bde3e61d1a5b745f1f7d582ba3758a4eec9e2bf9fb4e751748f111d1da69652a

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Size 2.3MB
Sample260529-e3txlscx7l
SHA256 bde3e61d1a5b745f1f7d582ba3758a4eec9e2bf9fb4e751748f111d1da69652a
MD5 d0db414308b790a053aefe607d59668c
SHA1 cc9eba2e138e3b594dcdf2179c5524dd7ca26162
SHA512 1758715cfeb9457e95ea417c0d8058dcd8241be35240d01b4d3eb857656ef5a3afd74214fead0fafa6eba72378c3e289ff1e98ee6a23616d8294885e0e9967cb
SSDEEP 49152:w3TQJudZy4eho/FtrtVdLFxk7HpuEfPXYgZ:wStPW9D67JrfPoo
TLSH
T1FAB58D1B7CE008EAC06A533289A762927BB5B8490F3223C72E50B77D3F76AE45D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 1936 created 4512	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 1936 created 4512	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 1936 created 4512	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 1936 created 3128	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	81
PID 1936 created 388	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	82
PID 1936 created 1840	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	83
PID 1936 created 3544	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	84
PID 1936 created 1256	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	86
PID 1936 created 3956	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	87
PID 1936 created 1284	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	88
PID 1936 created 996	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	91
PID 1936 created 996	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	91
PID 1936 created 4364	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	102
PID 1936 created 4364	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	102
PID 1936 created 4364	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	102
PID 1936 created 4072	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	103
PID 1936 created 1160	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	104
PID 1936 created 2056	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	105
PID 1936 created 4500	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	106
PID 1936 created 4064	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	109
PID 1936 created 4832	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	111
PID 1936 created 2404	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	112
PID 1936 created 4484	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	113
PID 1936 created 2696	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	124
PID 1936 created 2696	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	124

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 64 IoCs

resource	yara_rule
behavioral2/memory/1936-1-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-4-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-5-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-6-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-7-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-8-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-9-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-10-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-11-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-12-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-13-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-14-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-15-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-16-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-17-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-31-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-79-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-88-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-78-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-49-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-164-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-163-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-161-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-160-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-245-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-306-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-297-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-303-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-444-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-458-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-465-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-554-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-460-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1032-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1086-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1107-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1070-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1108-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1087-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1160-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1161-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1162-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1163-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1166-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1177-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1164-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1187-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1165-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1195-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1200-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1199-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1198-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1197-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1196-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1209-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1212-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1211-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1208-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1215-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1222-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1220-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1219-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1218-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1936-1217-0x0000000500000000-0x00000005001D6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1840	chrome.exe
4356	chrome.exe
1160	msedge.exe
3916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245025278641736"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{C3FC278E-79C6-49D0-99FB-9CFB30269026}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
4512	chrome.exe
4512	chrome.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
996	chrome.exe
996	chrome.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4512	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 4512 wrote to memory of 3128	4512	chrome.exe	81
PID 4512 wrote to memory of 388	4512	chrome.exe	82
PID 4512 wrote to memory of 1840	4512	chrome.exe	83
PID 4512 wrote to memory of 388	4512	chrome.exe	82
PID 4512 wrote to memory of 3544	4512	chrome.exe	84
PID 4512 wrote to memory of 3544	4512	chrome.exe	84
PID 4512 wrote to memory of 1256	4512	chrome.exe	86
PID 4512 wrote to memory of 1256	4512	chrome.exe	86
PID 4512 wrote to memory of 3956	4512	chrome.exe	87
PID 4512 wrote to memory of 3956	4512	chrome.exe	87
PID 4512 wrote to memory of 1284	4512	chrome.exe	88
PID 4512 wrote to memory of 1284	4512	chrome.exe	88
PID 4512 wrote to memory of 4160	4512	chrome.exe	90
PID 1936 wrote to memory of 996	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	91
PID 996 wrote to memory of 2376	996	chrome.exe	92
PID 996 wrote to memory of 4428	996	chrome.exe	93
PID 996 wrote to memory of 4356	996	chrome.exe	94
PID 996 wrote to memory of 4428	996	chrome.exe	93
PID 996 wrote to memory of 4892	996	chrome.exe	95
PID 996 wrote to memory of 4892	996	chrome.exe	95
PID 996 wrote to memory of 4552	996	chrome.exe	96
PID 996 wrote to memory of 4552	996	chrome.exe	96
PID 996 wrote to memory of 2600	996	chrome.exe	97
PID 996 wrote to memory of 2196	996	chrome.exe	99
PID 996 wrote to memory of 2600	996	chrome.exe	97
PID 996 wrote to memory of 2196	996	chrome.exe	99
PID 996 wrote to memory of 4024	996	chrome.exe	100
PID 1936 wrote to memory of 4364	1936	2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	102
PID 4364 wrote to memory of 4072	4364	msedge.exe	103
PID 4364 wrote to memory of 1160	4364	msedge.exe	104
PID 4364 wrote to memory of 2056	4364	msedge.exe	105
PID 4364 wrote to memory of 2056	4364	msedge.exe	105
PID 4364 wrote to memory of 2056	4364	msedge.exe	105
PID 4364 wrote to memory of 4500	4364	msedge.exe	106
PID 4364 wrote to memory of 4500	4364	msedge.exe	106
PID 4364 wrote to memory of 4064	4364	msedge.exe	109
PID 4364 wrote to memory of 3096	4364	msedge.exe	108
PID 4364 wrote to memory of 4064	4364	msedge.exe	109
PID 4364 wrote to memory of 4064	4364	msedge.exe	109
PID 4364 wrote to memory of 3096	4364	msedge.exe	108
PID 4364 wrote to memory of 3096	4364	msedge.exe	108
PID 4364 wrote to memory of 1468	4364	msedge.exe	110
PID 4364 wrote to memory of 4832	4364	msedge.exe	111
PID 4364 wrote to memory of 1468	4364	msedge.exe	110
PID 4364 wrote to memory of 1468	4364	msedge.exe	110
PID 4364 wrote to memory of 4832	4364	msedge.exe	111
PID 4364 wrote to memory of 4832	4364	msedge.exe	111
PID 4364 wrote to memory of 2404	4364	msedge.exe	112
PID 4364 wrote to memory of 2404	4364	msedge.exe	112
PID 4364 wrote to memory of 2404	4364	msedge.exe	112
PID 4364 wrote to memory of 4484	4364	msedge.exe	113
PID 4364 wrote to memory of 4484	4364	msedge.exe	113
PID 4364 wrote to memory of 4484	4364	msedge.exe	113
PID 4364 wrote to memory of 3528	4364	msedge.exe	114
PID 4364 wrote to memory of 3528	4364	msedge.exe	114
PID 4364 wrote to memory of 1560	4364	msedge.exe	115
PID 4364 wrote to memory of 1560	4364	msedge.exe	115
PID 4364 wrote to memory of 3472	4364	msedge.exe	117
PID 4364 wrote to memory of 3472	4364	msedge.exe	117
PID 4364 wrote to memory of 1728	4364	msedge.exe	116
PID 4364 wrote to memory of 1728	4364	msedge.exe	116
PID 4364 wrote to memory of 1560	4364	msedge.exe	118
PID 4364 wrote to memory of 4708	4364	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_d0db414308b790a053aefe607d59668c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28bdc728,0x7fff28bdc734,0x7fff28bdc740
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,4321793851616016422,16229139316976045643,262144 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,9602122435900548295,427232012105386140,524288 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2084 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,4774172718528831160,16519220652655887974,524288 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2292 /prefetch:13
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,4274697374873440461,2902516253086611165,2097152 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,6447432991476007019,13831521094248363862,2097152 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4176,i,1369237186021849178,10166552039282163895,2097152 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:1284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,2591612646075673982,4656423548995269360,524288 --field-trial-handle=1916,i,9173104099705689825,6594303697985564030,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28bdc728,0x7fff28bdc734,0x7fff28bdc740
    3⤵
    PID:2376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,2911419785875915506,10300356305177899941,262144 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:4428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,9992180819021627157,7561583680728420409,524288 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2092 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,6540298287453735083,2259490307190568317,524288 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2356 /prefetch:13
    3⤵
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2880,i,4061584061464061562,8857127631308956875,2097152 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2888,i,7348726339842642187,3070712268102141162,2097152 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2936 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4012,i,15160115655540878202,15315461313501055319,2097152 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4016 /prefetch:9
    3⤵
    PID:2196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,3059644249424541663,569732084387669532,524288 --field-trial-handle=1952,i,8617143815646587481,8479844094437702837,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7fff2406c188,0x7fff2406c194,0x7fff2406c1a0
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,6096532792293845633,15885271453503485704,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1532,i,12420699868562192836,1132770293951169879,262144 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,7108376827449554324,9274316703560809176,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,18254312823033805477,4581239745168742074,2097152 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4450960561459555987,421636813340831347,2097152 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4032,i,8501463369708515815,4923770490016384439,2097152 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,1398504191140217464,12943093412655340737,2097152 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:9
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4104,i,9328622737296520092,17235788164006303230,2097152 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4116,i,8466333530129021163,11383923819211407394,2097152 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,13147335163976616503,2016050353886784199,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,1570893297513578621,17803400969312090872,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15453555649783015588,9954692353934013931,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,6406877744880312728,3051923016450855619,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3103891704418763815,14188113475057847002,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,12303337856269514874,16960597307677530961,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,12303337856269514874,16960597307677530961,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,3263293636654287219,7646123738501614652,524288 --field-trial-handle=1964,i,3328965698136342955,12021211212550198691,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fff28bbc188,0x7fff28bbc194,0x7fff28bbc1a0
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,13642283587425194403,8524976805023388588,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1644,i,14637167192453919606,11038806311173378606,262144 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,10260763071682971700,16241986160945369941,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,14338485223039032375,1254013156318517232,2097152 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,16734883221591603204,1377406760565325162,2097152 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,17843125293798129836,7301329354017895756,2097152 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,10241351591346289126,14972732810549211357,2097152 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:9
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,3066060162460992345,12605215209056147591,2097152 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4244,i,14807680717639263029,5573453658916719987,2097152 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,15957485066544790020,17237343761284632722,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,2131338559570080201,13315917264513978501,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,14199019459908599780,4540689378367892745,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,13096031691629882550,3073364248707246508,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,3007668075355693516,822340814440862692,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,3007668075355693516,822340814440862692,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,4287769156227663057,8030166388109706287,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
    3⤵
    PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,2574088243769946929,13624832827287909721,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,4377566490074439132,17300477969006325439,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,2628570794668791357,7679813016146350227,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,1199361114151601552,16870884240421879046,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9845589254577574958,12429656339243383515,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,9500315016901627111,10805091677875377032,524288 --field-trial-handle=2168,i,17661265122395144035,11277520835920099537,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    PID:696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 1e4f54776b1b40b456dd805327615b3c5deffcf2db33e589d5bc6b52bbcd1933
MD5 56b10e1e74b6706b57dde96bf766dbf9
SHA1 56a34e375e70b12c244295648d6e0641f33011f6
SHA512 cf469396d294424e4fef7dd376eea71d95d97f34c8e8a07031474ca3189e64ade1b89bd27e7df381f2778fea721f119ccd253914777f827b6f0f4644ac130a61
MD5 SHA1 SHA512

Submit Download

1b37b47f-fbb1-409b-9598-54456ae00730.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1b37b47f-fbb1-409b-9598-54456ae00730.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bdbf27c0ba1382f102642206b6e66fe1b89af4c5367dcb59a4763b538086afa2
MD5 88feab56a23269309653561b9b261f43
SHA1 a38af0ff9a6232cdc7915774c6bf7bd9fba890ef
SHA512 3b176c101188ee779a17b1420f8e8c17f46821d70f3baac73fc11320ed43ccc4d669a8362dfeb891945c62f5871a42fafdc5f00977ed5464269a274702c1cfd1
TLSH
T18BF0F4AADC21AC3B18FD1B2930640B46F750136B2B80895F3B3D930D8FB567F468582C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 41fe28d165e679b39180039c47b3970d19046b736faf8a2521a3b65b0903baaf
MD5 0e5c012d1dd0cabe24e2b0b223c4780b
SHA1 e64b722eb4d3ef8ac5e2fe43ad28d89dd40997df
SHA512 c67a7208ff0528ca88a1b69d4cb4b73d45f117462908f38ec538606a4f521f4cf6136884d3b1662340833a063f7bcaa1a9362c25b3d1868e8ee9d9f634fc7910
SSDEEP 6:/FoEXEJfEfkN+Y1N75agggSPZL/dnF4kEXh1BFXbkllIhXJTvl:d7XkfEMNXTggggelF4kEh1XXg/G9
TLSH
T1B113176C5688AA13FA5840B87A4A077093F0C11AFB95871732F23662B5C42A19A48310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1785b59358cd8f3545d93b514de9e5770eaa96598dc5ba0e60948482e0d8c670
MD5 41c02c04b05fbd662c9bb3f67b827c2a
SHA1 9659e23409d076d603fd54ab1e0e7c835c418e71
SHA512 795d2c8676bc0a32ebeb4e74ca166a39a12331676b1b1e53f79c7c625b4b474eb98c3b51696152d6479bff32eea1a7e4b9fb5e11de082a6dd3e9d3d5a5a553ae
SSDEEP 48:0JijRYPzDXM1XgAXOtMmXWveRNOdVEPLVBKWwtlG:0K+PzDXugAOtjW2fkVOLHKWol
TLSH
T1A944A8F71C00EAC3E625DAB86C41932C8E3346261C95EEB6F63844A25590AF3312C671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 751597dec161e266d9b50b85cfbadf0c77321295c972cfe4b3978f297d578a82
MD5 d2f59e5cf52b85ff131121ad9d77e722
SHA1 f01507e2fbaf25aa43bb25ad8404eefdebe3b64d
SHA512 ca97edc0556aea91377916418d9c2d1113e015aed42ae3b72a2507f3f9a7aa30147c62229ad8a5539f6550be819394486c30896a3131b12ca9c7cd47c82365b9
SSDEEP 768:vUfDPLSgcRUv+644qziK4tiK4fiK4wUfDPLSgcRUv+Wahv4xUfDPLSgcRUv+v44e:U4AKRKPK2aN04z4
TLSH
T14F162BB74F24B986E681EF70BBCDED1C7C742395EC925882E122927949F0FC51B8115E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 f0181004dd99486fd046b33f2efc728d9cb2b35da640ec78ac48a4c75c5ede96
MD5 9dcfa201d732000d40bc6c2b2858dc09
SHA1 a7baffc9847dd0edb933cdfb20d1a45306f7d080
SHA512 48de02da2229ff8cc48a712646bee48e6eb2cf9d4ea46f4107c6fafd51cd3ffa1b7af9ea84aecbea7959381f8c8145b7f92bddf3b1e99cc4030d81c257cdd05b
TLSH
T12DE086882ECAC16E609584B3D774B30DDBD13405B6C838821709D8C672879256AD52A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 cab03baa7cb304714b2bf1e522b7c07d59fcea44a0ca45e263e2f3f217eb7d6c
MD5 da168ec7ab4c973c8c60565206f627ca
SHA1 1f1f5033f7049632f9432366e237d5b5a736ed95
SHA512 975aa6dad0c6acca50df66d12b7d916055cb43f34065a2fc79485ecd3a5e0ff7964d48b0874dd11eaad26c140c9dc147a23936904c6bf817958906141697354f
TLSH
T166E0CD8938DAC26F5585847307A5930CC6E43406E7DD35821700F48772C651CE5D7691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 106B
SHA256 3a0abb41f1f0fe1382e1a68d716c9fe77e222a518a2d468ad4c98dd82b8f3b15
MD5 c441b448b2ed3281ec2d040b40aaf8a3
SHA1 0cdb52276b299da33a381dc57c23a987a4670eab
SHA512 3eeb4f51e1f68b6ffda74ea9e6b027744e1b10bb30fae8f97790fd82874252a177e57bb8c9a291b4664b0116d00336576cef016d6fad344d375bbbaa0f0f9f53
TLSH
T1FEB001F3FA121121D5039DFCA0206796A736A529024A55D1460901356AA9794361F99D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 401B
SHA256 fa6c9260639dee439ab08844fb18f8ef3d0298800f415865fe00e061a11a2e8d
MD5 3f1b404eb4d7662e14c98273607a1c2e
SHA1 615a40f23b5e5b86f01d8fa8234402e3e53bcdaa
SHA512 9f5baa26741ef70ef922680b32852d2546a43b31b67fc9790448c0c9eaf0629d2ceb1edd5b238b0a15a6981326780b07f96cd49f3181f874eeca245b9682369c
TLSH
T1F9E02B4D7ECB855E2057907FC765974EEBF1340EA2C936528F0AC84521A2118D3D1696
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 0f2a3354547be10520868d590512b886d43e6b3106642e6369dd51569351fd74
MD5 14b72b7e896886f6792be790d5d5e255
SHA1 4dd6b8df281fc4005697cdd1477d7075169dc345
SHA512 c8fc8e737f909c1e0cd651aa2f212e6860a126319f15821896e82da95478545b4d5a20db8894379b24b5a4cfa7bc42a07865656d105f2ef92a7e44a47c05d97b
TLSH
T163E0D8D95CCEC15E3305806B4718770CE7E13405D6DD3A410B00E4477189418D7C12C6
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 f9d074cd1829ea18866a71c7d33afd4c41ced1743add639f3a40b0fe79ba46a7
MD5 34af16c67712e37f936f944eccf25c23
SHA1 4ae89a0c41b24c60ce5c559d3eaf5e8fe1e23a0f
SHA512 25e92b1cd973d844be1aa5505e8af15927f57b168d9b9615dd2dc9bd7564275120129e687f1b7e2787c2e33d75c25510eac66d085cb185dd2f52ce896fe97e03
SSDEEP 96:F1mKgM6RwcnDh1JpNPLXbXFXKXTAFXSXTUXFXKXTNxhXsXoL0XbXNXKXT2uZXIGj:F13dFmDhRJL1ajyCjU1aj98dL9ajp4Gj
TLSH
T1A0A15D6EB90A184EE46D4937CD78571B5FA9CF0C27FE3767A9DF8A0405B0A5701086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 c94a7f693a96a7237c9cdfd9e87374102abe493a53feb545b323546e980cc0dd
MD5 8a07ca503c665cb480750b62d43769ef
SHA1 369f8843c41676f1aad4e7256eb50f44075aa1ca
SHA512 8832d0a7dbe08e734e4c7f48ddb56c4c47e32bc879134e615363091692b784779b24370fcfd54798c2c4c6d42b8ce68925aaa8e4a2f05249c9e78cd5f8f65c04
TLSH
T194E0865439CAD1FE305780A34770A34DE7E47416DACC78421F45D54A23C695879F2265
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 121KB
SHA256 d0c08f31de1f646818f0925112077cd3052b50d4fd18ca75d1d3ec5af9281df8
MD5 842897decb46b70d70b3d543e82db7c1
SHA1 79b8d93aa9c3b6dba587a199ccf489b7527fc859
SHA512 9517543c7f24815d3a2d7e24c09b5a4af11c47509ce2817b89a47c16fbec88a14c92ae38540c23c522bb6259b920fe3709ae50d3689d8c5420b24d00c841daab
SSDEEP 3072:r3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sz:rwB34GASx/DLETz
TLSH
T1B3C3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a473248953641b_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Size 303KB
SHA256 25b583a14f9a359586c3f3b70d84cfbeef554c90388e55a3febd41f84b6e7960
MD5 fd63155915a635fbc6b9510bcb607d7a
SHA1 a8aed1f91808855b8cef07500a9b9e121c593b39
SHA512 6d725dbdf095cf2dbe4e23fe9949b84576ca28910c7a1e0039e0d84b19baf23c42642e5b5dc5a73745bcdf30742e0c9ada20e156e5598e8cf8c54e204f14025a
SSDEEP 6144:l8LrkR+b3WNv4Txz3ZF8LQBiWla05uQ9Cwp5flYh4nmR4flvmHSpfy7YVLF9qrPL:3YvIvXFBH
TLSH
T13364084697601667CD7303FB0A638667773982483FC7D30B25E257B96C223F3E98A949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b2daaff43bc36d6be48381c5ee8678fd056de8cd83363ff0ea02a1a0708eb360
MD5 f74f6ef72352365d1a382e3dd67bfc26
SHA1 4344ef4ba041196a7b942421a86d6c5b181fa1c8
SHA512 0635faa100b9554f34e0643dc92b1950301ac1a9e9e286c02791eb766bfb681b56dae31bda0d5d111888471f3ce2159051f0e182a80d111c3466c1b05b1b599e
TLSH
T141B00255C112A322C04603B03DAD99E9F176DF2BC617121693F01A67DC25AA04A25664
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 289B
SHA256 0768e811c51ac61a8e573ac6b53f89dbb1d89eb2fcf62536a9a5f730329c584b
MD5 541c42f1c98b3e1b011d22eba854e707
SHA1 db30188de1f22e3077e7044be1386a5d0ecaed9d
SHA512 47828c1b40deb8d37d6ff4fc8f7673fbb59b40e07f54f0fa4121b91941160134c251e20f7f28f7ee5185f3c8aee2b7e95a1bef573bc64c68912016accbe90604
TLSH
T1B2D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 3bf1fd35d7c9151bc3a619c29dbe76fef59df8b5a66c8abf6a6b335a50949010
MD5 d880722d435ea6dc88c660a3b7fe1cd6
SHA1 5a954ede06eb98056da593c832a5751935011de4
SHA512 f35ddb6767326aa8b89207a24da8fa9ac9addc502c0f0193aded5b48b27a7e6033849251356e60629ae12d82c42cd88a532325b3c98faadfa62ca1b40a3b688c
TLSH
T173E086DD2CCAC1AE3256807B0B68730CE6E23405E7EC39421701D447338A814E7D1295
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13424502517768304

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13424502517768304
Size 1014B
SHA256 d22d40df1ddf63d5f28a540d2b26f87bb1b711b229c8bd053138fd6787df375d
MD5 2cd38ee8ed997f907762dbc41c1f2f0a
SHA1 1553f05e73bd03acaf0d5604472a4e310160c6e2
SHA512 a98cced73255acf1c2a9650cb42aaa2cf28357b91fbce9c8dbc4b847a5ae56bb1b27fcfacfa68aae0cf8df46b51bccac6edce1f53814f00ef5611040b0474054
TLSH
T1C111282638D01DBAC77A453F914995E2AA3CED5261890E872152336541FF261DB12EC4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 452f54602dc77359ed229dcf73f389da60c948476a54ca119b3542d780efe31a
MD5 da24e16b93945adeec0ae633df69e7bc
SHA1 d0c52de650565a55007505b81177bdbe210b0c72
SHA512 47678451f83d6a78e535207b69dc637a238175d346b20fcf678ee9e2b332ac7d78d2f9043e8929b7445d59c8c5114875f6a67ab3d404a15ec0b35af2c84883a0
TLSH
T15EE0D86579CAC6AF2087806B5315F30CD6E37401DEDD24521B04E185638640876E3241
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 f96e8be36efacb94a736baaf896a6a9fb7f8e2c670039966e2dc4d4021352391
MD5 a2af759329ad6e23d7d9e77e8335ba85
SHA1 6a768829f59b0aa58f543d6aa2f1c61cdf1bdc45
SHA512 4ae0ab479e074826a707ee2af4d76e2622082d56a9ecfb54adace2bb7eeaeb688190da37880872d4af6b36b38ddd98b16eb745f6e7ce71730336405d89c8791b
TLSH
T123E086B46DCEC6BE3046C0A78764B70DE7F078059FCD39865704D44A72C251865F5691
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 de1f89c82986937bf6257ebcb9de2c84bcab7a52f014bdde901716ce6766ce70
MD5 22a48093a3fd9d2a6778b646f4692c61
SHA1 16c0138009c01015d9d46a000707557aa0190318
SHA512 9017113b87af5ed7f633013b4bf73c45049ac310096bbcbfa50af82526ca85b28a986b8b15a61c2aae4acabb36f085281dfb4ae40dc05617e3268b8734f6f899
SSDEEP 12:0pllqVkduQlQRXXwX4jKrRmLULIlu1qVkdrz:05QkuwQRXXwX4urRmLUL2u1Qkrz
TLSH
T1D34268CEB8108647E423403CC6DEA9D23D6ECD683F93290A18E4A42C2CBC103C009BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 b80902e3321781a99e6aedc34f2c2375d9166d9f06e3d3c94b5e3130a2c7de11
MD5 48db6657bf421dbf3811dda3d19bad82
SHA1 63db4b4e42c9c9c8434b40f016c053bd46ae3532
SHA512 cf6b3856a98e9ddb7aa3535d8ffdf6284331fbaf5c1b5526910146f40a1d62d82c90324aba1f763fdd12929fe1df9b43e615629311c4f7fe7e466e2b8bb663b1
SSDEEP 384:o52+sdGbf7QXIIImbGMIMNBAJoFsdGuz24f3sdGkMIv0sdGyo:+f7QgzGBo
TLSH
T11EA20996A3B41BA9ECCFB3FB78548D2E3B729C894466004170D55A7A3C33E8649C2397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 83073a0011fb942a667934e33e7a35341d9f3cb794691570b0db43b2bec09261
MD5 35949456b5b7a807c296de3e6a01b66d
SHA1 b5659b91693ba2eb1ee753b725ba835fdea13ab7
SHA512 ae97972d139d7ca884fecba49d76206cec848b4dd5075995d5e9fb68377fe59884299f983d7535430b4ee5468dcd9d116d2a5ae060b2abea61ff7123eba97e31
TLSH
T1B4E026847ECAC5EF70D580E74330630CE7C13802FBE824C60F00C8CEA28342469C1281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 4ac2beb78759bfb618ccae9e664f9c4b55bfc6f2885951380abd64ac02c94ec9
MD5 ffcb15fe379661e388b80ad48d597656
SHA1 8222352f8fedd116fa1b2c782c3fba244c405bd3
SHA512 74018f7a1e631a9f242f6dd2ea767029c965bef93a614f0cce2c7d496653f9c7634fe659206e2725f8d2f4c04d3ec1192f59c9abb7f119c49a1bb689c825cf1a
TLSH
T194214CA6F331C249C649873AA43EEB251374D4669FF8ED0F51B520783E76E040D4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 9d86f91357e3aace1262840dba81b6bcaedd4b04005fb6f126681f5b586a81cb
MD5 24b94044cfd682d328ab5063b2a61185
SHA1 339b7e6a5d5b29cca629ccb5ffb57c763141968e
SHA512 5c5a4495ce7d9f9f6d9faf3b4b08f6c031f6f92b8fe0a21783361a7fccef71656612ce1ddccc2ea330f8a7966dd890b2cff6371aa9e0cd123afe0babcecab56b
TLSH
T17BE0DF847DCA85EF609180E34370A348E7D13842FBE82E820F00CCCEA28242479C6281
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bb50b3613b2c3b59a2eaaca34ae997a629aba33d206325e0ffd9d8cbec71f064
MD5 74595547473a19cb7b7f786317c85be6
SHA1 70fa2d82131c3782f0f9a03a703ffb21416d9a7c
SHA512 7488a3f42224233d480124afceb5dc1ed75e5972ef402c7624a415ab7134dd84b70548041448fa27c99c0a57f593bcc74ce8dc89deb0ee40491fc2661340b196
SSDEEP 3072:E8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:SwCcmXKegIh6jh9JvexhQ
TLSH
T12FB3125A28273DA688BC6EB37457338286A357E26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 13ae7d4e7da3e87970532f49a8686025d4122bd0ef7812eb92863603ae49a9cf
MD5 894dac739eff07e4463caf596f9d90df
SHA1 41ac6f29af4f4f01f8be3cb08503214335e8a666
SHA512 94d597e0d2982490cdadfcb784fd2772fac608cdff130e711bcb7adc8bbf14ffe2780c3836c3e4363d85b64c684bdc30705a2430d1c69eac4d011cc35bef2866
SSDEEP 3072:x8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nC:HwCcmXKegIh6jh9JvexhZ
TLSH
T166B3125A28273DA688BC6EB37453338286A357E26C05F14E90CCDF0B45DDDB415EB8B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bbd199bc7bda9ec12bfd4c2127df8e23ab5a7f93b8f3e2daebd96e76d6da4110
MD5 d57061f0b5f0720510276bd69ba84d58
SHA1 e6ad517a23244452083bcf090504b333ae844f23
SHA512 9ec65e2412f4538450b84c9fd3a459bbf26625812c37104b73a11d7d4130c9113b7302637b4e62898a14d964fc47e3f2e25059f57528039e51a59f60099093d5
TLSH
T17AD0235B1E3934D4FB74427550E3C7441B9C709707412A5663DC9C64C8F44F10481BC3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 981ab398cad8775803967a8dd9c7122a991adc46fff94fcfd389749dbdf60f0e
MD5 850e051534dbc8d2cb5ca1a69897a4f2
SHA1 9d7de5c74aa0b59b4de313216ab90dac7cea292a
SHA512 032542e81a1d6cae1b3726e766eb072a31dbe344c5b538011545da7c695761acbe95b6ab6b2c2e54a755d7cd2a8685e1adb002c3852faf36c5847c24147554d6
TLSH
T1CAD0805F1F292444FFA4427154D3C7941B5D705546156D5252FDA96484D45F101411C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a15a3e839138c7906992e44db34d3a8cc0f946da67a2a988c67446ba9d141298
MD5 cc4fbfa288f9ea8b686b25ec2f5c7df7
SHA1 e2de9a4aaef768a0e3b434d9e873ed6c996fc776
SHA512 8eda87c6cd5f0df1dc3dae556c73019cd77798c98d6875eb632ad8d6538bbdf1c25c0f9ad7622ef0b2efa2a65bcd744dcfffedd844d8870672a09429cfebff96
TLSH
T192D0805F1F292444FFA4427154E3C7941B5D709946156D5252FDA96484D45F101811C3
MD5 SHA1 SHA512 TLSH

Submit Download

a764d144-93c5-4a59-8316-7fd763e203df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a764d144-93c5-4a59-8316-7fd763e203df.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c1134b9de9cde36179f0b1477fba0c5beebb65d26cfb091cba9a8c2ed36550b3
MD5 8c764bb95ac844f8440c277012eaa0c1
SHA1 d328cd880bf742bb2f5128d17da59e32c4144f92
SHA512 d4506a29cd63cbaf55408c6ea374467e11004b3a51c9a301b6f43cd86f4d41df3909d44503031ec6398957dd6ff542384e958c894caf742a81a151dcdd22f3cf
SSDEEP 24:KdUf7QxaOdG2S4Oq+hIj8SKixhaiS1E8CSmQMR8MbyXYpfEvWazdbXf4vT+2IjDz:KoVIpKuMkbyhGInK/aoXyBeIXK7a8Q
TLSH
T1A091469272FA46423D7E250887578B276A45F6A33019BC3B77A810724F66E235CFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 02af31fdbd5fae0990aef3750f5875003d7ee4612da4148314d5079920f412ee
MD5 29dd30440d2b647563ad4953e3898930
SHA1 eb868d7ec2f8055f51ea34de59940f4be8327fb1
SHA512 af3dee2cf9bc473fe59c18f621a2d56bdc6ce0e3efbe383fb4bd8afb8e7d7b735955ad0f7048e196ea1d120d8e88bdded03c665395a626c42e636d996f3650f9
SSDEEP 192:1GNU6t6H3ZyQmiUyEmm2Hq/rUH5mXhHI+2GbJsn09GYqHI:1GNU6MXZuH2Hq/E5IpI+2GQVI
TLSH
T1EC222838A8786C6B8EA3DE51F48B77174F98226FE7C55F94E9E40A1C41CB29C1307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e517b334c3e23abe425d0d8128697b5e26bf6a5de6ae6eb634ec4a3d640548d7
MD5 75cec34b95615d31f890bde7f159df08
SHA1 dda928e2d53fb08f35b040f07eaa7f98b965faf4
SHA512 4956507f7d9e5888fb3b9cc508b5fd8a96b71ba472a0172a55581f3521e98a147c2849b75dc259a2e6f3f5f4d1a530de14fd2c1ebcc0f2498085b5c887558343
SSDEEP 192:1GND6t6H3BQmiUyNHBHm2Qq/rUH5mXhID9MD/U6:1GND6MXf642Qq/E5IlrU6
TLSH
T1AB02F93878ACACBB9EA39E05B48777179F95216FEBD15F84D9E81B1C41D728C1302932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86d1368d0a934f983b1d2b6ba148481f97c732c0c4f79d7a98be267313646b8d
MD5 3a32c8f8ca76d6581f7c08d7743b402a
SHA1 7c5b9c6e0ca5a5d1024716297ab73285d18ccd0d
SHA512 febcea042ceea6887e95024ac49087f20aff24d9fbe7ff53465910f4af2db8e65cac1eb2920ee5651df6228f7a0eb0ceeffaf36ed8e99f84ce373ff96be376c5
SSDEEP 192:1GNC6t6H3ZyQmiUyE0m2Hq/rUH5mXhHI+29/9nCqKU6:1GNC6MXZup2Hq/E5IpI+2rKU6
TLSH
T133120A3868ACAC6B8EE39E11F48777174F94216FE7C56F94D9E80B1C05CB69C2306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

22989e9f-7e08-4e04-ae3a-4700ad403e20.tmp

Path C:\Users\Admin\AppData\Local\Temp\22989e9f-7e08-4e04-ae3a-4700ad403e20.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

30d40e1c

Path C:\Users\Admin\AppData\Local\Temp\4ac00115\30d40e1c
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3025063-a4eb-4937-803e-05db2bde9501.tmp

Path C:\Users\Admin\AppData\Local\Temp\a3025063-a4eb-4937-803e-05db2bde9501.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_1166182051\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab40e35f-198d-409f-9fe7-c27a1c0293af.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_1166182051\ab40e35f-198d-409f-9fe7-c27a1c0293af.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-297-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1032-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-161-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-163-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-164-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-245-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-306-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-0-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-303-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-49-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-78-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-88-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-79-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-31-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-17-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-444-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-458-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-465-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-554-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-460-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-16-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-15-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-14-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-13-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-12-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-11-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-10-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-9-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-8-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-7-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-6-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-5-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-4-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-160-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1086-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1107-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1070-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1108-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1087-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1160-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1161-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1162-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1163-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1166-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1177-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1164-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1187-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1165-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1195-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1200-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1199-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1198-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1197-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1196-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1209-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1212-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1211-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1208-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1215-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1222-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1220-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1219-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1218-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1217-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1214-0x0000000500000000-0x00000005001D6000-memory.dmp

Download

memory/1936-1246-0x0000000500000000-0x00000005001D6000-memory.dmp

Download