salatstealer | 5e58a0e0b4ab711349370567728293cf6e732870aa9ea9def6ae5b59ca7322c3

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RKNBYPASS.exe
Size 5.6MB
Sample260822-le6d3ashnf
SHA256 5e58a0e0b4ab711349370567728293cf6e732870aa9ea9def6ae5b59ca7322c3
MD5 1f6b88a1a6859c4bc2969541334d12cb
SHA1 d7b49a07497daeae229427bee23371abd801d3fd
SHA512 715e0bb75ccd61f7211d0e33e8eb00aa46ee17b9545c483196edcd9a13f924175fb89a8cdda8eb44047381f4997dbaa4e21fa7f21fa1e75ad3b4921c84fbb54b
SSDEEP 98304:PjPrYm4Nj4237cruKcJhYxeCXND/Xb5APHV9Zv5OdXQITSysmH5pD/sq4w:PIXdV37MHcJhId/LGrZv5gFSyFZtsg
TLSH
T1065633D07E32448DC21FBAB9851E75810D2DA587C7DAE8E3385AE52F70FB988436C647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 19 IoCs

resource	yara_rule
behavioral2/memory/4640-62-0x0000000000F90000-0x0000000001BE8000-memory.dmp	family_salatstealer
behavioral2/memory/4640-63-0x0000000000F90000-0x0000000001BE8000-memory.dmp	family_salatstealer
behavioral2/memory/4640-64-0x0000000000F90000-0x0000000001BE8000-memory.dmp	family_salatstealer
behavioral2/memory/4640-72-0x0000000000F90000-0x0000000001BE8000-memory.dmp	family_salatstealer
behavioral2/memory/2056-77-0x0000000000580000-0x00000000011D8000-memory.dmp	family_salatstealer
behavioral2/memory/3932-78-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-79-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3228-101-0x00000000005E0000-0x0000000001238000-memory.dmp	family_salatstealer
behavioral2/memory/2732-112-0x0000000000DC0000-0x0000000001A18000-memory.dmp	family_salatstealer
behavioral2/memory/3932-115-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-139-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-216-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-391-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-461-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-478-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-497-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-513-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-543-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer
behavioral2/memory/3932-564-0x0000000000820000-0x0000000001478000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
54	1944	powershell.exe
55	1944	powershell.exe
56	1944	powershell.exe
57	1944	powershell.exe
58	1944	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
4812	conhost.exe
4640	svchost.exe
4132	Zapret2.0Bypass.exe
1608	svchost.exe
3896	svchost.exe
3932	TextInputHost.exe
2056	csrss.exe
3228	TextInputHost.exe
2732	TextInputHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemAutoLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\SystemData\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Program Files (x86)\\WindowsPowerShell\\csrss.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TextInputHost.exe"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000024542-10.dat	upx
behavioral2/memory/4640-17-0x0000000000F90000-0x0000000001BE8000-memory.dmp	upx
behavioral2/memory/4640-62-0x0000000000F90000-0x0000000001BE8000-memory.dmp	upx
behavioral2/memory/4640-63-0x0000000000F90000-0x0000000001BE8000-memory.dmp	upx
behavioral2/memory/4640-64-0x0000000000F90000-0x0000000001BE8000-memory.dmp	upx
behavioral2/memory/4640-72-0x0000000000F90000-0x0000000001BE8000-memory.dmp	upx
behavioral2/memory/3932-71-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/2056-75-0x0000000000580000-0x00000000011D8000-memory.dmp	upx
behavioral2/memory/2056-77-0x0000000000580000-0x00000000011D8000-memory.dmp	upx
behavioral2/memory/3932-78-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-79-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3228-86-0x00000000005E0000-0x0000000001238000-memory.dmp	upx
behavioral2/memory/3228-101-0x00000000005E0000-0x0000000001238000-memory.dmp	upx
behavioral2/memory/2732-107-0x0000000000DC0000-0x0000000001A18000-memory.dmp	upx
behavioral2/memory/2732-112-0x0000000000DC0000-0x0000000001A18000-memory.dmp	upx
behavioral2/memory/3932-115-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-139-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-216-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-391-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-461-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-478-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-497-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-513-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-543-0x0000000000820000-0x0000000001478000-memory.dmp	upx
behavioral2/memory/3932-564-0x0000000000820000-0x0000000001478000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\4aafbc5c-59ec-fddb-7f11-830ed7405c59	svchost.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\csrss.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\TextInputHost.exe	TextInputHost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\TextInputHost.exe	TextInputHost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zapret2.0Bypass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe
1748	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318645611629522"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4640	svchost.exe
4640	svchost.exe
4640	svchost.exe
4640	svchost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
1944	powershell.exe
1944	powershell.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
3932	TextInputHost.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe
Token: SeCreatePagefilePrivilege	1504	chrome.exe
Token: SeShutdownPrivilege	1504	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4132	Zapret2.0Bypass.exe
3968	msedge.exe
3968	msedge.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 4812	1488	RKNBYPASS.exe	85
PID 1488 wrote to memory of 4640	1488	RKNBYPASS.exe	86
PID 1488 wrote to memory of 4132	1488	RKNBYPASS.exe	87
PID 4812 wrote to memory of 1608	4812	conhost.exe	88
PID 4640 wrote to memory of 3932	4640	svchost.exe	99
PID 3932 wrote to memory of 1944	3932	TextInputHost.exe	105
PID 3932 wrote to memory of 3228	3932	TextInputHost.exe	107
PID 3932 wrote to memory of 2732	3932	TextInputHost.exe	110
PID 1944 wrote to memory of 1216	1944	powershell.exe	112
PID 4132 wrote to memory of 3968	4132	Zapret2.0Bypass.exe	113
PID 3968 wrote to memory of 1308	3968	msedge.exe	114
PID 3968 wrote to memory of 4380	3968	msedge.exe	115
PID 3968 wrote to memory of 64	3968	msedge.exe	116
PID 3968 wrote to memory of 64	3968	msedge.exe	116
PID 3968 wrote to memory of 64	3968	msedge.exe	116
PID 3968 wrote to memory of 3020	3968	msedge.exe	117
PID 3968 wrote to memory of 3020	3968	msedge.exe	117
PID 3968 wrote to memory of 3504	3968	msedge.exe	121
PID 3968 wrote to memory of 3504	3968	msedge.exe	121
PID 3968 wrote to memory of 3504	3968	msedge.exe	121
PID 3968 wrote to memory of 3888	3968	msedge.exe	122
PID 3968 wrote to memory of 3888	3968	msedge.exe	122
PID 3968 wrote to memory of 3888	3968	msedge.exe	122
PID 3968 wrote to memory of 1800	3968	msedge.exe	123
PID 3968 wrote to memory of 1800	3968	msedge.exe	123
PID 3968 wrote to memory of 1800	3968	msedge.exe	123
PID 3968 wrote to memory of 1052	3968	msedge.exe	124
PID 3968 wrote to memory of 1052	3968	msedge.exe	124
PID 3968 wrote to memory of 1052	3968	msedge.exe	124
PID 1504 wrote to memory of 4872	1504	chrome.exe	125
PID 3968 wrote to memory of 4848	3968	msedge.exe	126
PID 3968 wrote to memory of 4848	3968	msedge.exe	126
PID 3968 wrote to memory of 4528	3968	msedge.exe	128
PID 3968 wrote to memory of 4528	3968	msedge.exe	128
PID 3968 wrote to memory of 4528	3968	msedge.exe	128
PID 1504 wrote to memory of 4196	1504	chrome.exe	130
PID 1504 wrote to memory of 4196	1504	chrome.exe	130
PID 1504 wrote to memory of 1748	1504	chrome.exe	131
PID 1504 wrote to memory of 4344	1504	chrome.exe	132
PID 1504 wrote to memory of 4344	1504	chrome.exe	132
PID 3968 wrote to memory of 1876	3968	msedge.exe	133
PID 3968 wrote to memory of 1352	3968	msedge.exe	134
PID 3968 wrote to memory of 1876	3968	msedge.exe	133
PID 3968 wrote to memory of 1352	3968	msedge.exe	134
PID 1504 wrote to memory of 5276	1504	chrome.exe	136
PID 1504 wrote to memory of 5284	1504	chrome.exe	137
PID 1504 wrote to memory of 5276	1504	chrome.exe	136
PID 1504 wrote to memory of 5284	1504	chrome.exe	137
PID 1504 wrote to memory of 5352	1504	chrome.exe	138
PID 1504 wrote to memory of 5352	1504	chrome.exe	138
PID 1504 wrote to memory of 5536	1504	chrome.exe	140
PID 1504 wrote to memory of 5536	1504	chrome.exe	140
PID 1504 wrote to memory of 5368	1504	chrome.exe	141
PID 1504 wrote to memory of 5304	1504	chrome.exe	143
PID 1504 wrote to memory of 5304	1504	chrome.exe	143
PID 1504 wrote to memory of 720	1504	chrome.exe	144
PID 1504 wrote to memory of 4772	1504	chrome.exe	145
PID 1504 wrote to memory of 1060	1504	chrome.exe	146

C:\Users\Admin\AppData\Local\Temp\RKNBYPASS.exe
"C:\Users\Admin\AppData\Local\Temp\RKNBYPASS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\conhost.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\conhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
    "C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1608
- C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\svchost.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\TextInputHost.exe
    C:\Users\Admin\AppData\Local\Temp\TextInputHost.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1216
  - - C:\Program Files\Google\Chrome\Application\TextInputHost.exe
      "C:\Program Files\Google\Chrome\Application\TextInputHost.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\TextInputHost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\TextInputHost.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2732
- C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\Zapret2.0Bypass.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\Zapret2.0Bypass.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/sexsoldier_crazy42
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffaa5dac188,0x7ffaa5dac194,0x7ffaa5dac1a0
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,10776965486915698907,1485555947474378734,524288 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:3
      4⤵
      System Time Discovery
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,10959694453693323613,15663982356894586940,262144 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,16152708708614465259,13132581625501342689,524288 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2705832530889585923,8715131929549545624,2097152 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,12242310621304799187,8096205374867404888,2097152 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,7099473410416639172,11868622705808742098,2097152 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,10421019167486378102,2684686961421157113,2097152 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,17599376805530186296,16520112473390282722,524288 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5180,i,5658367544254723821,18239203078126326216,2097152 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11235097125312039209,16752681099620701673,524288 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,12329612835470406335,16984897033605159754,524288 --field-trial-handle=2524,i,9145717285992037179,10486632926652124736,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
      4⤵
      PID:1352

C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
C:\Users\Admin\AppData\Roaming\SystemData\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3896

C:\Program Files (x86)\WindowsPowerShell\csrss.exe
"C:\Program Files (x86)\WindowsPowerShell\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaa3c8c728,0x7ffaa3c8c734,0x7ffaa3c8c740
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8539068974549399475,751411542921386298,262144 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,17988221563150399769,11089107247848694496,524288 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,13001620687792414956,11160050498421565212,524288 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,16017906650229999184,4905508724881330948,2097152 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,14749221269618380170,11749292100686670814,2097152 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,16781058566243133672,8892588686891380536,2097152 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,18067076148101810878,4158729409190713785,2097152 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,12173039021435836271,5294919262725945477,524288 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,12996724791236298932,17411467817131673096,2097152 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3344,i,15442768926920371230,10477664931188286003,524288 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,461686993134444478,10807725327220050584,524288 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3412,i,14730276754051434627,5972921985572619610,524288 --field-trial-handle=2000,i,6997348313164501908,13757851676621033792,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:1060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Zapret2.0Bypass.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\Zapret2.0Bypass.exe
Size 36KB
SHA256 8681df9ef3d507f277910a9ea228cae237192705e96ba17a45aea5b50949d6b2
MD5 b81d5bf8bacdb2bd2ca9731ad94fb78f
SHA1 eda4b044061a06a43cb6a1019e4682f26ae847ab
SHA512 7faa0f51148995293c2d4e23f5e3bcc17ba3ddc25e97154b728bbade2154d1ae655892e89520be2401d088d29763884f2d740d45dff0189642f813f0c76e0912
SSDEEP 768:NisrAg2L9aaF8Pz44UngI2jEL7lfQjJsv8QoS4r6IaAubd5IfBfS:NisrAg2L9aaFm44gt8dr6IaAuJ5UfS
TLSH
T1BAF2182E763C4726C9354B764FE64286673C625AB22FD75D38AB5C9ED4C67320300ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\conhost.exe
Size 2.2MB
SHA256 913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8
MD5 9a4770e18dead66536b148d05f80a8c2
SHA1 c457dc476070d547650e2716698cf93ae9ef73bd
SHA512 b77208da18b42b37f13877221573916bb3ba2115aef73589702727060537601e31cd566b707afc4875d8972204b98c21d4be742d7dd8f6d8eb59182106157ee6
SSDEEP 49152:mNjvbrrTKfm4N+2b42HVfx7cQgJmriR0zKiXJhuGgxeCX:AjPrYm4Nj4237cruKcJhYxeCX
TLSH
T1A2A512E06E73818DD21FBAB8854A35410C2EA087C7DAE8E3695AE42F71FF598437C147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\9a786a59d0da\svchost.exe
Size 3.4MB
SHA256 4589c504c69a8a2a2c0a6bcf7662e7c29607a4cc0a05ab27805cf989f6cefaf3
MD5 e322c525af3514b73bf5550a5ade0ab6
SHA1 808433e337e80503faeed0a14cd6f322fafa2778
SHA512 ba6bc52650e2719ddd8980bc70fd43fa4ac4bdef5fd413ece50f4b0a4176bd818a9af9e4e5a2b27512dd2565b774d17c42809d5c71cb7ba042b72cde3b609a52
SSDEEP 98304:CD/Xb5APHV9Zv5OdXQITSysmH5pD/sq4:I/LGrZv5gFSyFZts
TLSH
T109F533E418150848C1EDECB7AA7ACAD1321DAF52579E1E9D707467F51DA8C88F300B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4b20d32bed174a184b1f4446fae842f4dd616df74ea0c57297c28e7ddd69486a
MD5 0edbb3d018f0d70bdaf2400eefe9e5cc
SHA1 d3ec4adbf053573d36460c7f72dc48636e081231
SHA512 cecdbcd0deebcde1c36b460c345cea8ecbf004dc7631b935c04d4b1188314b91fa300e0fa4b7c219452b023aee291e57edf2a4d6f07ce22795f6905c3f6315aa
TLSH
T17AE02BA9C825AC6718FE47185015478AE750135B2A90554F3A3D910CCFB0B2A42C7C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 1974a08da75244e2d59b4cfd142235d9823bb0a51d60b8318541e2fa95841708
MD5 98f2ce560d6b44c34fdde5519219f2fc
SHA1 f439ca0cbedf0b50e9b533ad184fa48fb7e3ee85
SHA512 a832e6440ee7337da1ed438359c1926728b85b7a0901664eb1a8ab037238d5c4866c4fa2e25be60d1473874083a6905ec69dc759dff545e692ab00054e65427c
TLSH
T14EC09220AA840B95DB1A6ABB2C92A29036F43E7401A2DA62828C22BD46636E51213C41
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1b5b5806944d2c3f37c9485cab3d826ee6f407eb83dfa4567d5067aa066c4576
MD5 857a81ebaec848b9d70ab6877e7ed08d
SHA1 119e65780e591cbf673794f09de351ae6007f1ec
SHA512 2b5929ab1ea282ab6ad21a44bd4b182fd0fc5341f5b80ad055c6ffefb9faa8d1a20fedf8ccd1386d0d0a4b9b099bdedc20218bc2923fb6ac793296d5d3933a5b
SSDEEP 192:pRfIzafSjx0v7spAPRp22F9wHsb+WNnmN0Hwe1mvkw0aAVyIsnAUgtaJ:pRfIOCwYUX/FKwY05kvUaE8
TLSH
T1DC42E92EFD14793B9CCAD22AFA267753D7F9112121942E94EBFC892C14D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1a359ff0b8eea103c68136b945bf2217fdb7ab75f02ecaf3d0aabf8502efbe61
MD5 d172e9f08ef13d513857da00931a6495
SHA1 1a3ccbff5e351625c8f0cfdcd9b97fb78b4bfba4
SHA512 ec3b578ee2d2c4d92271de586154ac47eceee9eacadc8da4fab9d1924df823cb8a29c6baf990e871d599a0e01a99c4a36dd8f7a51cf668570e797319a8db60f6
SSDEEP 192:pRfIzafSjm0v7spAPRp22m/t9wHsb+WNnahrcr2Bwe1mvkw0aAVyIsnAUgtaJ:pRfIO/wYUX/4KwEg2zkvUaE8
TLSH
T13852F92EFD14693B9CCAD22AF9267757D7F9113121842E94EBFC892C14D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 91441c660ce5831c77512612a5b3b1b241f6e0935e8ed69877c35808c22d4d1a
MD5 409dfcb760503903975cace637ea9ba7
SHA1 811f3205b3977c376e440e07b19d37e9cf2bef0f
SHA512 fb6f9189f43ff1fc8999db43350481bce494586edf325a26031fbf678f5ff336a3745df1ecfebb37298fa0b6a83f5b60b60cb65cd3c4dedbaa58f64202014bed
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcMCDXODUr+ErU3/NHGcmyaOqjmD:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7po
TLSH
T17272F9677C4C8E370F94C6CCD8267F4F9DB5025B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a4e87debfb8f81776eb83bcfb77d99c3f7f83e015e385d755f33502140977cc6
MD5 e3a55e0c25082129c63c0db246d74295
SHA1 e6640ab9fe4d21b56ec45e7851217dc98a18fb48
SHA512 b5e862a454469c7ad17a0f76a35fa0afee55fe566096ad604488b1f6a75d3718b7cf34a1b3d19b326e0b0b3b1c9d141624d4a0eff3c3403d6767dc9943a2dc65
TLSH
T187B0128084019241C20206F4165324887214AF24970A170143E86E2288261908024190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5996a8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5996a8.TMP
Size 96B
SHA256 d478f68e23ca735495f47e1af6a8b394869cc9c81867996ada668ad0a4a4e11c
MD5 040ce497221042f136125d58d4369911
SHA1 37c20be180d18eeb46a7253c39650407c677e679
SHA512 af1d7c17cdcd7e659bdc08710edb9a6384783985768180d0906df11e0c9e96f1d92198f08ba979c3e51622cac6c316030431b023695f728ff1194e3a7c0f00cb
TLSH
T19DB002D5C102A312C35207B06E9595D8B164DF29C603161AD2F41B6EDC257614575570
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 787b9d8036e43c22b64b530c69be272c6926176b1bbf0917f2d0633a5dc34bfe
MD5 8d4928f592fc9f52a32413d8bddb8cd6
SHA1 f8de1688c83a83a825a2ef09eac686b7c6274698
SHA512 e0596c403bc85262e334b488f19a4816317e0539c292d8bc4343cc69e702f34b3bd27d88cdc4b93e5fd3d80d217b3bed640bc24a989574cfff26a85b88139931
SSDEEP 6144:Mj/a7Vd+pbYgrP5qLm7Rkm1tYpBeh2BAop:Mm09nP5qK9oBGcAop
TLSH
T1A73423731D7A9D3A5F1DE70C604E3B2F1EF64C56997E48A14A842A0D93DE3E84909EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 148e7c53e05c9d4419366880a667c44c4969949a02dbf9f86872c33338379196
MD5 13f96d05c7af9556fc249804be3c4151
SHA1 6952bc0135e0fd432022c05725ed4b82147427d6
SHA512 62ca7c9e68222af3dc87881475f054b300f8102e71a64c2ca94d2ef8ee953b0b2fd857c5c813444fcd09d144898259c714b860b7be87b475b53243b1df29bc63
SSDEEP 6144:Vpj/a7Vd+pbYgrP5qLm7Rkm1tYpBeh2BAop:nm09nP5qK9oBGcAop
TLSH
T1C33412771D269C369F1DE70C604E3B2F0EF64D56DD7E88915A842A0DA39E3E84D09EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 847aa945a3a342e75a990f99c07f63158602027d7c6513323341082fc937df28
MD5 818d6207c931e6e130917335b8aa2631
SHA1 f2c161e466ed27968ec361f59b2c55179cf71d15
SHA512 f5962b149365df7558ab3a990d061c073f782fb9a09a2b38ed6af9a5262fa25d231fec9c159937b265a14f5405bfa8ac0a42f73e20160baa378357c01c789ae2
SSDEEP 6144:1tj/a7Vd+pbYgrP5qLm7Rkm1tYpBeh2BAop:/m09nP5qK9oBGcAop
TLSH
T18E3412771D269C369F1DE70C604E3B2F0EF64D56DD7D88915A842A0DA39E3E84D09EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 334c2c78c3bf2fb22d694d90c1ebdc75d4418a9c2425d43e874d9620c36fb4b4
MD5 571b5d332abbd2702a24d53393891b4a
SHA1 e56909315ce1f425078857d5e0631fd73846806f
SHA512 a24c3fccaa6b78d612c4be2056f4a20d3d93c6683c30167e53a8c60fbc9e9d0231887abf9548ea4c1bb9fb66e06ede4656c37c16c5597eef874157babe15e15d
SSDEEP 3072:DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:6m7Rkm1tYpBeh2BAoK
TLSH
T17DC3123B5D65E9779979B70EB08E0B1F1EF149A2C920DE92C8D86B0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 d8664c098696254b7faf448371799fe5378651f488af00503c380ea4424fb604
MD5 2a3b8e39b7d6a0fce8316662d2c1a480
SHA1 6098ca7487c470d841d549331448254a6cda28d2
SHA512 750186ab0f7e31ea164a475aaa3149555b3a1b3b859768ae483f1f406fc1e4c41e1cb22639d480afc4b1421ceb46d8f3a8255e1ff54ef50827e0133489cb8d60
SSDEEP 6144:rj/a7Vd+pbYgrP5qLm7Rkm1tYpBeh2BAop:vm09nP5qK9oBGcAop
TLSH
T1D53423731D799D3A5F1DE70C604E3B2F1EF64C569D7E48A24A842A0D93DE3E84909EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2ce0318c35c33b967098227a805dc29c73a2b7f4330779681222d5705016d45c
MD5 112b4d378fb6de8463c4dac9be8211a4
SHA1 ef5a2d0eae647090adbaddba09b3baa65ba512a7
SHA512 6db3b811f5d6a1814cd36363818d7bb4008a1ac3903c1364e64f611373d1406d3067c52b3b65a5858f72c0e8e0527448185040336ca582baef95a88f336228ef
TLSH
T119D0A722692975D2F32A41799062CB011A15417766637701B215981C9A740C5B5876C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 15185833ee42d8ab76f5c11e196c89ee5c2c974459fb5938f1b46beaae357c4e
MD5 9f6ad6bcbd054ddd5b6b00e8b134b4d7
SHA1 5a67ade3de04ff1bc94bd2037b946c420dff1e1e
SHA512 97305c3bae68963bdc9283da2d6c5e6d07aeaecd554bed4459c324a27dcd5357f31c8bbb9731a24c142e1dc12d52c0473559d93e7b7ae785d6b3dcceb7ada4b6
TLSH
T15F71A43B06E22CD2D39047FD74DE1AF5747749DBFD8F5EAD12209A3036137128229568
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592a81.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592a81.TMP
Size 3KB
SHA256 03a0ac044edbc4666136b7ddf27fe25671111199bfba61b6339ed8a866b629a9
MD5 05bbf5e15cdc618ff8522262d4a8b3c1
SHA1 145882749940b0b6fe6c48564f106e04888fef9d
SHA512 6e091429b8b49e605815071058a206b7cdaa2c6bb173e8ca9bafb71847a948ee298055f8cd8ac68b303c0c87c1b18d616bad24b94324718debc86ac0caeeb5e5
TLSH
T1F071C53B06E26CD2E39047FD74EE1AF574734ADBFD8F5EAD12209A3036137528229568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9563418db994dd4590fbd69cd4fe27b4f429e536c89d85b07c9df623b13e1e7c
MD5 34c0b7c7775febe1d4bc9ad5cea927d4
SHA1 e6c057615497ef8e53fcdb5ff56662f3cc24e26c
SHA512 bb5c21e851165a44004c5f6df85b1b6157c6cbca0bdb2d688145ca3c8c317f522143c99b12f38407d7b9c0923562a4354c60b9c63514cdcf9e4d66452169e3f0
TLSH
T1E1318DF7C3E5966E890156F0AB14AE1BCE6D0615431C3C1A89D4BF2B93F3471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e01205f284f5117c3fb9e6f99c6e13c8d3691b00c9f83d423dfa9ec058e1d9f3
MD5 9140d3338d6e31c8a7a741a4b7d5ca8d
SHA1 5c83ee81268abeb866e7dd01b53ad171af1dc306
SHA512 71a0c18d148747ef7ed9684151fb63b5d0157130be3b0f771d7a86cc180abebdf61e8175cd6fb724577dda61d047fc45bf900031e22c6e795f3c07221975c97c
SSDEEP 192:sxZkORsyM/jK1Ml8kjc/f7sSWpV9B2bEdpXtHW6+WNcYis4/YAGO7IgEJ:sxZkOSFc/f7sSWv9AY9Hbh4/NI
TLSH
T10952E911AA34697BCCDBD20DFA557F53D6F91463A2901E449AFCDA1C00E6AEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1f7dcdee1cf51e4ddb052cca11ba796cbbdeec8814ea3649d33d2a1a3f5df874
MD5 7c71bec8238f6fd5fcd11be0aebf9a17
SHA1 b3140c869983ccdbb9eb002dc5003fa00162cec5
SHA512 0929e21b77955cd97e6c9a2820616fd4663515837f5d0ac8bbe76f1cb4650af2667c7cf7a724dea38fdb5e6da4024970143b0e0d3c1cfd4087feb89e3c7ce3bc
SSDEEP 768:IOtJsqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV94Ll6AR9yroE6T:HbsqxAlWvJD6Tu1jai4LAs9pEw
TLSH
T19EE21C3B694CC77E4F840E6DEC2AAFD76ED801CB66588D5447FA880C02CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 f7052c837bc97bfcb6ef6d0c4722c1da8e45c48f6fc24b95bbd653ef67e4421d
MD5 be914ec7ad259017c26c7ce96ed122bd
SHA1 196628027d5de0faa7564d33a2bb3209bf0f110f
SHA512 1cffcde120f5048a2c0601c98bc8d307d5d0f9c555a713f5c54bdb64262936b393b5bb3d727d32ff30f7f6ecfa6f66df13cdf7fcb56c38bb6011d36368f5b315
SSDEEP 384:zJsNaNI8bXD+xVRNwOqp9Ui67QASt6k1o65mkc83B8g:NUaqXHwOS9Ui67SO65U83Sg
TLSH
T1638239B1E8645CE74895E5C9A24BF5132DB85037CA8D1E4CE2F87A3D318F5F84342D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d60aaa9fe5fbba71a48cb89ee92e391741341fb671809fe644edfb9b4bdf71df
MD5 16e8a8ba8c0b3d864b813ecda5d7e52d
SHA1 4b77fa203ce72ba143f7a0b362b7aef77e36f61b
SHA512 313e2cdea436f5b80129ac3133efae9a973abb990c934c5a80e0389d5f63b240afe758708e9bfe031349372df3da6f982f9197655b7cc5d971208766c14d3689
SSDEEP 192:tONA6JkRtQmiUyLuW+RNwOm9OmGh3bLRMU6:tONA6UrNW+RNwOq6mU6
TLSH
T1D702E9357C382C7B9EF2AE49F98B27135FA5206BE9952F80DAD81B0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f9351345d10301f0c5a3a8c08520e561d3a48c38534832fd90565732aa1aad0
MD5 ec5c2a4f8405c742dbc688d88e401ca2
SHA1 b824e8a42e92a188b03f2a43f562ce68a234855e
SHA512 49e1e84417c226d35276a1a5f16e20d02a8f8432cb1dc2cb46c12b86b08bc3f287331b17c0b2f6372d91e86dc2f39e31f72a27992df864f2eedd25846ed0cd61
SSDEEP 192:2ONj6JkRwQmiUyWuQ+RNwOm9Om3l9UiZVcbDqPyU6:2ONj6UwKQ+RNwOqp9UikRU6
TLSH
T19912F9306838AC775EE6B805F58B36939EA82077ED856F84D6D51F1C00D768C274FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

03815068-9b05-4a5c-b84b-1023c9155515.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\03815068-9b05-4a5c-b84b-1023c9155515.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55d3f6ad51c711780020619c02968043a56947ddb6269c3e7d8b0a4cf00eb7bf
MD5 6770da02ad8c1f27ecb9b887bf609e76
SHA1 36c0617200bc6ceec35b4d30cf41e1aa7b09ab76
SHA512 7397e050379e8d183e662ea6c251adb0976e52593da486a416b9cb70fbda18e2806a7ba2dee238d6e54e50a87e5e8fe93b9e4596fbb22ef84228497ae98f4d75
TLSH
T17B411758BAFA1118B3776F5A9BF6A86D547BBC772E06D45E00110E4E0A27A40CC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_amhntc5k.sfg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amhntc5k.sfg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 7d89cfdc77a9a047fb69138841cdedb813eaf3b2a9fe7ef1bd8d155955331d12
MD5 e0476efa27941a7f6fd3a0ef929aca86
SHA1 f74e1516fea8ce0c4606d2bee56ccc3923d54413
SHA512 8ac17e81af9f5246e0121e4a7f42a3e056968a96629a4addd90673f6d838989da7fd3630b793c252bbde3612fd5110ff23152322c104fcbaa1f435b2c80d1b95
TLSH
T1EB217C4065F995B71C5300F6A3154D4E6E5731422F989DC8E7C9634AF082C15BEEF3A5
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 b06909f30637d95e35300bfc8743a73fd2df10217d3f2c1ea2307439108f1786
MD5 3b36ce2a9fcc577d26da8b0bc9f4c951
SHA1 67fea8b471babacbcfdb26b22e4aeef362bb1ca7
SHA512 eb854d638f70227254fc0eb972ded8643797e64a70016723290a6b1b1dff1b2cc30e346e25076d374ae5cda58e41b97ac87498f9a3b873cc2c1ee716c21e7cc5
TLSH
T1AA218B4022F956B61C5301F6A3154D4F6E5731422FA89DC4F7C9634AF082C15BEEF2A5
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_log.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_log.txt
Size 1KB
SHA256 574b59c26e673bd08df5e1a7086f6275e2a9fa1e09bd6d335679e7df355417cc
MD5 125e44fdf192b9df235298b930bd8b13
SHA1 dd0bf8adb56574b39204e040a706be309d4ae0da
SHA512 3dbef1325ff69c0adef5930b19f2b0d190c3060e3dd12a819a6504045e8b649e3c797829eb788acb684428d4762ced881d6be8c429711bde1aca231c6b3231cb
TLSH
T1EF318D4032F9567A1C5301F6A3154D4F6E5731422FA89DC4E7C96349F082C15BEFB2A9
MD5 SHA1 SHA512 TLSH

Submit Download

autolauncher_tracking.txt

Path C:\Users\Admin\AppData\Local\Temp\autolauncher_tracking.txt
Size 33B
SHA256 15a915363bb36a0df2671c55674b818ac3f139688facce1d40cde8f0bd6465ce
MD5 ff0cac0e2aa55f807f78b34b000ead6c
SHA1 7967f1c12abd315a3331e4fe013adcfccc945835
SHA512 7839f7a81b4227b4c53185ca4b99f8070fc75080ae124ac00ea1faa1336f06a2c4b55afe8967f5a55ec14e790305dc46f0e8abbe22db09bd469a8ab668861081
MD5 SHA1 SHA512

Submit Download

memory/1488-0-0x0000000000820000-0x0000000000828000-memory.dmp

Download

memory/1944-82-0x0000000005360000-0x0000000005988000-memory.dmp

Download

memory/1944-97-0x0000000005A70000-0x0000000005DC4000-memory.dmp

Download

memory/1944-125-0x0000000007650000-0x00000000076F3000-memory.dmp

Download

memory/1944-116-0x000000006C750000-0x000000006CAA4000-memory.dmp

Download

memory/1944-126-0x0000000007790000-0x000000000779A000-memory.dmp

Download

memory/1944-127-0x0000000007860000-0x00000000078F6000-memory.dmp

Download

memory/1944-80-0x00000000026D0000-0x0000000002706000-memory.dmp

Download

memory/1944-128-0x00000000077C0000-0x00000000077D1000-memory.dmp

Download

memory/1944-129-0x00000000077F0000-0x00000000077FE000-memory.dmp

Download

memory/1944-130-0x0000000007800000-0x0000000007814000-memory.dmp

Download

memory/1944-131-0x0000000007900000-0x000000000791A000-memory.dmp

Download

memory/1944-132-0x0000000007830000-0x0000000007838000-memory.dmp

Download

memory/1944-137-0x0000000007930000-0x0000000007952000-memory.dmp

Download

memory/1944-138-0x00000000086D0000-0x0000000008C74000-memory.dmp

Download

memory/1944-87-0x0000000005270000-0x0000000005292000-memory.dmp

Download

memory/1944-114-0x000000006C700000-0x000000006C74C000-memory.dmp

Download

memory/1944-113-0x0000000007610000-0x0000000007642000-memory.dmp

Download

memory/1944-94-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/1944-109-0x0000000007AA0000-0x000000000811A000-memory.dmp

Download

memory/1944-110-0x0000000007440000-0x000000000745A000-memory.dmp

Download

memory/1944-108-0x00000000073A0000-0x0000000007416000-memory.dmp

Download

memory/1944-93-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/1944-124-0x0000000004D90000-0x0000000004DAE000-memory.dmp

Download

memory/1944-106-0x0000000006600000-0x0000000006644000-memory.dmp

Download

memory/1944-99-0x00000000060F0000-0x000000000613C000-memory.dmp

Download

memory/1944-98-0x00000000060B0000-0x00000000060CE000-memory.dmp

Download

memory/2056-77-0x0000000000580000-0x00000000011D8000-memory.dmp

Download

memory/2056-75-0x0000000000580000-0x00000000011D8000-memory.dmp

Download

memory/2732-107-0x0000000000DC0000-0x0000000001A18000-memory.dmp

Download

memory/2732-112-0x0000000000DC0000-0x0000000001A18000-memory.dmp

Download

memory/3228-101-0x00000000005E0000-0x0000000001238000-memory.dmp

Download

memory/3228-86-0x00000000005E0000-0x0000000001238000-memory.dmp

Download

memory/3932-78-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-79-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-478-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-115-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-139-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-71-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-391-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-564-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-543-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-513-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-497-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-216-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/3932-461-0x0000000000820000-0x0000000001478000-memory.dmp

Download

memory/4132-46-0x000000000A090000-0x000000000A098000-memory.dmp

Download

memory/4132-48-0x000000000A0F0000-0x000000000A0FE000-memory.dmp

Download

memory/4132-47-0x000000000A110000-0x000000000A148000-memory.dmp

Download

memory/4132-19-0x0000000000A10000-0x0000000000A20000-memory.dmp

Download

memory/4640-62-0x0000000000F90000-0x0000000001BE8000-memory.dmp

Download

memory/4640-63-0x0000000000F90000-0x0000000001BE8000-memory.dmp

Download

memory/4640-64-0x0000000000F90000-0x0000000001BE8000-memory.dmp

Download

memory/4640-17-0x0000000000F90000-0x0000000001BE8000-memory.dmp

Download

memory/4640-72-0x0000000000F90000-0x0000000001BE8000-memory.dmp

Download

memory/4812-18-0x0000000000850000-0x0000000000A7E000-memory.dmp

Download