Overview

overview

10

Static

static

3

2026-06-02...ch.exe

windows10-2004-x64

9

2026-06-02...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 21:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_9f65fda2bb79d64f821b32c4a0cc85dc_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
  • Size 2.3MB
  • Sample260602-1l86vset4z
  • SHA256 61ed703f0bcb4baf9a90fc8ce8ca0a2fb7db558cf493d3d2920f442f884ab00e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 64 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_9f65fda2bb79d64f821b32c4a0cc85dc_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_9f65fda2bb79d64f821b32c4a0cc85dc_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bd7dc728,0x7ff9bd7dc734,0x7ff9bd7dc740
        3⤵
          PID:3184
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,5386107351741230068,15617953927702238395,262144 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:2
          3⤵
            PID:796
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,1685538324190140286,1561840824139212781,524288 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1780 /prefetch:11
            3⤵
            • System Time Discovery
            PID:1764
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,10078217038041310914,15174546557186793461,524288 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:13
            3⤵
              PID:3200
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2996,i,1988867504407634996,1728836371369982030,2097152 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3016 /prefetch:1
              3⤵
                PID:4204
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2980,i,2247290442448695552,3189195035655882676,2097152 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2992 /prefetch:1
                3⤵
                  PID:3868
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4156,i,16886792769860521576,9821149595728497266,2097152 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4160 /prefetch:9
                  3⤵
                    PID:2136
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,6319311022689653556,2265110613713351441,524288 --field-trial-handle=1888,i,2039129059029195908,482596836066433926,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5244 /prefetch:14
                    3⤵
                      PID:3284
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
                    2⤵
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:2392
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff9b456c188,0x7ff9b456c194,0x7ff9b456c1a0
                      3⤵
                        PID:4980
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,16242462135518186628,16587034512916461800,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
                        3⤵
                        • System Time Discovery
                        PID:1352
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1580,i,7903851101716361614,17547575673770017181,262144 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
                        3⤵
                          PID:4132
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,8993494037488834987,11653223174896906243,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
                          3⤵
                            PID:4436
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2532,i,10185768439093371062,12814861351736078855,2097152 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
                            3⤵
                              PID:4468
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3172,i,4397454370709355424,14600614945151945525,2097152 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
                              3⤵
                                PID:3504
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4036,i,15593657000283527735,14489348558135454345,2097152 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
                                3⤵
                                  PID:1744
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4060,i,2049054972462666640,14379672209060177520,2097152 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
                                  3⤵
                                    PID:2184
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4072,i,7890512413821671263,2204776629431021977,2097152 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
                                    3⤵
                                      PID:3452
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4048,i,17010740147529000727,10245989904163388946,2097152 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
                                      3⤵
                                        PID:2256
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,3486484265429983001,10271806406576712668,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
                                        3⤵
                                          PID:964
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,13213701113141306550,6194842251677192786,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
                                          3⤵
                                            PID:2044
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16753847705735437325,8233302283623653014,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
                                            3⤵
                                              PID:5520
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10210037026391732557,15769789031180791346,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
                                              3⤵
                                                PID:5528
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,17655773884234715375,6180680083607732426,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
                                                3⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:1852
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                  cookie_exporter.exe --cookie-json=1100
                                                  4⤵
                                                    PID:5344
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,14475753670061443691,16998146516741659024,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
                                                  3⤵
                                                    PID:2732
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,14475753670061443691,16998146516741659024,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
                                                    3⤵
                                                      PID:404
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,5751263532853470433,6431874833963556236,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6020
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                        cookie_exporter.exe --cookie-json=596
                                                        4⤵
                                                          PID:3060
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,16360608733032185800,10354897655802504538,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
                                                        3⤵
                                                          PID:2792
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,17986566705323174118,8141583859756869782,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
                                                          3⤵
                                                            PID:5920
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,4106099684045328542,8755519293519709393,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
                                                            3⤵
                                                              PID:5588
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,2602828191754500143,1251082557230798261,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
                                                              3⤵
                                                                PID:5628
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,12420330016816628335,6394326702840533718,524288 --field-trial-handle=2136,i,3060169906206378848,8788349492008322197,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
                                                                3⤵
                                                                  PID:1056
                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                              1⤵
                                                                PID:2640
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                1⤵
                                                                  PID:4128
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                  1⤵
                                                                    PID:564

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        BookmarkMergedSurfaceOrdering
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                        • Size 6B
                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        BrowsingTopicsState
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                        • Size 649B
                                                                        • SHA256 e909e1fc310a0d7f96fded014be6895ec6274c5b8a5e3cf49602603684f135e8
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        SCT Auditing Pending Reports
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 1e8f0f39b4a8e3e9334069763f9f547bf0e532c7ce898393931d2e2242972b54
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Secure Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                        • Size 17KB
                                                                        • SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Web Data
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                        • Size 138KB
                                                                        • SHA256 d13844eb77850ad66273189dcbd75238ffffd79795d1f9eba0cf29b49f5739ee
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 232KB
                                                                        • SHA256 d9cde3500238e67aaec97c55ab188061da8a0a63ab2463ed7cfb9fab2a5f953d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 115KB
                                                                        • SHA256 4ced8edadb75bb3547d25571ca57a0f0568ee2e987d8756ff211b58dbc22c2ae
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        SiteList-Enterprise.json
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                        • Size 2B
                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Edge Profile.ico
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                        • Size 70KB
                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        HubApps
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                        • Size 106KB
                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        sync_diagnostic.log
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                        • Size 4KB
                                                                        • SHA256 3cee886c0dbf703e5f43ecfd4e617cdbbfc770ff8bac12a676a1cdafe0cdb6e5
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Web Data
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                        • Size 224KB
                                                                        • SHA256 a1460298de8e47d1b1659a9162f4ec64b668d172d66f9dfe5453a840be71a81c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 8KB
                                                                        • SHA256 59c085da447b7ba3da3ee6ec26a29f213dc4c700cb9ae9a48abecf2a51f58cef
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 8KB
                                                                        • SHA256 6b00565fe1278c987b6fc6977c52b376cee38965bbb2b10aee936f38cce7020a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        87361b04
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\42af0883\87361b04
                                                                        • Size 40KB
                                                                        • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        9355c06f-9fda-480b-903b-7f20c43a3739.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9355c06f-9fda-480b-903b-7f20c43a3739.tmp
                                                                        • Size 10KB
                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        b6affc93-fd62-48e1-ae09-c5b1d16da171.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b6affc93-fd62-48e1-ae09-c5b1d16da171.tmp
                                                                        • Size 1B
                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        content_new.js
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2392_1399132832\CRX_INSTALL\content_new.js
                                                                        • Size 10KB
                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e12da347-e0f6-4594-b124-839cb39f258e.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2392_917417925\e12da347-e0f6-4594-b124-839cb39f258e.tmp
                                                                        • Size 147KB
                                                                        • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        memory/904-117-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-111-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-21-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-53-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-73-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-81-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-120-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-125-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-143-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-146-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-145-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-144-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-142-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-141-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-124-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-123-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-20-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-122-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-121-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-119-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-118-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-0-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-116-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-115-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-114-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-113-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-112-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-110-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-109-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-108-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-107-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-106-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-105-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-22-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-83-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-82-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-80-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-79-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-78-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-77-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-76-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-75-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-74-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-72-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-71-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-67-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-70-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-19-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-18-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-17-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-16-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-15-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-14-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-12-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-13-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-11-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-10-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-9-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-8-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-7-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-6-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-5-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-4-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-3-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-2-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-1-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download

                                                                        memory/904-2650-0x0000000410000000-0x00000004101E9000-memory.dmp
                                                                        Download