Overview

overview

10

Static

static

3

2026-06-04...ch.exe

windows10-2004-x64

9

2026-06-04...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_d6b97c41b81fd78a624c0f0b510e4d42_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
  • Size 2.7MB
  • Sample260604-e1l4zsaz5l
  • SHA256 7e0fe767724a5c52fb25f6ce902ffc95e0d2b1fdea895600f2212dda855c6c68
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_d6b97c41b81fd78a624c0f0b510e4d42_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_d6b97c41b81fd78a624c0f0b510e4d42_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffca823c728,0x7ffca823c734,0x7ffca823c740
        3⤵
          PID:3056
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,7848084522818176385,4281874073327505019,262144 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
          3⤵
            PID:2496
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,935548816654776813,7718995086764650472,524288 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:11
            3⤵
            • System Time Discovery
            PID:2544
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,12213402992772996843,979569197999908754,524288 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:13
            3⤵
              PID:4316
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,17833614940857907085,9983643196271312002,2097152 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3024 /prefetch:1
              3⤵
                PID:2804
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,4919797903489956179,9294329360072691610,2097152 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3004 /prefetch:1
                3⤵
                  PID:936
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4020,i,13599489567586447778,9377345666468866464,2097152 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4016 /prefetch:9
                  3⤵
                    PID:2220
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,17691630172459267170,17590034630995155695,524288 --field-trial-handle=1944,i,1723290340348377882,1035298747240579326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:14
                    3⤵
                      PID:5240
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
                    2⤵
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:5500
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffc9430c188,0x7ffc9430c194,0x7ffc9430c1a0
                      3⤵
                        PID:5524
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,5861995907813116240,2177511464995206540,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
                        3⤵
                        • System Time Discovery
                        PID:5760
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1652,i,3288884607622137279,6082398277184972656,262144 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
                        3⤵
                          PID:5768
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,3217569433942853304,4619313843949996356,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
                          3⤵
                            PID:5880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,1247837792517915970,17475226749618287480,2097152 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
                            3⤵
                              PID:5984
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,3887553895692677030,18414013452836406780,2097152 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                              3⤵
                                PID:5992
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4052,i,8044136454120015829,5045953503260030642,2097152 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
                                3⤵
                                  PID:6088
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4100,i,4928752043793923326,17951268053809336762,2097152 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:9
                                  3⤵
                                    PID:6108
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4072,i,7327923606946415162,7748061611258967059,2097152 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
                                    3⤵
                                      PID:6100
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4088,i,1815881603753021830,7580171837148770967,2097152 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
                                      3⤵
                                        PID:6116
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,967286122594504289,8002436510054282752,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
                                        3⤵
                                          PID:4312
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,17808268793231253780,9978712282116992299,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14
                                          3⤵
                                            PID:4220
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,17098353057663748661,17084380911434305405,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
                                            3⤵
                                              PID:3548
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,8512461187391633353,16927629793904316682,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
                                              3⤵
                                                PID:5328
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,13806240585219099824,9887163791434456884,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                                3⤵
                                                  PID:4372
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,13806240585219099824,9887163791434456884,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                                  3⤵
                                                    PID:1860
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,9242879098533069301,14685003800555379776,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
                                                    3⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2224
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                      cookie_exporter.exe --cookie-json=1148
                                                      4⤵
                                                        PID:1912
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,13725925266820749980,8884536180291372405,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5216
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                        cookie_exporter.exe --cookie-json=592
                                                        4⤵
                                                          PID:5000
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,4797423950607913091,15271850049317469808,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
                                                        3⤵
                                                          PID:4652
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,5269163195014263185,12027594181639811989,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                                          3⤵
                                                            PID:5340
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,17916772511470896179,2088644499817475010,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
                                                            3⤵
                                                              PID:1616
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,16781817092662252226,16769948562961923687,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
                                                              3⤵
                                                                PID:332
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,10821091148309357016,8871663086251811447,524288 --field-trial-handle=2240,i,10612257787602689547,8404781407160766603,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
                                                                3⤵
                                                                  PID:1260
                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                              1⤵
                                                                PID:652
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                1⤵
                                                                  PID:5428
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                  1⤵
                                                                    PID:5752

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        BookmarkMergedSurfaceOrdering
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                        • Size 6B
                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        BrowsingTopicsState
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                        • Size 649B
                                                                        • SHA256 67b37cae93ea4693e2b6296be2f8f2701ae9cffe15ed99cccabeadecbf0ec12f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        SCT Auditing Pending Reports
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 76c922c567f424bd573300931eb90df3a4b03faace7e10c96641c2c086d6da03
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Secure Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                        • Size 17KB
                                                                        • SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Web Data
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                        • Size 138KB
                                                                        • SHA256 ea7c02469c2990e85057d2af6317e324db0da87a6eb4d4518c744bb5ebbcd4b0
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 115KB
                                                                        • SHA256 cf515f7e20f9dc5115b2fd4fd5e88b5b48f568c0016e41cbf0ebc5bc406a10cd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 232KB
                                                                        • SHA256 f72cdae770c74e3eb3c009f2b8538cc436c0e115a9b2c7b4071f090cf72273fa
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        6e011225-3582-4917-ae34-70d64654614c.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6e011225-3582-4917-ae34-70d64654614c.tmp
                                                                        • Size 105KB
                                                                        • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        SiteList-Enterprise.json
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                        • Size 2B
                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Edge Profile.ico
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                        • Size 70KB
                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        HubApps
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                        • Size 106KB
                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        sync_diagnostic.log
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                        • Size 4KB
                                                                        • SHA256 dfad0d858d65bc292202ec570f3d613c9f4dac9ecf500cbe2b0596fc749b7409
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Web Data
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                        • Size 224KB
                                                                        • SHA256 2d9ac36648401d8c113360ec3ef1d51aeb57d23aaa9f444e88f2c2c99ea686c0
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 8KB
                                                                        • SHA256 c59f0e1efc9b1d8b2894b91ac2293d53d888bc2bba2eea5dd836983fb3a344f6
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 8KB
                                                                        • SHA256 5452b22801c85c996a30cac4a9e2f62aa992821f704d4e69e0b707428efd5d99
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        331c92a0-77ba-4a95-809b-83ba773c89df.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\331c92a0-77ba-4a95-809b-83ba773c89df.tmp
                                                                        • Size 1B
                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        ae300cad
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\84961c10\ae300cad
                                                                        • Size 40KB
                                                                        • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        fb64bb8f-a9ee-460e-9713-a0fc52bf1e08.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\fb64bb8f-a9ee-460e-9713-a0fc52bf1e08.tmp
                                                                        • Size 10KB
                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        14b1f2a8-3a6c-4359-b412-4f33c23b44ac.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5500_240138547\14b1f2a8-3a6c-4359-b412-4f33c23b44ac.tmp
                                                                        • Size 147KB
                                                                        • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        content_new.js
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5500_835395466\CRX_INSTALL\content_new.js
                                                                        • Size 10KB
                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        memory/3248-605-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-738-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-167-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-161-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-80-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-79-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-164-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-160-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-213-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-290-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-295-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-359-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-305-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-360-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-354-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-353-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-446-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-540-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-531-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-561-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-87-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-606-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-600-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-748-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-800-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-817-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-812-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-811-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-801-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-810-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-784-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-746-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-741-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-78-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-737-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-689-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-599-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-598-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-601-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-448-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-445-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-433-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-352-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-296-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-212-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-86-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-49-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-31-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-17-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-16-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-15-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-14-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-13-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-12-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-11-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-10-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-9-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-8-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-7-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-6-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-5-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-4-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-1-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-0-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-211-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-177-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download

                                                                        memory/3248-2784-0x0000000320000000-0x0000000320222000-memory.dmp
                                                                        Download