563ba9c9d7fecd992c2475296cce86d9e10852ff6b65479509af754185bf6886

Analysis

user interaction
yes
max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
something is-.jpeg
Size 182KB
Sample260910-ns91hsseka
SHA256 563ba9c9d7fecd992c2475296cce86d9e10852ff6b65479509af754185bf6886
MD5 6f31be3ea209529d40129e25b05d1468
SHA1 9bac4cb8363aebc9d9eaedc6081a30c720cc991d
SHA512 851ddf2c6f68f344d3acc9b5a490cfc6010f65a53bd67f34acb5ed6ff9cccd00d352119128a236f466e2fac4a9bfd30a30ee741ddb9f75739c6fa93fb2dc3746
SSDEEP 3072:pDzaY1mtK0p+biD2zEGOrP8v0d03F34dk65MwabHKgPZPswOWFf50Cj5TwGKgue1:d4tK0p+MaTOrEv0d03OdzOwIHKaRswv/
TLSH
T1790412EF0EC72A546A5D5698A01C20BECD11CDAF5097F862B8BC607C4BED0975C0FB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
142	raw.githubusercontent.com
141	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3516	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335140986175114"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1544	mspaint.exe
1544	mspaint.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1544	mspaint.exe
1544	mspaint.exe
1544	mspaint.exe
1544	mspaint.exe
3184	salinewin1.5.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2780	2456	chrome.exe	93
PID 2456 wrote to memory of 2936	2456	chrome.exe	94
PID 2456 wrote to memory of 2936	2456	chrome.exe	94
PID 2456 wrote to memory of 3516	2456	chrome.exe	95
PID 2456 wrote to memory of 468	2456	chrome.exe	96
PID 2456 wrote to memory of 468	2456	chrome.exe	96
PID 2456 wrote to memory of 2996	2456	chrome.exe	98
PID 2456 wrote to memory of 1672	2456	chrome.exe	99
PID 2456 wrote to memory of 2996	2456	chrome.exe	98
PID 2456 wrote to memory of 1672	2456	chrome.exe	99
PID 2456 wrote to memory of 1164	2456	chrome.exe	100
PID 2456 wrote to memory of 1164	2456	chrome.exe	100
PID 2456 wrote to memory of 2296	2456	chrome.exe	102
PID 2456 wrote to memory of 2296	2456	chrome.exe	102
PID 2456 wrote to memory of 4176	2456	chrome.exe	103
PID 2456 wrote to memory of 5080	2456	chrome.exe	107
PID 2456 wrote to memory of 5080	2456	chrome.exe	107
PID 2456 wrote to memory of 3436	2456	chrome.exe	110
PID 2456 wrote to memory of 3436	2456	chrome.exe	110
PID 2456 wrote to memory of 824	2456	chrome.exe	115
PID 2456 wrote to memory of 824	2456	chrome.exe	115
PID 2456 wrote to memory of 1272	2456	chrome.exe	119
PID 2456 wrote to memory of 748	2456	chrome.exe	120
PID 2456 wrote to memory of 3048	2456	chrome.exe	121
PID 2456 wrote to memory of 2244	2456	chrome.exe	122
PID 2456 wrote to memory of 2244	2456	chrome.exe	122
PID 2456 wrote to memory of 3332	2456	chrome.exe	124

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\something is-.jpeg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa3987c728,0x7ffa3987c734,0x7ffa3987c740
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,114585282424033800,16296614502162531277,262144 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,2405957521656091071,8554236693984137593,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,9025436613723529203,2086678094372710267,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,2055979641087558883,15892633950311274986,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,1222032716840282381,8721116753608343721,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,17610603283358396151,11391967932675653331,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3960 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,3860214858116555292,7718998263387357255,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,12858474903748746452,228342163167543019,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5528,i,15139715546981806481,6513876398371445414,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3320,i,13839496330077775686,3913886757992387505,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6128,i,5458243654827013949,17474668308748772206,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,8693972039856834998,5901801351204317523,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,1574188678660405469,7221679967022012755,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3512,i,13680980211603067347,9722109462246075339,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5952,i,18108826247930213245,14778711515376732313,2097152 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,861248763598835524,6029078371183493413,524288 --field-trial-handle=1892,i,3129646669180119945,12239570893543365300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4540

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x30c 0x300
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8adbf5c1ff601fd8233035056612ad6891ed474cdc6e32f83ac564a826168b1f
MD5 1f1c73c6b568e73ba22d4d39c204cc37
SHA1 158a664c172c8b2fc9d8804fbcebbc6e0ecc42cc
SHA512 4392f536e7623907703fa55a9564e68487a6de6af5f266bb0f52e05a51640a5feead893cb01d72fa5e0e28f161993d95040343bad766cf2e6c3cf984093e5ff8
TLSH
T116E02B99CD21ED274CFD471D90540F85EA10135B1B608E5B373D810D8FB46A7068695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 21KB
SHA256 b7582acf1f182c6a66e203cd6eee889d409cd05ff4950975128a32fc3e0c0418
MD5 e126007f6b835ef3a0916864cf476699
SHA1 04eb8318f173d6fdb5417e92645502d93966b8a8
SHA512 5e169a71116c41508283ee7224b7fee51c6b737a909c269e062e7494c9e7a853dbd4a762ddd9d9f104d79965d5570c2511df5b1c08c840c2037a4901af8a7140
SSDEEP 384:7zhykQ67ifiZgQPmqN64Q4PBZtjCiMEZiRkCYzMNFMvj686avLDo1bo0/GZl:5VQ6kU5Pmqk4xZTF2Ct6YLDkpql
TLSH
T1EEA2C01F966DC059082EB5CC9795B522D0CB8391E5CD106FD8F54C2FB4B277236E8B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 02c693e5aa9c06a14cc6b974b00a57b38410543ad196e1fddfb4da47c3bfdb2d
MD5 30a3a2d97e5c419562b94ccd22e6a491
SHA1 856ab7a2a4d2b1bcbb4e124e2f8f1c8635b872d7
SHA512 b117d35bc6a3741795d6c7f545951f9fe406807dbef95d750edbe54a5cd0172f8f1f18d012740418a74185d0fac9b471e1818071bd4ab9875840727b2f48ee4f
TLSH
T1EE712ECA635E440EFFC877F11CE50153B874015207570E99F081FBFE2A613A59A16AEA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 423c51af0bdba58e7f2365e5b0d8ef94a3b2aa73a2fe401e42702c04e67818cf
MD5 90ea60c5821cb8bf96b81e3d2801a35c
SHA1 e3afe9407e4fcfc190771a32ed8930eccaf1726f
SHA512 b86bde2d8b6bffe118c95ca9a4434488dc63acfc38d84223fad5842b957569b960c8f64ecf0f0589b20185c1eb487b85d207fa3626adbf36dfc4bb59a4a56621
SSDEEP 192:DQ/zIxDiJiJnykm+aItYvrlWx1aPIIkNKSSovhfPfWNPrv0DmFmmmrmtmDmgme:DQ/zIxDiJiJnykm+aItYvrlWx1awIkNt
TLSH
T11702BFF7C3E8D62D8D1156F4AB15AF1ECE290A24431C3D26C8D8BE1B93E2971E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 864e60cc9b5e9ec08f441bf4f5273cb0a14372f671df5314d032052b71dc230f
MD5 a84b2c8cab8c8cc9aa81e377cd8778fc
SHA1 db60750a593494cb700f4af7e6f80c1f6a50478c
SHA512 9c28c3a7a3657660c898709d3873578558199824f4d2faab8b81b203269b9c38cf7cd70a524a5e9a5c0303e9f863f362ece11f084d792713fb726cd91384ef57
SSDEEP 192:VRGcBhiI8S8lChX/v7ApAPRp2aR+oFp9qHsb+WNNlFSv1Gd+5+e0ekef5IQdnaML:VRGmhilghXXkUX7kwgUXeeexFale
TLSH
T1D352D56AE9106A7B9CD7C22AF9167773E7F5203525842EC4EAFCC92C24E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e4c1eb8e3c516356db70beec81c5bcaa1b5debc8066040ab660669431703a634
MD5 152cb5d86ed4e2a8a799e320dfc0b837
SHA1 1edf8825efdc2cbf536b1668ddb6856a1909f6fb
SHA512 1ad3daea1891b81c76b601473d1533061c1ba3407856e7f22a0379021cd45b7cf7da8f771d4afae80b9e3c2328d09bd30fa96b45143dcf21196bfac408d22dfe
SSDEEP 192:VRGcBzaI8S8lCh9A/v7ApAPRp2GkL9qHsb+WNnFS4Dk2akef5IQdnaM7aVyIsnA4:VRGmzalgh9AXkUXqkwol2zexFaF8
TLSH
T17052B52EE9106A7B9CD7C21AFA127773E7F5203525942EC4DAFC892C24D75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 febcd89b11e347aec8ea21cdb0ff083adffe8f0d78da79f1d5201c04cf8a42e7
MD5 6001872fb76233daa06a9e9ccdb27b06
SHA1 975fd8914bf00c5fe03b79cbf6eced87f7f4a4f3
SHA512 5bc8b3726403c91c8e6edab586ee55d261ea8b4c3d055c4f6ee1a32879ca58472638094d516e0b3b18f3f76f6f3324158253c9d77c20b5c3863be305f6db05bc
SSDEEP 192:VRBcBhi38S8lChX/v7Ap+PRpcaR+oFp9qHsb+WNNlFSv1Gd+5+e03kef5IQdnaMf:VRBmhisghXXkeXpkwgUXezexFaLe
TLSH
T1C762D56AE9106A7B9CD7C22AF9167773E7F5203525842EC4EAFC8D2C24E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7a6c1a236571aec293570ccac25004909f0f6d89cdec7cc090e512fcbafc32a2
MD5 1a78d85b03e025c6b46cf1c74c67d80c
SHA1 3397a32d6d323bc88e6603213eedfe0526fde943
SHA512 9cd2458c5f18e8c88992f588bda0cff1550f0e3b6dc21980682c6de2c295122bad2a0e0b9e975db0e8b862d302f7dc6febe26a5a4e2960337bf8195df1fc48cd
SSDEEP 192:VRGcBhaI8S8lChx/v7ApAPRp2G0p9qHsb+WNnFS45+eSkef5IQdnaM7aVyIsnAUp:VRGmhalghxXkUX4kwolebexFale
TLSH
T12C52C52AE9106A7BACD7C22AF9167763E7F5203525942EC4EAFCC92C24E75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4cb7cb607bfc8d2a2856949947af35ada6df77b6d35b3d704e2e80da88b3e4e6
MD5 bd05ed04a1d155846ff57ca7285b986a
SHA1 2ff91b84bff1b49fe8723a9156e40e4f16f6a3a9
SHA512 7c3d0c5f9b993e97482aa960edf7d85d480bdf79cbfa4a4495672cd147ada9d52e42c5bf7980dad7735e87775e5b0dd4e291c28387181c435c99b15766272e3e
SSDEEP 192:VRBcBhiI8S8lChX/v7Ap+PRpcaR+oFp9qHsb+WNNlFSv1Gd+5+e03kef5IQdnaMf:VRBmhilghXXkeXpkwgUXezexFaLe
TLSH
T1E062D56AE9106A7B9CD7C22AF9157773E7F5203525842EC4EAFC892C24E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d9205ca9aedf7b5bfca47f796eaf323ad5db813fab46ca6a0153188c44f53fab
MD5 f6ee1eb8ee9271557e8e697dfd7b5f1a
SHA1 7938de3442e74e457aed780a74e926e4181c23e6
SHA512 9a0335b87c31f8bfb9d65b45caa2d9167ef0a31a3f3c4ec476dd0ed7a4a14b0d774156116892c7a522e972bbd3ddbae4ffd931705e7148edd167ff39cbde61a1
TLSH
T1E4B01240C4036501C01302F4118214C87114EF20DB0B1B0343E0BA73DC252608124050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 60ea667e910762dfb4981d4937cd4e846c6293720a5fbbd3e749bf136fc018fd
MD5 4e291d719adb182725d3f21e786768f4
SHA1 6c32f34bfcc57f8fc0f7d522d77d816725327e79
SHA512 6b7f512f4fc4178c478e9236e5f2163f16d364624e9e3dd27862078043f8823115ada1365f97831f013b3ff4e2bd50338405da528ffbe84d25f762fd8acfb19c
TLSH
T1ECB00256C1427A33C04207F12DA595DC76E0DF35C7132617E2E0AFA6DC257604565970
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 230ac4bc8cf0c30fcb90e12a75c5ffa6ad7c439c9e81ab23a3adb2e637900474
MD5 f1041ea4d630696909d696d6e5984bbb
SHA1 c6cdafd1019e4da9bf689e20d62cc27b8748ab29
SHA512 e0aa4f7078935fccd02063f0c3578d30d6a7a39563a182d07df6ceed8bdc359fe4d2add058fdc1c01239649de61bec88bc24666331e31b786392c5ac5da58b70
TLSH
T11CA002E41190025ECD104671E2C582C53370BF5007030E42859441858C951D24122210
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 53483b690f503bd7e03244903815b56bf39e5696aa9d5da74e9e273529171b96
MD5 0d334499ef78460c3a4a273b7ebece4d
SHA1 55c5e7a1aca84564cb89d51430946688675b33ac
SHA512 28ce671f79f98efe2cad142d97d58c3a4033d4a531e603c7f6f78cf135aa503818dc4cd1b359d41d50b94328008b81fe31d6ddfd5c8898c01955cf80c48baeea
SSDEEP 6144:cQQ5tTbRIn7e2f7vwO6Ym7Rkm1tYpBeh2BAoA:Z+38eiC79oBGcAoA
TLSH
T14534127B6D90E93B59F78F6EA44F1F2F1EF256C2DA10CA8498D43E05D199B804C4AE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 12c033ba3d800faf0e3e6c9d743e76a5af315f4c8b88af06c3d32ffd965ee9c6
MD5 bf1edf2234742de7cfb631931b3fd28e
SHA1 3c1be644544ca0906e5e1f7320b75e431bde3401
SHA512 ed822a2873b59b6db620cb4379d5a35d6f9b747a4d5327990b9ef902b098fa011c545346facdcea56dd0ab480c3823e3fe3547c0659944e6829f69afcd9b0813
SSDEEP 3072:AoGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:om7Rkm1tYpBeh2BAog
TLSH
T1AFC3023B9D75EC3B5CB5A74FB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 3465d9a44322e628fd47427fc321011b122bc66e567656918ece4d70272f74dd
MD5 4569da09e055521a554a063c57bc9315
SHA1 94ae1f9a653a8446fa6d779739862d206b1900bb
SHA512 7d0c2eb10bd99b5ade12c1764d22aea3a1879cda1b6d33056eb66537c1d5d56a14625c0659d4dae68326e096b32cde321c5d9310df4b09cdad4201a27e7bfa77
SSDEEP 6144:OQ5tTbRIn7e2f7vwO6Ym7Rkm1tYpBeh2BAoA:O+38eiC79oBGcAoA
TLSH
T17B3422676D90E93B19F78F6EA44F0F2F2EF34AC2DA10C6D188D06B05D598B81194AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 844da83091680ac7a1c13316552482350c6f38db769decd94bc5d98787f3ad53
MD5 807e204e07632c8fe9c7e7c80ed60faf
SHA1 b68347ef97cfeb9a81313e3cbc7065aefc3a3c52
SHA512 e0f3012ed7ffb7f3fe9b0e5faeae172d6781292de0936eda0f0143d98ccecb9497e10cb35ab66704f1c462a730e1b149d3fa7b98301500f0fd2b67336799d188
SSDEEP 6144:tQ5tTbRIn7e2f7vwO6Ym7Rkm1tYpBeh2BAoA:t+38eiC79oBGcAoA
TLSH
T1B33422676D90E93B15FB8F6EA44F0F2F2EF34AC2DA10C6D188D06B05D599B81194AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin1.5.zip

Path C:\Users\Admin\Downloads\salinewin1.5.zip
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download