salatstealer | hxxp://31[.]77[.]168[.]233[:]5001/kgada[.]exe

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
36s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://31.77.168.233:5001/kgada.exe
Sample260720-tebtfsft8p

Score

10^/10

discovery salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/1440-170-0x0000000000E80000-0x0000000001ACF000-memory.dmp	family_salatstealer
behavioral1/memory/1440-171-0x0000000000E80000-0x0000000001ACF000-memory.dmp	family_salatstealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5232	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
1440	kgada.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000246e8-45.dat	upx
behavioral1/memory/1440-75-0x0000000000E80000-0x0000000001ACF000-memory.dmp	upx
behavioral1/memory/1440-170-0x0000000000E80000-0x0000000001ACF000-memory.dmp	upx
behavioral1/memory/1440-171-0x0000000000E80000-0x0000000001ACF000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kgada.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5232	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290366794614115"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
1440	kgada.exe
1440	kgada.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1536	4760	chrome.exe	86
PID 4760 wrote to memory of 5240	4760	chrome.exe	87
PID 4760 wrote to memory of 5232	4760	chrome.exe	88
PID 4760 wrote to memory of 5240	4760	chrome.exe	87
PID 4760 wrote to memory of 5068	4760	chrome.exe	89
PID 4760 wrote to memory of 5068	4760	chrome.exe	89
PID 4760 wrote to memory of 1308	4760	chrome.exe	91
PID 4760 wrote to memory of 1308	4760	chrome.exe	91
PID 4760 wrote to memory of 1692	4760	chrome.exe	92
PID 4760 wrote to memory of 1692	4760	chrome.exe	92
PID 4760 wrote to memory of 640	4760	chrome.exe	93
PID 4760 wrote to memory of 640	4760	chrome.exe	93
PID 4760 wrote to memory of 5412	4760	chrome.exe	94
PID 4760 wrote to memory of 1376	4760	chrome.exe	100
PID 4760 wrote to memory of 1440	4760	chrome.exe	109

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://31.77.168.233:5001/kgada.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcea44c728,0x7ffcea44c734,0x7ffcea44c740
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,2544496589752608551,12731231823923863754,262144 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,11354289586897565793,5655854252915015601,524288 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,13921621368470426526,18253477667915193211,524288 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,17588959828868621219,11352996498546670034,2097152 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,3945209088569077693,14088435279199307592,2097152 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,4229379963131749986,2224291501811688548,2097152 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,4693502290438976655,5470831016950187923,524288 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,3876960107942020816,15750498081043840545,524288 --field-trial-handle=2000,i,14572471543747128505,9315368595572625531,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1376
- C:\Users\Admin\Downloads\kgada.exe
  "C:\Users\Admin\Downloads\kgada.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a8fce15-242b-4cbf-af21-9eeae88c05fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0a8fce15-242b-4cbf-af21-9eeae88c05fc.tmp
Size 115KB
SHA256 6e5424701887b329c8c27ce3d44fab026a5a71ff5dc112435aaa4779134882d1
MD5 f97be8f0414dc6ca2aad5d62a14be503
SHA1 0bff10e4511c1e2e65da7ca074ec572d373b4820
SHA512 09aba548c0a58a7a7f1824ee040f0a5285c14284257786368c5c44b7a17cbbb1c4959899dbb51070a8e412cbd4736dd80679d6d13edd709914d92f69bf632d7d
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:wm7Rkm1tYpBeh2BAo3
TLSH
T137C3122B5E71A9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 918afc0dad8ace577f5699460f7e323a93aa7468e15bca5fd0a57bcc03b85758
MD5 6e4c67168264ee1bdac005685d11557f
SHA1 a4c6904cf451f1d493fae8288bd82b4466a1fa76
SHA512 e112fc629077b58a1f848ce2ec0807290cc6e544eb030df972dfe3f0be3b3dd2d6bf432d67d545a74dec0ad2d510cd4310baaff7aa095bbf8eec5078c98ad192
TLSH
T17FE02BBEC9A1DC3709FD175DA1514745FA5523177B40459F3A3D89084F7433A4346C9C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e3a143ca9a83ee9555f058a98e4a470c3f925d8883b69d51d1758b174b3e5189
MD5 49ef18bb24971c7ae527d3fd536c88ce
SHA1 6a65b77422cfebac3b710fccf0c48996f712e7f2
SHA512 ea18c963df6f2a55d2aee1fbf9bd651e5b373a88639b8be4a2e8bf656ac072ab7909a9076f155318980e83d924e1d3a482e12fc52a620184ef3684029aca382f
TLSH
T15D319BF793B4997E8610D2E4EA156F2FCE690524131C3CA689D46D1B53F29B2D10038F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 29ccd9aa96002af9ed55a138b402d637653228cf9d7cf2366d68abec023b81b3
MD5 8270308006c9259f4e78a440d1bb6d0a
SHA1 c47d182914bac67ecc4f4aba20782b05463470e0
SHA512 9a24513e1cb63f512f572e6acab157aece3274213d9b5efc0306197fd3db687bc236fd17702abe88d92b77a28b89429d287efd2cf0f4c3b4f64bb77073854a16
TLSH
T1ADF09EE7E279B46361B948EB1E04BC0969B5AC3602419CF0DF6BC2ACE1815F30B12463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ac083ff7e12bf02f9216fb981d315951f83a561c4e162ed19182ea8ec48bd406
MD5 cddba6a033ef0f70b0938f4f67d00ac6
SHA1 1eed56565a42632af772b3e9374bba8e1ab51afe
SHA512 015064bb500422d54bc3c74c997ac17a19361e94905a625323665c34a92cfbc977db454cc837a039a25551c53357e7bef58dfdff73ac25f68d7726408481f1a2
SSDEEP 192:5Rr/A28qSwp4Lv71hpAPRp2g92Hsb+WNnp1PY9D2yK/egHD3ubPyIsnAUge:5Rr/ys6BhUXDQwrPM2lQe
TLSH
T1CA42D62FAA11697B6CDBD22AFD667B57D7F5002525E01E80E6FC8A2C00D76CD222741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 218663345085930c371849339ad0460b3704cc481b1ffcda8d611e2d128603f8
MD5 44489ea13398a3394cf8e399a891da2a
SHA1 2edcecdcc84039110047bba79d549cdce86e0a83
SHA512 f9e1806048535d631716995954e2f854b62b6e030212b90e39059b0d8e06bd4104a57267519a8f007556f9c8aea9bccbafc33472cdcdc0de7dc09057455e7ac0
SSDEEP 192:5Rr/A28qSwp4Nv71hpAPRp2g92Hsb+WNnp1P59D2yK/egHD3uvVyIsnAUge:5Rr/ysYBhUXDQwrPv2l+e
TLSH
T1DC42D62FAA10697B6CDBD22AFD667B53D7F5002525E51E80E6FC8A1C00D76CD222741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 83e0b7912d419934e792492998e6ad45e28a907917573b292477cf6c6b69aef3
MD5 ca537126be24a586fb234444de96a808
SHA1 5e1ee5a51220ef10a7fcc22bdd9c3d6959c56248
SHA512 f05c0a871aff9f144c2d508d2d293b9091d59927de6663e1d8b410512388ded17c3d148a9b3a28f16410b178bb9ca297a66a479a10b856feb6175ba737ce765b
TLSH
T148B01260D4015241C00305B411031C9C730C9F109D0D1B1243E069228835471C524150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588a49.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588a49.TMP
Size 96B
SHA256 9d5952bf6d3c0872e301625c8d7052429d088cbeadf788c889b0dd23bfe0c6f7
MD5 feb6ab508a927d8ab3e77d371981ab2d
SHA1 28ba404facf5d61bfc0918ec18f6c9fab07fdb9f
SHA512 4facb529b7dfaf8f681deb51b8512637755328308f70537247a3141a5d05518a355047e92bf98e7243287211ec9ecc2d525d5f1f0f12d673807374f224c91526
TLSH
T108B02202C002A302C0220BB028B283C832A2CF2ACA030222C2F03A2BCC3223200B2030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d610c093f1185ea730183696f0192048cf79997e62a1f23de0f52d51c97230d0
MD5 50e8e0eef47af6f40217913527596575
SHA1 6bcbd576734254b2d2e4bd61b5af8f881dfd98c0
SHA512 b0535b2f998e3babb8c21b78dd8d102fe58970752488cc2844e0c796a5a8d5f62487931cf04544c97e297370a18cee1aaa71eb5c1b34fefad039801013c9cf28
SSDEEP 3072:UWGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:gm7Rkm1tYpBeh2BAo3
TLSH
T179C3123B5DB5AC375DB9BB5EB08E0B1F1DF249A6C920DE92C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d5837f46e8dcc617a1a0b98f0036aa202b281adb972856309ff3e0422770be73
MD5 b09094a94ab065c3c5df039328c48da3
SHA1 3cbd6aa0c7568441c847c4d4e36547d0debd26ec
SHA512 f3f35c679e55a6df01fd6de1e45e95a005ab485a528204192ad67903a6f7ed3aaedd3c5fe38fb5beaa6daba838157cd0d1b31b080f76061572724c590fb8c7e1
SSDEEP 3072:7WGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:lm7Rkm1tYpBeh2BAo3
TLSH
T1BAC3123B5DB5AC365DB9BB5EB08E0B1F1DF24AA6CD20DE52C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 433587.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 433587.crdownload
Size 3.4MB
SHA256 0f3f573291640f052d0ddfa9a6aa46c240a4dbaaf4f60e71916ee2daa05dfb6b
MD5 a843751cc28ee2096d2b9e0f49e3be3c
SHA1 b29be11e2879eeab1b34d91c46bec528f97425b0
SHA512 389ec564ed2d8ca5a6d23627c9a12eba5031ffb43485cbd878005128c1b4f487448fd2a872eeacb834a2e0c96189cacfad43bfc1b062f6f94294654ed58f6b05
SSDEEP 98304:PUsk6JPAWc6O4umG5quf7ZHHHC7cFGMgwlbrNzly:csTJ4J6O4lYlhHHauRXNzY
TLSH
T124F5333BD8A5C241E1B0673844789BE2AD28BA931C4DA1BDD2724DDB9FD728494C93D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-75-0x0000000000E80000-0x0000000001ACF000-memory.dmp

Download

memory/1440-170-0x0000000000E80000-0x0000000001ACF000-memory.dmp

Download

memory/1440-171-0x0000000000E80000-0x0000000001ACF000-memory.dmp

Download