.exe	86
PID 4348 wrote to memory of 1236	4348	chrome.exe	96
PID 4348 wrote to memory of 1248	4348	chrome.exe	97
PID 4348 wrote to memory of 2892	4348	chrome.exe	98
PID 4348 wrote to memory of 2892	4348	chrome.exe	98
PID 4348 wrote to memory of 1524	4348	chrome.exe	99
PID 4348 wrote to memory of 1524	4348	chrome.exe	99
PID 4348 wrote to memory of 3972	4348	chrome.exe	100
PID 4348 wrote to memory of 224	4348	chrome.exe	101
PID 4348 wrote to memory of 3972	4348	chrome.exe	100
PID 4348 wrote to memory of 224	4348	chrome.exe	101
PID 4348 wrote to memory of 4476	4348	chrome.exe	102
PID 4348 wrote to memory of 4476	4348	chrome.exe	102
PID 4348 wrote to memory of 4904	4348	chrome.exe	104
PID 4348 wrote to memory of 4904	4348	chrome.exe	104
PID 4348 wrote to memory of 3976	4348	chrome.exe	105
PID 4348 wrote to memory of 3756	4348	chrome.exe	108
PID 4348 wrote to memory of 3756	4348	chrome.exe	108
PID 4348 wrote to memory of 1192	4348	chrome.exe	109
PID 4348 wrote to memory of 1192	4348	chrome.exe	109
PID 4348 wrote to memory of 4632	4348	chrome.exe	110
PID 4348 wrote to memory of 2064	4348	chrome.exe	111
PID 4348 wrote to memory of 2080	4348	chrome.exe	112
PID 4348 wrote to memory of 4336	4348	chrome.exe	114
PID 4348 wrote to memory of 1648	4348	chrome.exe	115
PID 4348 wrote to memory of 1648	4348	chrome.exe	115
PID 4348 wrote to memory of 224	4348	chrome.exe	120
PID 4348 wrote to memory of 2476	4348	chrome.exe	121
PID 4348 wrote to memory of 2476	4348	chrome.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-Type -AssemblyName PresentationFramework; $result = [System.Windows.MessageBox]::Show('Do you want to run this program?', 'Confirm', 'YesNo', 'Question'); if ($result -eq 'Yes') { exit 0 } else { exit 1 }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffea76c728,0x7fffea76c734,0x7fffea76c740
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10657646035137546185,12116360760364321329,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,11524837452978196819,11429423191768356203,262144 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,1084003612846982888,610881772446843630,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,237156547429392035,16018301363817605158,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,15478675906477727375,9617675650625862522,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3984,i,11863706451758520182,1327810382137564952,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3988 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,11146840761408445041,10545291833907316539,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,12525972494978561088,5876316904683418530,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6000,i,7676194158041670816,3490304789141744141,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4788,i,15714032325339188624,2237415522704281412,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,292067407262635191,7821855994874392031,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,10414124543391756842,6909566536200332344,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3348,i,2361421586410248250,14771421918489106990,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3944,i,9921686358317628247,1895908315023412822,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6140,i,9309293762626338904,18379609498928013139,2097152 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3948,i,10514399256139254543,15962270226988710903,262144 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1536,i,5970305577319036455,14780931297775996549,524288 --field-trial-handle=1984,i,7431207878050120928,10313946024346987680,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:2476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4300

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5-safety.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5-safety.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1908

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x2f8
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d354e684aa9dea384123a5845cd7940b3ea55deb138a0633f1b7088401edc87
MD5 9bc9300dbea0e2b2a5b636c0dd01d92c
SHA1 fe3cb913570189642e2cdd1fe7a41aaab6b2fa11
SHA512 8cef216c5e0350e7e8d827caa08a04dda9fd249c0a121938d805ec7e764a893999c9253c7914c2d62130ceabd9b7adce504c24b85f1201db9ce49fba0ec41209
TLSH
T10BE02BBAD821EC3B08FD076960510747EB00231A2BC0580F3F3E824D8FB0676058296C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5d1779015868adf2d88661580f442e3c4e47ff904dd125c14460b1bb8b5a2196
MD5 117b11a0f87b171990aace1336cfca9d
SHA1 221aec3aff645e46db14e0e7168809a9ebe91af0
SHA512 4c4401e56b093d82081918049806f26ef9c1ec9d3c54289fd06cc2d7e599d3f02629784ab9396c8d0e1e121f9611c35a7ef65abf4cf0a13078f72fe9437aedc5
TLSH
T180518F5AFDE9C61EFF48667260C08C01787D60BC346BCF8788E8187C6E177EC0552922
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 68ade5628be1d87195c703ec350663f96e2fbc1d5b2ebf562d1fdc0d61ad1b7c
MD5 d31c13cdebf2bc041862532a40c9437a
SHA1 ca9f3437bc12c4b176b25bccac856838cfe4c31b
SHA512 2761b4a8b503b4cf38f6d8f65fa9c37f88f3f8c3a4fc717a42a0adf6cfd53dd03c42768546bef91204e3752dcc570b3cb14e120d9f26bda0505c628c83fd66ee
SSDEEP 3:MsEllllkEthXllkl2zEolYull:/M/xT02zDYul
TLSH
T197440405FFC04C0DCD4010304431C3700370DC540D11F74334D30413DCD55400C01004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 59d20e77973c5a5637066d4bc2c9865cf85048e9cc68aab1464a260728bbc341
MD5 36bd566593b20ea3f1017ddf0ffd4dc5
SHA1 3a2b2a81e0d5183a20f8f369c679e467f8a02027
SHA512 810dc3fadb18d4f4719c077d5e007ff660487597708ec1f04f834aff9d925dd8df80e730d23957400b95a72fb785fe09b2d92dca846a18164258884fbbbc7a64
SSDEEP 192:D+uuUm79mlm83aIaSFJVZQHzR+KNNmImmmDmEmDiBmzm4arZYM:D+uuUm79mlm83aIaSFJVZQHzR+KNNmIQ
TLSH
T1F5F1AEF7C7E5852D891155F4EB25AF1FCE290628431C3C6AC8D4AE4B93E2872D21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 7dc6745169f0f7a4df0145a12cc8f83d628d9d28b4c00e505b18abebba0119f1
MD5 d4d464bea3a869adbc065d3c14de80d5
SHA1 6ba22fc2d39b909edc4b3964dd72ae2964d9761a
SHA512 9ef182b2dff9e0d466397b4607b4e99bf5ca5e4307c4f27a203a29a8d5ae535653a5731429fdc777f9987c0d87f900d8fdee2395b828229d5b1dd9dfb82b5c64
SSDEEP 192:D+uuUm79mlm4aIaSFJVZQHzR+KMuNmImmmDmEmDiBmzmv:D+uuUm79mlm4aIaSFJVZQHzR+KMuNmIK
TLSH
T12DE19EF7C7E5892DC91155F4EB25AF1FCE290628431C3C6AC9E4AE4B93E2872D21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b0a7340b481e5916959ab08f539eb067bd43cec650f9bc4b5115ea8874d7d076
MD5 13cd03a6bac9f747742f7287549ad39d
SHA1 fcf5c31bd6e4f0aa7bf5c853572719ee5206703b
SHA512 0537cf3db100bd6f4f5716b1e28228eac750bebeb376677c5e39bcc8ae40e5499f907b4cda2f62b58225c942ae26dd9058677d5ed36443e65ea1101428f8c1c5
SSDEEP 192:D0uqltxwmEmg3aIaSFEdZQHkZqKUNmrmmmDmtmDiBmzm4arZ+7M:D0uqltxwmEmg3aIaSFEdZQHkZqKUNmr1
TLSH
T184D19BF783E5866D8A1196F4EB15AF1FCE390624431C3C76C8D4AE4B93E2972E21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3756d904ffe5001613f6ff85ccbd2cdd2c27b3bc019c56af994a3f7f25577c86
MD5 f3e2c4522472ad9327bc9b5cff1e1712
SHA1 5653f45321ab6fe40fe2edb840738a8e2e9ecb5d
SHA512 21396418d4c2cea87aaf17b6d42082a3e159aa124fce3f81903edd3579525a24039166518fbb0da5928245a7dec6fded5db863772557d46c9556f4727c446d97
TLSH
T19A317FEB9A7B78AB20BD49AB2D14BC066D79A8310181A4F5CFB7812CF0D54F74F11116
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0c40d1f4568261d1f9d67e949387978d0b3181628915752319a58c01eb7e9a89
MD5 5f40d82e173f50279f52e2f423402852
SHA1 2e864b50a6014c114367f9d54dbfad8f9e930166
SHA512 62a605220c926a2554f38aa429acf6f05655a2ae36702c37e2cd0637d07f6cb33b9d6ebe6f3df4a96a9964dc4176f286f1cda6e0fc266bfa2df2b13abddabdc5
SSDEEP 192:DRScBz4WKa5G0zv7CMhAPRp2VeQemY93Hsb+WNw8h1I5zl/+mG2y0BfkwVpfU0VK:DRSmz4wxLx8XeYxwBM5/i2y8fswe
TLSH
T1F152B76EB910697B9CFBD219FD25772BD7F11021A1852E88EAFC8B1C14E79CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 48b82bc36cfd647f24f3658d9be8a300faac7327b4fb1ee6d23aa396e40f5cf2
MD5 652050c7854f626cb6e7ad124d833074
SHA1 a7ba8e4c03b6b5e55719e6e209aa2e8eef1120ee
SHA512 4b37ed74d058c353297d40132b91daf270f999e24bba717b3326bc0e96e69ba346a6a08a9a2351d6a7704cec0fe35739502149a92043dcb2bcac55096e61a4d6
SSDEEP 192:DRCIWKa5GE8v7CMpAPRp2u93Hsb+WNnh1dHBfkwVpf50VyIsnAUgtaJ:DRCIw/oxUXZxwTdhfhw8
TLSH
T15842C62EF914653B9CFAD21AF9257B17D7F5102161852E84EAFC8A2C14EB9CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9d08e3868bec05154556e86b5a03bd589ae3ae589e53f2ea077ce9575332f2b7
MD5 f1473755b2cbfb78e78ad8dc7e0cb4f9
SHA1 ec26b34efcffdc3de8d1222bfefe520a3f26c744
SHA512 bf154c934bbfc2c3c06fcd60290e78ca3f82fd902ea88c6baae8d37d5e1231d7353770cd654ae9fb5e2694a6f6de15a50c924f9396ad1a6dfb5c625d677bbaa5
SSDEEP 192:DRScBzIWKa5G08v7CMhAPRp2fsmY93Hsb+WNnh17mG2+BfkwVpf50VyIsnAUgtaJ:DRSmzIwxox8XiYxwTr22fhw8
TLSH
T13F52D76EF910653B9CFBD31AF9257B1BD7F1102161952E88EAFC8A2C14E79CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1d57a6640f33f427843900a0c59fb12b8af69ab13f44c303da10142087fea404
MD5 814e9130ec2022021ef7c128c3f22f4b
SHA1 e102bb1b06de12b2db414e387eea7ce39d1fd607
SHA512 9dd2b61f31383ad370ae4f25a4f99b4dbb7304c321385841b5bf84c2a1819c399be3a5ac686fd3233ac1fbbcc88d12624041fa283854155507575b2583640f75
SSDEEP 192:DRScBzIWKa5G0zv7CMhAPRp2VeQemY93Hsb+WNw8h17mG2gBfkwVpfU0VyIsnAUp:DRSmzIwxLx8XeYxwBr2ofswe
TLSH
T10A52C86EF910697B9CF7D219FD257B1BD7F11021A1852E84EAFC8A2C14E79CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f910911db9d2e8993a8a48ceb32c4b2453cc13b3c04aaa46f18d9679a8c6fe06
MD5 debcb88bcfd22103b66aa4e64148acc0
SHA1 2f9fcfaae05e68d3c71d62048509ff26883feaf1
SHA512 7edc92f7a5ef3277bf10127b77e3961390cf5b30b4e1610de085d720a42c2a7006cb65943770d36f16068c2fb531070d59c9d86d04d15e6d9f8b580fd890f503
TLSH
T1E8B012118002A951C04702B4168604A831545F219707130753E0AE72D8261B14026150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a515.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a515.TMP
Size 96B
SHA256 221ab43f333335f1d2801e58da92f689c99dcf529e5208ed3bdff9767cc1e998
MD5 a17909b56a5f3a0b760e7642842a5326
SHA1 2b0348ebd5392a6fd5981df1c5960ac24fa5b8f9
SHA512 eb14dcc459f0730e363db4e627d0f5913a16f8bae747453a0da10346cabf1c5eefcd4a3414e553383f1d93f76c02654df75d2968df193072db224d4ef739647e
TLSH
T152B02200C002A202C08203B023C280C830A0CF30C203022AE2E0AE32CC20A3800320A2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 f7946dd71131941b08c1ca81b07e4761bc85fd34c1aa6995d7db30ece37bd702
MD5 a2cf401b76ac2902e04270843ef16c83
SHA1 ee7b4636208952dcb9dbb3119f55a83e36890fe8
SHA512 ad6369757d122f2c3fb9f4d681c8f2d0573a9b1098a436c6e699d1f8f2de7620661de86139a5587b1ae56b99c8813b5be321702e8cfa88dc73b31eed064701cf
SSDEEP 3072:gizY9epa3xNBjF/3zGyME8Yj/ZWiJyxy3Qw/xLANk0mUW5GmRntSFCjEENN:gisiazBjBGygyyxyrOk0HOGm/SFyEEv
TLSH
T1BC14127EDE2719E798BC0EA1369E250E4DEA4B4E605ED88CB1CD7308E1D418D0F55EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 1423e453bad78775e99d388c083df1f7082f8c968400efe051e25a330bef1c63
MD5 bfc4ce25cb243756fef5c6c0b5fbd7e4
SHA1 52cb5585d28d988d5a46500068d54b5f5c0e2232
SHA512 dbd1f34687cfffc7fad770d1cb110a880f7ff84f815b50d67aa0f48c029f1baab857e672f9e67905c4c77f55ccd67ba4cdc352afe7641871fb6f732049a9826b
SSDEEP 3072:wizY9epa3xNBjF/3zGyME8Yj/ZWiJyxy3Qw/xLANk0mUW5GmRntSFCjEENN:wisiazBjBGygyyxyrOk0HOGm/SFyEEv
TLSH
T13814127EDE2719E7D8BC0AA1369E250E4DEA4B4E605E988CB1CD7308E1D418D0F55EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 350cdd0837c3b8b5cfea15f99c02b7e30ff3e00216de3cef82b3d4a2149e9daf
MD5 a9345e362efea9ac7ce2abfc21f7147b
SHA1 7eca31ae16fcaee1d4b36934cc1b8d669185a5f0
SHA512 065f42ef0b8f02c810357038b52bdda7d8da0c311dff158615c37a00e8f6947003618d75c71e73057e8720c1eb0c764ee0ce0d24b96e8611b0840687cb771a66
SSDEEP 3072:BzY9epa3xNBjF/3zGyME8Yj/ZWiJyxy3Qw/xLANk0mUW5GmRntSFCjEENN:BsiazBjBGygyyxyrOk0HOGm/SFyEEv
TLSH
T1901413BADE2759E7A47C0AA137AE150E4DAB464D305F9588A2C9730CE1D42CD0FA1F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 213KB
SHA256 e1fab747ec8ee2a66ba59c630949eb72cfe82ce3a26b2dc555d23029477e1dbd
MD5 9a61226bf1d2db2317896b3d3e82ed2a
SHA1 e3c5b22fb976407426efec29bdca6c77e5ef0243
SHA512 b4826ffb3b571f0711edd470d42246ea765bf767d637fb1b56f2091cc63eac854b0c5b40e569dece5a8b42c61244a8df3fe1ebeee5ce8c63b90961f319aede47
SSDEEP 3072:2ksnPQVzY9epa3xNBjF/3zGyME8Yj/ZWiJyxy3Qw/xLANk0mUW5GmRntSFCjEENN:2SVsiazBjBGygyyxyrOk0HOGm/SFyEEv
TLSH
T13424127ACE2609A7A8BC0EA0369F351F4DEB4B4D605A998CB1D8730CB1D518D0F55F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 bc8e2562046d2df4a4630ed623d15d257df600ab9f544e2d913cb63831fa4173
MD5 b0fcc44799ead41f3993ad47cce12bf4
SHA1 46e7ed05f50a592181f1bec88a6408d7a87a8bfb
SHA512 098ac81d38ed68ad376aec12b3db05250dd3144847b14bbe5b030890f1532d70276ed67cd41c02fcc7d0a3f7587c499075f86f4d2b08f3755b36367f34847046
SSDEEP 3072:azY9epa3xNBjF/3zGyME8Yj/ZWiJyxy3Qw/xLANk0mUW5GmRntSFCjEENN:asiazBjBGygyyxyrOk0HOGm/SFyEEv
TLSH
T1C31413BADE2759E7A47C0AA137AE150E4DAB464D305F9588A2C97308E1D42CD0FA1F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 add5ac9d741b96d52d256f062a8fce92bf11d36cff69d36fd48a798a2916b837
MD5 bb9af2ac2a0f73d733fada7ab9eb4f6d
SHA1 dcffbba7ec1551f63cfef4f8a469f5e5a6550e59
SHA512 8eb7b6f9b952935996dbfcbe560797670669ee58485d44f9f5cda78785c82e4d29ce4f336ac9076fcba28f882aac939da2fec08939ce4f8a14766f83a8b49570
SSDEEP 3072:lzY9epa3xNBjF/3zGyME8Yj/ZWiJyxy3Qw/xLANk0mUW5GmRntSFCjEENN:lsiazBjBGygyyxyrOk0HOGm/SFyEEv
TLSH
T1C31413BADE2759E7A47C0AA137AE150E4DAB464D305F9588A2C9730CE1D42CD0FA1F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1b78c91-ed0a-420b-b97c-3dcd4a2e83ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a1b78c91-ed0a-420b-b97c-3dcd4a2e83ca.tmp
Size 89KB
SHA256 50dd92889bfba0d6ec7524fad19800da9904c36a1a56ea9a0db4c04d028a79cd
MD5 e2c56fa2a1d36e88f493952f7a573b27
SHA1 8af7ffe94e90bb018b67525a4fc54e74022200ab
SHA512 28b1285257bb2e92273d5339b8ea71ea2d1ce3e16b0c48ccec39493102682be697b15365bb2d94b72788c091e6579c63192ce482050128b1d1d0dbc70871f34b
SSDEEP 1536:ip/pcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:ap3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1219312BA4E2A46E7997D4A8176AE7909CE12534D705FB9CC325C638C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2nb0efls.riv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2nb0efls.riv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

salinewin1.5.zip.crdownload

Path C:\Users\Admin\Downloads\salinewin1.5.zip.crdownload
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-0-0x00000257EE9D0000-0x00000257EE9E0000-memory.dmp

Download

memory/2776-2-0x00000257EEA50000-0x00000257EEA72000-memory.dmp

Download

memory/2776-1-0x00000257EE9D0000-0x00000257EE9E0000-memory.dmp

Download

memory/2776-12-0x00000257D6620000-0x00000257D662C000-memory.dmp

Download

memory/4300-429-0x00000281278F0000-0x00000281279BD000-memory.dmp

Download

memory/4344-465-0x0000013F29D70000-0x0000013F29E3D000-memory.dmp

Download