salatstealer | d4d8f9d25375b02c0bf756f3d9adc3a8ed2170fcfb88d44979400d4d1eecf88d

Resubmissions

09/07/2026, 04:07

260709-epp2hacv6r10

09/07/2026, 03:57

260709-eh545scv4r10

Analysis

user interaction
yes
max time kernel
210s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TgWsProxy_windows_10_64bit.exe
Size 3.4MB
Sample260709-epp2hacv6r
SHA256 d4d8f9d25375b02c0bf756f3d9adc3a8ed2170fcfb88d44979400d4d1eecf88d
MD5 3f2f2f591fb3dfc0ac6b5dbb793ffb73
SHA1 bbf2a67ab5f845e68b266b561b31627edda83ea7
SHA512 0d671fb568955a13e68dca58476eaf07735b1e6e93958f349e19a9f5da2807cbf1c0aa9a4ebe6e34a81808222128944a015a93bed2c1372eec50166f6b844b1f
SSDEEP 98304:s66HgsWpF6ANjcp/f86v9toDTL2l2vHvjqW7ZpzK:sfIpBNqf3ETLrmW7m
TLSH
T10CF5333710289CADD5B50CB3A33489BE6349DD76CF308EB2363996D10A868095DBDD9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 25 IoCs

resource	yara_rule
behavioral1/memory/1768-1-0x0000000000130000-0x0000000000D86000-memory.dmp	family_salatstealer
behavioral1/memory/1768-2-0x0000000000130000-0x0000000000D86000-memory.dmp	family_salatstealer
behavioral1/memory/1768-3-0x0000000000130000-0x0000000000D86000-memory.dmp	family_salatstealer
behavioral1/memory/1768-57-0x0000000000130000-0x0000000000D86000-memory.dmp	family_salatstealer
behavioral1/memory/3296-79-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-80-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-225-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/1672-405-0x00000000003F0000-0x0000000001046000-memory.dmp	family_salatstealer
behavioral1/memory/5548-451-0x00000000003B0000-0x0000000001006000-memory.dmp	family_salatstealer
behavioral1/memory/3296-534-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-564-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-570-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-587-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-609-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-628-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-643-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/5244-653-0x0000000000180000-0x0000000000DD6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-670-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/5648-680-0x0000000000C30000-0x0000000001886000-memory.dmp	family_salatstealer
behavioral1/memory/3296-681-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-685-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-702-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-703-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-704-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer
behavioral1/memory/3296-705-0x0000000000F70000-0x0000000001BC6000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
111	4740	powershell.exe
112	4740	powershell.exe
113	4740	powershell.exe
114	4740	powershell.exe
115	4740	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
140	2880	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
3296	TrustedInstaller.exe
1672	TrustedInstaller.exe
5548	TrustedInstaller.exe
5244	TgWsProxy_windows_10_64bit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1768-0-0x0000000000130000-0x0000000000D86000-memory.dmp	upx
behavioral1/memory/1768-1-0x0000000000130000-0x0000000000D86000-memory.dmp	upx
behavioral1/memory/1768-2-0x0000000000130000-0x0000000000D86000-memory.dmp	upx
behavioral1/memory/1768-3-0x0000000000130000-0x0000000000D86000-memory.dmp	upx
behavioral1/memory/1768-57-0x0000000000130000-0x0000000000D86000-memory.dmp	upx
behavioral1/files/0x0007000000024405-56.dat	upx
behavioral1/memory/3296-58-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-79-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-80-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-225-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/1672-232-0x00000000003F0000-0x0000000001046000-memory.dmp	upx
behavioral1/memory/1672-405-0x00000000003F0000-0x0000000001046000-memory.dmp	upx
behavioral1/memory/5548-446-0x00000000003B0000-0x0000000001006000-memory.dmp	upx
behavioral1/memory/5548-451-0x00000000003B0000-0x0000000001006000-memory.dmp	upx
behavioral1/memory/3296-534-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-564-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-570-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-587-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-609-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-628-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-643-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/5244-652-0x0000000000180000-0x0000000000DD6000-memory.dmp	upx
behavioral1/memory/5244-653-0x0000000000180000-0x0000000000DD6000-memory.dmp	upx
behavioral1/memory/3296-670-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/5648-679-0x0000000000C30000-0x0000000001886000-memory.dmp	upx
behavioral1/memory/5648-680-0x0000000000C30000-0x0000000001886000-memory.dmp	upx
behavioral1/memory/3296-681-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-685-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-702-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-703-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-704-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx
behavioral1/memory/3296-705-0x0000000000F70000-0x0000000001BC6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\taskhostw.exe	TgWsProxy_windows_10_64bit.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\TrustedInstaller.exe	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\TrustedInstaller.exe	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Google\49ec53c1-b762-b775-d00a-64e7440bc1b7	TgWsProxy_windows_10_64bit.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrustedInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrustedInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TgWsProxy_windows_10_64bit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TgWsProxy_windows_10_64bit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TgWsProxy_windows_10_64bit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrustedInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2880	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280436947540577"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2280	chrome.exe
2280	chrome.exe
1768	TgWsProxy_windows_10_64bit.exe
1768	TgWsProxy_windows_10_64bit.exe
1768	TgWsProxy_windows_10_64bit.exe
1768	TgWsProxy_windows_10_64bit.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe
3296	TrustedInstaller.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3296	TrustedInstaller.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3764	2280	chrome.exe	93
PID 2280 wrote to memory of 2880	2280	chrome.exe	94
PID 2280 wrote to memory of 564	2280	chrome.exe	95
PID 2280 wrote to memory of 564	2280	chrome.exe	95
PID 2280 wrote to memory of 4360	2280	chrome.exe	96
PID 2280 wrote to memory of 4360	2280	chrome.exe	96
PID 2280 wrote to memory of 1776	2280	chrome.exe	97
PID 2280 wrote to memory of 5068	2280	chrome.exe	98
PID 2280 wrote to memory of 1776	2280	chrome.exe	97
PID 2280 wrote to memory of 5068	2280	chrome.exe	98
PID 2280 wrote to memory of 8	2280	chrome.exe	100
PID 2280 wrote to memory of 8	2280	chrome.exe	100
PID 2280 wrote to memory of 3936	2280	chrome.exe	101
PID 2280 wrote to memory of 3936	2280	chrome.exe	101
PID 2280 wrote to memory of 3912	2280	chrome.exe	103
PID 1768 wrote to memory of 3296	1768	TgWsProxy_windows_10_64bit.exe	107
PID 2280 wrote to memory of 3384	2280	chrome.exe	109
PID 2280 wrote to memory of 3384	2280	chrome.exe	109
PID 2280 wrote to memory of 1932	2280	chrome.exe	110
PID 2280 wrote to memory of 1932	2280	chrome.exe	110
PID 3296 wrote to memory of 4740	3296	TrustedInstaller.exe	111
PID 3296 wrote to memory of 1672	3296	TrustedInstaller.exe	113
PID 2280 wrote to memory of 948	2280	chrome.exe	114
PID 2280 wrote to memory of 1480	2280	chrome.exe	115
PID 2280 wrote to memory of 2848	2280	chrome.exe	116
PID 3296 wrote to memory of 5548	3296	TrustedInstaller.exe	119
PID 4740 wrote to memory of 6088	4740	powershell.exe	121
PID 2280 wrote to memory of 5304	2280	chrome.exe	122
PID 2280 wrote to memory of 5244	2280	chrome.exe	123
PID 2280 wrote to memory of 5612	2280	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_10_64bit.exe
"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_10_64bit.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Comms\TrustedInstaller.exe
  C:\Users\Admin\AppData\Local\Comms\TrustedInstaller.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\ReAgentc.exe
      "C:\Windows\system32\ReAgentc.exe" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:6088
- - C:\Program Files\Google\Chrome\Application\TrustedInstaller.exe
    "C:\Program Files\Google\Chrome\Application\TrustedInstaller.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\TrustedInstaller.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\TrustedInstaller.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe4c1dc728,0x7ffe4c1dc734,0x7ffe4c1dc740
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,11695155274754418246,12425497916147873566,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,5827852978351145777,821475953933294035,262144 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,10429454410027236588,10230777903699484109,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,17877863724835330888,1400148608714331988,2097152 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,12488709709144854238,2431258547036065545,2097152 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3948,i,2549137607448388913,16379791027834868918,2097152 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,5075709853590866109,6547504992519344741,2097152 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,4644361346467739001,937805307786039681,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,9363269054498041610,10892604314475416572,2097152 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4888,i,12168952063047896388,963089323572690640,2097152 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,7851641267839075991,5569429378198000166,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,14802524244518192806,3973380656184547194,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3276,i,16991268535803398965,9272590705290414340,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,899579864708008467,15850670412185911538,524288 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5304
- C:\Users\Admin\Downloads\TgWsProxy_windows_10_64bit.exe
  "C:\Users\Admin\Downloads\TgWsProxy_windows_10_64bit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6152,i,11606405109076809890,15960013800800260805,262144 --field-trial-handle=2060,i,12243578894816465165,13580239637114457973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:5612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5616

C:\Users\Admin\Desktop\TgWsProxy_windows_10_64bit.exe
"C:\Users\Admin\Desktop\TgWsProxy_windows_10_64bit.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TrustedInstaller.exe

Path C:\Users\Admin\AppData\Local\Comms\TrustedInstaller.exe
Size 3.4MB
SHA256 d4d8f9d25375b02c0bf756f3d9adc3a8ed2170fcfb88d44979400d4d1eecf88d
MD5 3f2f2f591fb3dfc0ac6b5dbb793ffb73
SHA1 bbf2a67ab5f845e68b266b561b31627edda83ea7
SHA512 0d671fb568955a13e68dca58476eaf07735b1e6e93958f349e19a9f5da2807cbf1c0aa9a4ebe6e34a81808222128944a015a93bed2c1372eec50166f6b844b1f
SSDEEP 98304:s66HgsWpF6ANjcp/f86v9toDTL2l2vHvjqW7ZpzK:sfIpBNqf3ETLrmW7m
TLSH
T10CF5333710289CADD5B50CB3A33489BE6349DD76CF308EB2363996D10A868095DBDD9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6790e7cce7a7b4134098ba0dabe6a0b78401f788a425c5d0c04493f1944692ea
MD5 47bef59ec7ca11ab8d7b3ee9f536aa6c
SHA1 8e502786f5bf64ef1b203974c1c3c532aa0ac61e
SHA512 588dce7ebbacecd6fd1867310d989be8e5384f8b9fc22dbad76154584ee042f7c7ba4bf2c108257c2b55242f49431fe5fd4e5066fbe87370ca11a4d45de5ea0b
TLSH
T1F2E02BA5C862DC2B28F90718B01057C5D754135B2A81D94B7F3DC10C8FB16364986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9db528a26df8ab516634f1da6f801d2da11561d0e577dce328ec13a85995d578
MD5 1b193a5287787b3c218b8dbc5b2dfa76
SHA1 f578c674e9b24c1a0eca98af94e27900d3abdfe0
SHA512 944a761714a35b6feea8041ec6fef08eed63cea012f7c9fd4394dcdb9ca749e1fb86d868d6859a672d06409247c4635117c1b3a9c2d24a11c7895377a9bd21ab
TLSH
T1E9716E11427B4EEACBE7C2B8ABE70C963631459B88833A36050CFBB91706BCCD301D15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d1751a329a304b8748d7ce41d0dc445899e328ca156d11b15e30ffc4e9f41b1b
MD5 904097e80d0ac609d6e921c3f2e071eb
SHA1 e35778542b0bd86a097ef132eb7e90f6600af3dd
SHA512 f57f10228d65ceb42af6cefeb2d405464629111e0134b9adaf56c09c3cd56545d46e3e4ffdd640743e3639a073f9696dc8d6d9d83efb5aaad049f5220b4d1b31
TLSH
T1DA716E11427B4DEACBE7C1B8ABE70C9A3631419B88833A36114DFBB91706BCCD311D15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef0f29cee8bd03d55fb01339d276125b983f6fc40a1b1846935b286f22923828
MD5 33abdfa2b022331579f515125aae6f37
SHA1 937a6aacd4d386937f2f0e699146635b910fa825
SHA512 affb8ecba4ff6b1061fb59ead5d2b7bb2c7c51ac5460393ac9b27975709b9c60a50cab42f15788d5cf1286c72526a80e6b96e39b9271a121f1b33f6072d0dd8c
TLSH
T179716E11427B4DEACBE7C2B8ABE70C963631819B88833A36010CFBB91706BCCC301D15
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 2b9d7b11403b3c8af4745c1784ef2cbe47c27260dbe7e84888c71e8097c78cca
MD5 56ccbc25749481084f0c1d668190f166
SHA1 065855ea63289ad1da7ba0e6112c8a193c023d04
SHA512 2a38a48b7d34e6d156a1fbdac55ae5da3d186e1c94511e9a4cef97656134a65c77eda1e7a4daf19656482b7f56196cdab326884b286061e42df0bc292c83e49a
SSDEEP 96:XPareMaZ5tHmHSeqHAeFc7cvnoJsd7e8pc:XParLaZzmMRKHJGZ6
TLSH
T12E92C59E0F102495C4B98D75CCD4449A2E3D011CE313FEEC6E56C4B288F1A9BF256229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5b28f6835357582d0289f7b253b9c427156594b5b807a0991091e410aac42c33
MD5 790011c7af6e24b364f74ca00bc68b28
SHA1 bdd9ea7bc1cefd875a95af14b7d5ebd531cc0b69
SHA512 6eb6bfcce138b2532e275c072f763811f26bd23919639c4a74cf08a71f8a1a46dc4b6e650c8aa5ecfd546028bd7b82244b2bec9f83fe0303f81afe0e8fb1a8a1
TLSH
T11081C0F387E4856D8A1256F4EB15AE1FCE290614431D3C66C8E4BE5BA3E2872D21138F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ea8bf18957802d302b29d79b119876633d2644f8870126cf6df7ea9445211b62
MD5 1a961b398914a74bbed59f772979716e
SHA1 35959cdf6c21f144b8ef8f947e53ef250b1fdf39
SHA512 e4a25d792ee156780d55af5660359e8a0134508cc4018f09971c951d19250fb0adf7785206f08390a3c0bc34692721918298dfabe63b8696ea21ca69c66333df
SSDEEP 96:DzkmvmKgUOaIMXcqaFmjQHmO+mrmumD0xomH:DzkmvmXhaIMXcqaFmjQHmzmrmumD0xo0
TLSH
T1B7A1C1F787E4856D891256F4EA15AE1FCE3D0924431D3C66C8E4BE5BA3F2872D21138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 47f5073fd0c824fef42274b7cefb838c45612df9fd5585fa07b78b20476c6a69
MD5 a2da1afd743df1f78d79ec47ab66385a
SHA1 8795fe4e684a047d8084ed5e06c09fbe9e53acc7
SHA512 e1d80afae0cc438f6545f33108fdb1c60eeecb7841a26541c552a367a361887ea75b5993e9105f39ba69c17c19d98b984539a5306e64965b7c7523e535533c20
SSDEEP 192:yRFHCj/CWBv5v70hVPRp9d4BW9+Hsb+WNn+1v/sYhYFHr2S/aieca5VyIsnAUgrK:yRFHGq+ZgDXt8wEcYmFL26ade
TLSH
T18E52C52ABA10697BADDFC215FD12B757D3F6202125912E44EBFC8A1C1AE76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5f0b655f66f587fb14efad809260fbf35a5fe6cb1bf869715f4e7672c1ae4e46
MD5 0a765861330df3e7bcd2cb8a6e781aaa
SHA1 4abfe6fe5dd12d7b0d9bb3164465ca72e7de1e57
SHA512 47463712ad8b95f4e5003a8377976c0a9a2df212f3debe000b98e5d1f140ae755ad11394f5700a44db1cd54d06474b548ef4834793cbcb2196ae41adbf8c22aa
SSDEEP 192:yRFrCj/CWBviv70hVPRp9d4BW9+Hsb+WNn+1v/sYhYFHr2S/aieca5VyIsnAUgrK:yRFrGq+ugDXt8wEcYmFL26ade
TLSH
T12A52C52ABA106D3BADDFC215FD52B757D3F6202125912E44EBFC8A1C1AE76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5ed4811bbe9e294289b7bdfea030e6e83d38785001c5f1d323e4d53aa2f274a3
MD5 45968285ba6e2b6c5814402e2fb83c67
SHA1 e27b3b4c91d2a20a879df2a5c55a10d808aa55e5
SHA512 5ec8a8c30730eff3f894c0b2caaa469c625905a97af5057d6d710c2781068732c4a708a3bdc1b3ffc80548a9073cc739a600a73b2ffd59b47303bcf6c9dbe47c
SSDEEP 192:yRFHCj/CWBvWv70hAPRp2dj9+Hsb+WNn+10sYFHr2S/aiecaDVyIsnAUgtaJ:yRFHGq+ig8X68wE0hFL26ar8
TLSH
T13B42B62EAE10693B6CDFC219FD527757D7F6102125952E44EBFC8A1C1AE76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b6b4111a041c98cb3ddbe829f634223bd177a359c675cc2c7f2a8349ce58b055
MD5 1aed8a2b3448eb479d5b2d76ea6181be
SHA1 248a8efbad7b42355770c0b86b1e1c621190678a
SHA512 3a33ee70b92cf6eb23c84f21d6bd324f9d69889b2759931d8c236a3381cfb2c95eb48476694c8b4fb15fa717229db621829e2a5c7da6a42faa979b4af9afc253
SSDEEP 192:yRirCj/CWBviv70hVPRp9d4BW9+Hsb+WNn+1v/sYhYFHr2S/aieca5VyIsnAUgrK:yRirGq+ugDXt8wEcYmFL26ade
TLSH
T14552C52ABE106D3BADDFD215F912B757D3F2202125912E44EBFC8A1C16E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f3295a977f6aac90ef05139c1eb7d55bab3958190b974c07bd2bad28562dc0f1
MD5 2430f71f4d4687e948713acedaca32ae
SHA1 7538f1972b37318cd7de03007481fdeb1ea6d0a1
SHA512 40efbb24f17afc55b5c3b013ac571dec81438db9f86f82f30a90cb8c340898bc00d4883c14cdfb62de75f96814f58e9e3fdd20f969d5e99f749cfe42e5cdad0d
SSDEEP 192:yRFHCj/CWBTWv70pAPRp2dj9+Hsb+WNn+10sYFHr2S/aiecaDVyIsnAUgtaJ:yRFHGq8igUX68wE0hFL26ar8
TLSH
T1E242A62EAE10693B6CDFD219FD627753D7F6102125952E44EBFC8A1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6fbb06cd868107f22bb6f62ca7af49f66cb64a2701391be9f52fc3f1b1beee46
MD5 3129b2de0ff7571960e2736241387517
SHA1 3fdfb2a0a61e9bd8b971f0fe56207b0a949dd267
SHA512 67f43a2098c48414f7cf06f864acf04fe8d2b282094e57cf50e7bfc05155b5978d4dde1c8ed8b7c99e1ac2573024ba3bff882260d2e6990aa74d4d45ff6427b3
TLSH
T142B01260C4035141C41202F4114694C8712C9F22AB0E270183E07A6688351508038050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59389a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59389a.TMP
Size 96B
SHA256 d5dd63835961e08adf906b39060bf378cbf55fcac50abdef4acf68c11ae2f6de
MD5 ce3c842188ebabaefd7e2c4a4791a55c
SHA1 ff95987ed6fbc67255b707f8f7da15eb56f24d58
SHA512 8ccf305ff77a88ecd25d0eabaa8ad1d339ec73305c453c24b39481b21fbfa78ba68aa0f5b7c5ea865eb90d71d5c8e1001aacba2b64fa38b0607e78171fa81a24
TLSH
T1D2B002B5C113F217C04207B02B9D95D97169DF36EE072237D6E01A66DC356628926661
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 89fc93fb37b751ec5081737bcc0e6c3928e35d442bcddc59699bdd9dd2fdcc11
MD5 11cd6cc2f7203ddbecb4b66bacdd4906
SHA1 897d80a57d6eb19ab567d36ccc219809c4afbea0
SHA512 fb4fa49b2accb24de8fd6e42aab3ee169e298ee56f90f436a9019ea4b4b2bd64643b2ef07710ea497d4f8bb928ec0a27aff3698e1f82d4bcc1ae25e0ecde478a
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OO/RVumGne5:1nbZeMrv/hGtO4ne5
TLSH
T16ED3A94B3A743006DDE68A722CE051BB5E3C716D8F55A5D528B620588EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 be3813150f996b9156bf3a32aef094d44021d7230c469b005328fee6a830b894
MD5 3b87422827245bd89aded53e6f4d5067
SHA1 25aa3d93add8e4bb02296239d7158e599e2ade85
SHA512 f501c355677390defcd10a59f9d89c66a6941019537a30f5ab63ec3bd391bc53ea56bf3a3639aebec5b88074f1734a95e85cb8f7ecef11b6f884046c4545d5e7
SSDEEP 3072:+URcyfUarm0rgJRBe3XdI7qnPtyvXDpa1GGqfd7NtZL8cHQRZEQ6Sps+:BcKUIgXsnK7utyfN4qZ/ZLW3Ex+
TLSH
T1BD3422B3FB961F329CC68F34BBA34F9E9574D0D2A538C2017ABE319B49D58529506C2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 5f2799a036c05198577cefe80004c638f9a55ab3b66908f6b72e7e8fba46880c
MD5 da4ca2428d797aaaec2ba0e3b15e4483
SHA1 1c1fc9684e4a146a690e0244515d30457246ddb5
SHA512 d1ae41df5cc5c32148f83e8a4120970e9f0bb9f3cdd057df1e936d1f9a4134b6dde4aff020afa1facddf4491cea9169193e00d59dfc2b83c7ae5c7a25e720d70
SSDEEP 3072:PqKRcyfUarm0rgJRBe3XdI7qnPtyvXDpa1GGqfd7NtZL8cHQRZEQ6Sps+:SgcKUIgXsnK7utyfN4qZ/ZLW3Ex+
TLSH
T1FD341273FB961F325CC68F34BB934F9E9DB4D0C39A38C6057AB9319B48D54529906C28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b3e417bd30c60716eda8d18400797d9d88e3dd91a9f943861b6cbc9c7009935f
MD5 caa535a6e3566e0af84a8fe6d15be34c
SHA1 93ca043dd21545ce2cd092822d499a3e9ba6c68d
SHA512 27f686ce8d41a17f8aba5482f967ccb372558a57b6e8d0a21e2186461944b6ddfa1fb16552786c2a3083969cf7449e21a9aa8a659790be23f6212a2e7008ff70
SSDEEP 1536:bgLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:8qfd7NtZL8cHQRZEQ6Sps3
TLSH
T11EC30237EBC21F339D92CF64B9134FDA57B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f0f000c99f3c115852a1ab8ac17d0716c13bcf93af93b2795374e32360776551
MD5 a6940c31e9ea5939a5e32a7d1b6480b1
SHA1 5dab35eb60aa02ee9480ca9c087207f5cc98edc4
SHA512 6eb2ef74d539270376e4a7c54d2df220b487d9cdf840a3f964c9424feb77d395fadcbcb3ce59db55e814ae998de607bd51b4de1ea001da2ab08dfc8ae59bd817
SSDEEP 3072:3URcyfUarm0rgJRBe3XdI7qnPtyvXDpa1GGqfd7NtZL8cHQRZEQ6Sps+:GcKUIgXsnK7utyfN4qZ/ZLW3Ex+
TLSH
T158342273FB961F329CC68F34BBA34F9E9574D0D2A538C2017ABE319B49D58529506C2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2pstw2wo.azl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pstw2wo.azl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-232-0x00000000003F0000-0x0000000001046000-memory.dmp

Download

memory/1672-405-0x00000000003F0000-0x0000000001046000-memory.dmp

Download

memory/1768-57-0x0000000000130000-0x0000000000D86000-memory.dmp

Download

memory/1768-1-0x0000000000130000-0x0000000000D86000-memory.dmp

Download

memory/1768-0-0x0000000000130000-0x0000000000D86000-memory.dmp

Download

memory/1768-2-0x0000000000130000-0x0000000000D86000-memory.dmp

Download

memory/1768-3-0x0000000000130000-0x0000000000D86000-memory.dmp

Download

memory/3296-685-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-628-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-643-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-564-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-670-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-704-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-703-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-681-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-58-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-702-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-79-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-80-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-609-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-225-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-534-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-705-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-587-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/3296-570-0x0000000000F70000-0x0000000001BC6000-memory.dmp

Download

memory/4740-235-0x0000000005500000-0x0000000005522000-memory.dmp

Download

memory/4740-471-0x0000000007A90000-0x0000000007B33000-memory.dmp

Download

memory/4740-548-0x0000000008990000-0x0000000008F34000-memory.dmp

Download

memory/4740-238-0x0000000005F40000-0x0000000006294000-memory.dmp

Download

memory/4740-542-0x0000000007C30000-0x0000000007C38000-memory.dmp

Download

memory/4740-234-0x0000000005830000-0x0000000005E58000-memory.dmp

Download

memory/4740-541-0x0000000007C60000-0x0000000007C7A000-memory.dmp

Download

memory/4740-233-0x0000000002B80000-0x0000000002BB6000-memory.dmp

Download

memory/4740-540-0x0000000007C00000-0x0000000007C14000-memory.dmp

Download

memory/4740-539-0x0000000007BF0000-0x0000000007BFE000-memory.dmp

Download

memory/4740-476-0x0000000007BC0000-0x0000000007BD1000-memory.dmp

Download

memory/4740-461-0x0000000070B60000-0x0000000070BAC000-memory.dmp

Download

memory/4740-473-0x0000000008340000-0x00000000083D6000-memory.dmp

Download

memory/4740-462-0x0000000071300000-0x0000000071654000-memory.dmp

Download

memory/4740-470-0x0000000007A70000-0x0000000007A8E000-memory.dmp

Download

memory/4740-547-0x0000000007C60000-0x0000000007C82000-memory.dmp

Download

memory/4740-472-0x0000000007B90000-0x0000000007B9A000-memory.dmp

Download

memory/4740-403-0x0000000006530000-0x000000000657C000-memory.dmp

Download

memory/4740-390-0x0000000006460000-0x000000000647E000-memory.dmp

Download

memory/4740-460-0x0000000007A30000-0x0000000007A62000-memory.dmp

Download

memory/4740-236-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/4740-448-0x0000000007CC0000-0x000000000833A000-memory.dmp

Download

memory/4740-449-0x0000000007660000-0x000000000767A000-memory.dmp

Download

memory/4740-237-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Download

memory/4740-420-0x0000000006A10000-0x0000000006A54000-memory.dmp

Download

memory/4740-447-0x00000000075C0000-0x0000000007636000-memory.dmp

Download

memory/5244-653-0x0000000000180000-0x0000000000DD6000-memory.dmp

Download

memory/5244-652-0x0000000000180000-0x0000000000DD6000-memory.dmp

Download

memory/5548-446-0x00000000003B0000-0x0000000001006000-memory.dmp

Download

memory/5548-451-0x00000000003B0000-0x0000000001006000-memory.dmp

Download

memory/5648-680-0x0000000000C30000-0x0000000001886000-memory.dmp

Download

memory/5648-679-0x0000000000C30000-0x0000000001886000-memory.dmp

Download