salatstealer | f1afbc7c73f92140ebf00708d39bd73060bf5c32a7ec48d2c3f167bfe660c779

Analysis

user interaction
yes
max time kernel
199s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NerestPCFIX.exe
Size 3.4MB
Sample260819-ssh91sdk31
SHA256 f1afbc7c73f92140ebf00708d39bd73060bf5c32a7ec48d2c3f167bfe660c779
MD5 a909f680456b92fca321297f082d22e6
SHA1 398a8e07e756289a4e1dbed201602050901410ec
SHA512 0440e5285768a94e26d3e8b65bf0cce2f7dad876c0e0c13b8a43dab262b8f191bad4817ae259f28e51a17efc602a0307fac3483691b2f5af72e2ccf1267db61a
SSDEEP 98304:or+18PgOzBYWiQtqkepdn3lKHnk2LCc7Numhv:NxK6o0n3lsn3Z7Nth
TLSH
T116F5333C370AE81DEB941A73E7F42788D33E521C93243D67A7BB961611C8A8634BE54D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 19 IoCs

resource	yara_rule
behavioral1/memory/4348-2-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/4348-3-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/4348-4-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/4348-71-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/4348-94-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/4348-109-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/4464-135-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-155-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4492-199-0x0000000000E70000-0x0000000001AC5000-memory.dmp	family_salatstealer
behavioral1/memory/4464-218-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/2788-220-0x0000000000020000-0x0000000000C75000-memory.dmp	family_salatstealer
behavioral1/memory/4464-369-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-370-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-371-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-372-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-373-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-374-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-375-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral1/memory/4464-376-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
4464	dwm.exe
4492	dwm.exe
2788	dwm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4348-0-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/4348-2-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/4348-3-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/4348-4-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/4348-71-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/4348-94-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/files/0x000300000000072f-107.dat	upx
behavioral1/memory/4464-110-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4348-109-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/4464-135-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-155-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4492-183-0x0000000000E70000-0x0000000001AC5000-memory.dmp	upx
behavioral1/memory/4492-199-0x0000000000E70000-0x0000000001AC5000-memory.dmp	upx
behavioral1/memory/2788-207-0x0000000000020000-0x0000000000C75000-memory.dmp	upx
behavioral1/memory/4464-218-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/2788-220-0x0000000000020000-0x0000000000C75000-memory.dmp	upx
behavioral1/memory/4464-369-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-370-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-371-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-372-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-373-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-374-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-375-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral1/memory/4464-376-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\c768c6af-5aa2-5366-9f40-825e3fbfaf5a	NerestPCFIX.exe
File opened for modification	C:\Program Files (x86)\Common Files\smss.exe	NerestPCFIX.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe	dwm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dwm.exe	dwm.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NerestPCFIX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1188	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316266643695173"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4348	NerestPCFIX.exe
4348	NerestPCFIX.exe
2300	chrome.exe
2300	chrome.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4348	NerestPCFIX.exe
4348	NerestPCFIX.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
2300	chrome.exe
2300	chrome.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4464	dwm.exe
4464	dwm.exe
4496	taskmgr.exe
4464	dwm.exe
4464	dwm.exe
4496	taskmgr.exe
4856	powershell.exe
4856	powershell.exe
4856	powershell.exe
4496	taskmgr.exe
4496	taskmgr.exe
4464	dwm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeDebugPrivilege	4496	taskmgr.exe
Token: SeSystemProfilePrivilege	4496	taskmgr.exe
Token: SeCreateGlobalPrivilege	4496	taskmgr.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe
Token: SeCreatePagefilePrivilege	2300	chrome.exe
Token: SeShutdownPrivilege	2300	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
2300	chrome.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe
4496	taskmgr.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1356	2300	chrome.exe	92
PID 2300 wrote to memory of 5104	2300	chrome.exe	93
PID 2300 wrote to memory of 5104	2300	chrome.exe	93
PID 2300 wrote to memory of 1188	2300	chrome.exe	94
PID 2300 wrote to memory of 4472	2300	chrome.exe	95
PID 2300 wrote to memory of 4472	2300	chrome.exe	95
PID 2300 wrote to memory of 3604	2300	chrome.exe	96
PID 2300 wrote to memory of 4492	2300	chrome.exe	97
PID 2300 wrote to memory of 3604	2300	chrome.exe	96
PID 2300 wrote to memory of 4492	2300	chrome.exe	97
PID 2300 wrote to memory of 3336	2300	chrome.exe	99
PID 2300 wrote to memory of 3336	2300	chrome.exe	99
PID 2300 wrote to memory of 1864	2300	chrome.exe	100
PID 2300 wrote to memory of 1864	2300	chrome.exe	100
PID 2300 wrote to memory of 2436	2300	chrome.exe	101
PID 2300 wrote to memory of 3684	2300	chrome.exe	103
PID 2300 wrote to memory of 3684	2300	chrome.exe	103
PID 2300 wrote to memory of 4644	2300	chrome.exe	111
PID 2300 wrote to memory of 3964	2300	chrome.exe	112
PID 2300 wrote to memory of 3948	2300	chrome.exe	113
PID 4348 wrote to memory of 4464	4348	NerestPCFIX.exe	114
PID 4464 wrote to memory of 4856	4464	dwm.exe	115
PID 4464 wrote to memory of 4492	4464	dwm.exe	117
PID 4464 wrote to memory of 2788	4464	dwm.exe	119

C:\Users\Admin\AppData\Local\Temp\NerestPCFIX.exe
"C:\Users\Admin\AppData\Local\Temp\NerestPCFIX.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Adobe\dwm.exe
  C:\Users\Admin\AppData\Local\Adobe\dwm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Program Files\Google\Chrome\Application\dwm.exe
    "C:\Program Files\Google\Chrome\Application\dwm.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb740dc728,0x7ffb740dc734,0x7ffb740dc740
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,3543140858777502162,5692762862074636396,262144 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,17464158160442883779,15946445787585043184,524288 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,10039063549357430664,6638374290496651523,524288 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,11386980520599736348,272626834959146358,2097152 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,8147339772553187197,4678808179333791172,2097152 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,14899566880900320402,11367193861561132606,2097152 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,14161365044828190653,14141878862381095922,2097152 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,719201484509883823,11391927279791470589,524288 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,10380088121453868553,5376863017303089710,2097152 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,5625100597591772101,16782021837967609689,524288 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,15688609458055197159,4742457376609161520,524288 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,6239815605379573608,17408236304053928783,524288 --field-trial-handle=2036,i,7548818406510647577,8941439544718314616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:836

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Users\Admin\AppData\Local\Adobe\dwm.exe
Size 3.4MB
SHA256 f1afbc7c73f92140ebf00708d39bd73060bf5c32a7ec48d2c3f167bfe660c779
MD5 a909f680456b92fca321297f082d22e6
SHA1 398a8e07e756289a4e1dbed201602050901410ec
SHA512 0440e5285768a94e26d3e8b65bf0cce2f7dad876c0e0c13b8a43dab262b8f191bad4817ae259f28e51a17efc602a0307fac3483691b2f5af72e2ccf1267db61a
SSDEEP 98304:or+18PgOzBYWiQtqkepdn3lKHnk2LCc7Numhv:NxK6o0n3lsn3Z7Nth
TLSH
T116F5333C370AE81DEB941A73E7F42788D33E521C93243D67A7BB961611C8A8634BE54D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 05aa3f4954be6a83bb2800f59636e18de90ab29ad41b4f6c5d53e72ccd17691e
MD5 3ba0e2f193d5210dfd582bc9f8d4ec9f
SHA1 79c03ebd937b0114e119625244f40476e3c24028
SHA512 6e3bf3ef9f0bf74c56681fbfb220e3ee40b1212c8246020e729575d8d4e842faf831a8fd6fbacec74a8e6f9380ec70a6d4c89c7142343e99e970717dffa688c8
TLSH
T1AAE022A6CC61AC372CFD075C60954B46EB55131B2EC2891F3A3CC21C8FB163A4196C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d50860d8cfe4251d60bff28a05f8ea863ff8e0caff3911238c13c83fbff774d7
MD5 a6763094a1f3241b4b2ae27776cf20eb
SHA1 637305180092f90c8ca11bc925878ba0799b966a
SHA512 23c390bcf881aeab1a4f46f9a8b9c511d2f2c9e7e946eead64fdb93d1073a10eef2c1c3e096716cd9ccedf8c5153079c5a9d0db0b35d20cfdfa1920d963a7a85
TLSH
T145C0121D135A2132C79C1631306100A127F449F909DA669AC5D03DCA6C63BF1C402F01
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 19f07080b56c3adcf01545fcd6a9140fc391648f88f7049f5d79be3b6a4256f9
MD5 68f2c86adf2fd01eda6417a58f31a387
SHA1 d23867fffa84a381faeff2a54cfd5f14c4c076e9
SHA512 084528ee105bd8f2f958a2a6bd37c3c64916c13842740e03b1cf84386d84024f0c093f70d2c2ff251a36ec23b1fd72ef7abe1f27ecd7f5baab4ae8e57af0d6dd
SSDEEP 3:MsEllllkEthXllkl2zE/liC65Xl:/M/xT02zjC65Xl
TLSH
T11F4402086B800406C50112345062C3502376D45006125B47245218725C856C01C00200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 a59ceac26901de6faf3e25a88cefb720d1e9d52b4f8475a2c0e90311faae463a
MD5 0bf9e40be76c24bed144214fd5daa5e3
SHA1 f035c835e7e367c01c5ced080e37660bdbe14993
SHA512 c498baa2600a3eede98bc639608ef9126cf41f96b5cb9295caa1ab3ed41b4e6f6b8fa895da3c1d4873836311b78e32febe56a50c72f65394886ea2ce04c3ec2c
SSDEEP 48:TL9aw/aHLopFMavU1iQHc4Z7Ki9tNHHGr1:HPareMamKi9tsr
TLSH
T10792758F1F306211C4F4A73DE8D14ADB2D3C512CD36B6A44DE5414B24CD14BBF2160B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7d010386cc764997d01e2511b5b7a78cb078e8601dabd5337f5da34d0ef9fe66
MD5 7cbb14a8d8fae706f5555dfedbf14d72
SHA1 7bb0452e882a65935bf23309d1c8e898051b9f92
SHA512 02e0080a23abfa501ea28cd2ec069f4f0f0357784dd7f5ae7b7be545a66bad102c944ad8e7f8206be540efff7cd3ae69d7df0e644184749466552a1343b87b89
TLSH
T15B5180F7C3E8C52DC94156F4AB156F1FCE2A0924432C3C66C8D4AF5B93E2871D11468E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9953d130e01862d1e929f014e62f7326b255895f1e8875ef80adf07db82d1831
MD5 e224dab1a23fbb657b3a5351e351c1b4
SHA1 12664ac5c73915cf05644233719bff2d4eb8a853
SHA512 47d5bceef8e05e070825a5a3f0d2b11f3e0ce152ba75d10083f9eabf549374af5ef7cdf1e8b9406d5259b7ef6f032c623b825919b548fd927b29346c3213d3a9
TLSH
T1C8717DF7C3E8C66D895156F4AB156F1FCE290A24432C3C66C8D5AF6F93E2871D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f779876101b4533a494b14e88d805741248df7b1793321e28bfc36956009ea14
MD5 e1fc83cb9dddd5c4b489944f2df3e7e2
SHA1 1242025803659e38ef3807214226a42f4c55372a
SHA512 10f3dffd293e1dfdf4bead2fa2c0485883bb7c11280d86a987f25a97a3b33e498f23726a73c8ab842c8b4e04b8af22d37553f9279cb2c06889fdabb316f103bd
TLSH
T11BF050A7D26AB02751BD85BB5D05780E25B6743102D128F5CE6A81AEA0850E70B11057
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 320d852066b92460032542001f07cd66d250930e9046eddb58d695305d78b42c
MD5 10407eb25cca069b7a92a4ca9fa5d39e
SHA1 5775ae6cd2f9d8dc91ade0bcf6e44a2a86a8eae9
SHA512 0540659ded3a68ad131293fd4b446847821ed5b796680a8860f5b75eade6325927f4138209df4da22d9f617df90d2d62926716f78ae575c7d646c59102802b55
SSDEEP 192:MR66LU59PwScv7hpAPRp2W95Hsb+WNno9kZ04zXt202peOnpUiCmo2VyIsnAUgtK:MR6UGLI9UXtrwH0y2hrl8
TLSH
T1BD42C73EB910B53B5CDAD219FA223B57D7F6143125E02D84EAFC892C15EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a4bb4550942dd8b1d770a7075da1c159109976e093cced5f934c52373fbc1c40
MD5 800dba54388960a5bd491c021a705cd5
SHA1 829dce0fcee8a0b9546975b709a78773c6b6ac45
SHA512 03299c6ee56bf661ba0317753eee325a26ab81e55bb6709f2ff7e29716489c5597f35f5fceaeaa9d9fb20a2ec6d70dc5feed454904bb717fb6c5b4f74fc4eb49
SSDEEP 192:MR66LU59PwSfv7hpAPRp2W95Hsb+WNnGwt8Xt202peOnpUiCQo2VyIsnAUgraJ:MR6UGL39UXtrwztU2hJle
TLSH
T16A42C83EB910753B5CDAD219FA227B57D7F6143225E01E84EAFC892C15EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3eba0f189a4453d5d9b3bcd9a46db984899d1ef36a08889f2998347f9c8ce7f5
MD5 091115b365daf7ba5e492b01ee2163ce
SHA1 6b1d5249aa9c9981cd3376c6b126ea3f42b7d79b
SHA512 17ec6b455ab08bb05948fac79368ec8a049a9b471f159b82d8450aae5d4d4179366bea348d715e3e38b39cfff1ea51470f23fdab73c6cfe0f48fb68a8d99be52
TLSH
T190B0222AC0032223C00303B02CA080C83830CF30C3032302A3E80A23CC28A200220820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7c33825004118e9592972ce50166e06b52b1fb38589c8d65ce80f0568d8ad867
MD5 0924519150757ea824337a3d166fff9f
SHA1 12abf02b6a7b0d6a54d66fd7459ee37f22cb33d9
SHA512 d8cd2b942a650ea05405de97bfc5a659607bf591ed9e0cca4ed8ae293abe5932bb671fd91c14a744a2cdbbd7cfdfeb2762093d5cc3e9d38edcaa56fe9a9bcfdb
TLSH
T1A2B0124080815102C44302F81142188CB1149F10D60A270943E87DB2AC25250C116050
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 6ab26e9bd9805a8c664c838c4a7ed3c12582322c9bb28923372c0737d2b8db7f
MD5 c802a9aa21708c597933ec730b4618ea
SHA1 e26c661f4d087f76662bbc210be35bb0353aec13
SHA512 baad11f99d34fe59eb6fc55e766f7d00374c3465d639fa7940880f2678d53dae0708aa428a5804d1c9fb79a87c0702085b12fa294a6f79b153b6cb8654116f72
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2uPW0RVumknW:1nbZeMrv/hGX+NnW
TLSH
T1ABD3A74B3A747102EDE58A725CE051BB5E3CB16D4F55A1D428B620688EF2863B23D0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 398ae0ae6b1e9e831a34ed33c9a326bf485fba800cb9fee755499dd78cdd262c
MD5 d4242e2ac37b4b842cbf7a8f4b491659
SHA1 b9fd0b24f5dd46a4c3b22ce90dfcb09439b11799
SHA512 1163da6d1d7ccc2dcfbe5f4895859f9934a468d291ee94075c185c05170a8d8f90b135709075e553d0c9f77e7931bf93c78dce1e37fb8d416808befd9ce4742a
SSDEEP 3072:tzuYgCxM+oX6X9pQh830crT7vYh6SV5Dswy36aY3mqfd7NtZL8cHQRZEQ6SpsN:duYJe+D9trU6Sbgf6h2qZ/ZLW3ExN
TLSH
T1673423336FC22E3F9F93EFC5B0321A4366B1C4C6D4B1C95DD6942EBB1E8250269D2864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 8496d49f818b2d19e1fb649638c14cefcbe0a30c3fde3ea5a7688b5922d8d345
MD5 6bd94dcbdab7c9aad930dfc40a0c0c25
SHA1 e08429361e78423d2025c1aa4d315d9b5d8e6239
SHA512 8b1b52122e73f367333455911d5de8a7f2184cd335cca4376045918cc7bdef809894c93279916cf3fd2006c3e74262f6577bd0b9c7251594876c5d2284e63108
SSDEEP 3072:1oYgCxM+oX6X9pQh830crT7vYh6SV5Dswy36aY3mqfd7NtZL8cHQRZEQ6SpsN:aYJe+D9trU6Sbgf6h2qZ/ZLW3ExN
TLSH
T1C83423736FC22E3F9FC3EB95B07219436371C4C5D4B1C559D7982EBB1AC29026AD2868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 be7a682b130ae2c4ccae98ed1e7ae5decad6df9b8d4a1c4c2558e79b1544cebf
MD5 4c5cfdffae7bc50e5778bb70c9eff513
SHA1 ce2a9c9ae3dd6f2bd5a82a28e433bf88451040e1
SHA512 6566c49e9ae500e5873bb6c79c169b1ac62c72f28e041ebe1f3b3ef94595319a6f9dafa46fc3ba916080110cbe4d9ef67a675fbad49710432f4d0478b44abcca
SSDEEP 3072:Qd4YgCxM+oX6X9pQh830crT7vYh6SV5Dswy36aY3mqfd7NtZL8cHQRZEQ6SpsN:S4YJe+D9trU6Sbgf6h2qZ/ZLW3ExN
TLSH
T1D53423736FC22E3F9F93EFD5B0321A4366B1C0C6D4B1C95DD6942EBB1D8290269D2864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a81a14ed8791112ec9eb69cb945847f0ff0289007ac6df97e39fa610fc6f2a5f
MD5 665ebfe4f0e515f62b9155a72cae50d5
SHA1 3545f86b7d0e9be44090834d0d041515e7557df2
SHA512 40e430df2ec312781e8bf1fa42a2ad8d2cc652759868f6e1e151fb0b7e192e84084356ee5dc5cde4ffa87e61a2cf88392291ee684cc95298c3422a3da0e4fdb7
SSDEEP 1536:6dyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:aqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1B8C30237EBC21F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93491644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0otbpsmj.ptq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0otbpsmj.ptq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2788-207-0x0000000000020000-0x0000000000C75000-memory.dmp

Download

memory/2788-220-0x0000000000020000-0x0000000000C75000-memory.dmp

Download

memory/4348-109-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4348-4-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4348-0-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4348-2-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4348-3-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4348-71-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4348-94-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/4464-375-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-218-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-369-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-376-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-135-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-374-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-110-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-155-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-373-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-372-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-371-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4464-370-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/4492-199-0x0000000000E70000-0x0000000001AC5000-memory.dmp

Download

memory/4492-183-0x0000000000E70000-0x0000000001AC5000-memory.dmp

Download

memory/4496-90-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-93-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-81-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-82-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-83-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-92-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-91-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-89-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-88-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4496-87-0x000001D687D90000-0x000001D687D91000-memory.dmp

Download

memory/4856-188-0x0000000005FD0000-0x0000000006036000-memory.dmp

Download

memory/4856-232-0x0000000007C30000-0x0000000007C4E000-memory.dmp

Download

memory/4856-224-0x0000000070550000-0x00000000708A4000-memory.dmp

Download

memory/4856-245-0x0000000007C50000-0x0000000007CF3000-memory.dmp

Download

memory/4856-222-0x0000000007BF0000-0x0000000007C22000-memory.dmp

Download

memory/4856-247-0x0000000007D50000-0x0000000007D5A000-memory.dmp

Download

memory/4856-261-0x0000000007E20000-0x0000000007EB6000-memory.dmp

Download

memory/4856-262-0x0000000007D80000-0x0000000007D91000-memory.dmp

Download

memory/4856-263-0x0000000007DD0000-0x0000000007DDE000-memory.dmp

Download

memory/4856-264-0x0000000007DE0000-0x0000000007DF4000-memory.dmp

Download

memory/4856-265-0x0000000008570000-0x000000000858A000-memory.dmp

Download

memory/4856-266-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

Download

memory/4856-223-0x00000000703F0000-0x000000007043C000-memory.dmp

Download

memory/4856-211-0x0000000007ED0000-0x000000000854A000-memory.dmp

Download

memory/4856-212-0x00000000077A0000-0x00000000077BA000-memory.dmp

Download

memory/4856-208-0x00000000077D0000-0x0000000007846000-memory.dmp

Download

memory/4856-200-0x0000000006BC0000-0x0000000006C04000-memory.dmp

Download

memory/4856-198-0x00000000066B0000-0x00000000066FC000-memory.dmp

Download

memory/4856-197-0x0000000006690000-0x00000000066AE000-memory.dmp

Download

memory/4856-196-0x0000000006150000-0x00000000064A4000-memory.dmp

Download

memory/4856-187-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/4856-186-0x0000000005690000-0x00000000056B2000-memory.dmp

Download

memory/4856-185-0x00000000057C0000-0x0000000005DE8000-memory.dmp

Download

memory/4856-184-0x0000000002D40000-0x0000000002D76000-memory.dmp

Download