6612647cf0695049791a4cca0be9ef3eec9f397e33f31b6464252f61839c3799

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 3.2MB
Sample260701-ma5gmsbv2m
SHA256 6612647cf0695049791a4cca0be9ef3eec9f397e33f31b6464252f61839c3799
MD5 2cc45e54db15815c229cfe3b420c9cd4
SHA1 2ae708644229e152963bb438509f0bcde5aea7b0
SHA512 56d661ba3fb1e4e018ae6e761f736b7ffe6da8fed26ec8049ca232fa794df3fe76f42c426ed57cee55b3aaed927f774219c5d655784596297ac5b53c65f8aeb1
SSDEEP 49152:YIx8J+vGZERtBgNClRkEHvR4/n9noh0Ww2Ln8OgCsDp/L:YpuwnNWwO8Z
TLSH
T140F56A47BCE509F9C0AAA23188A786967775BC090F3123D72E90B7782F727E05D36B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 3116 created 5040	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 3116 created 4656	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 3116 created 4460	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 3116 created 4856	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 3116 created 4872	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 3116 created 1216	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	94
PID 3116 created 712	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 3116 created 5040	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 3116 created 5040	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 3116 created 4856	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 3116 created 4856	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 3116 created 4044	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	106
PID 3116 created 5428	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 3116 created 256	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 3116 created 3176	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 3116 created 1568	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 3116 created 2040	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 3116 created 3352	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	114
PID 3116 created 1464	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 3116 created 4044	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	106
PID 3116 created 4044	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	106
PID 3116 created 3176	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 3116 created 3176	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	chrome.exe
3176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273746269998172"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{962C9E62-FBF2-48DA-8852-DB63C9477A7A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5040	chrome.exe
5040	chrome.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
4044	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5040	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 5040 wrote to memory of 4656	5040	chrome.exe	89
PID 5040 wrote to memory of 4460	5040	chrome.exe	90
PID 5040 wrote to memory of 4460	5040	chrome.exe	90
PID 5040 wrote to memory of 4856	5040	chrome.exe	91
PID 5040 wrote to memory of 4872	5040	chrome.exe	93
PID 5040 wrote to memory of 4872	5040	chrome.exe	93
PID 5040 wrote to memory of 1216	5040	chrome.exe	94
PID 5040 wrote to memory of 1216	5040	chrome.exe	94
PID 5040 wrote to memory of 712	5040	chrome.exe	95
PID 5040 wrote to memory of 712	5040	chrome.exe	95
PID 5040 wrote to memory of 2796	5040	chrome.exe	96
PID 5040 wrote to memory of 2796	5040	chrome.exe	96
PID 5040 wrote to memory of 1304	5040	chrome.exe	97
PID 5040 wrote to memory of 1552	5040	chrome.exe	98
PID 5040 wrote to memory of 2428	5040	chrome.exe	99
PID 5040 wrote to memory of 1552	5040	chrome.exe	98
PID 5040 wrote to memory of 2428	5040	chrome.exe	99
PID 5040 wrote to memory of 2096	5040	chrome.exe	103
PID 5040 wrote to memory of 5472	5040	chrome.exe	104
PID 5040 wrote to memory of 2096	5040	chrome.exe	103
PID 5040 wrote to memory of 1112	5040	chrome.exe	105
PID 5040 wrote to memory of 5472	5040	chrome.exe	104
PID 5040 wrote to memory of 1112	5040	chrome.exe	105
PID 3116 wrote to memory of 4044	3116	2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	106
PID 4044 wrote to memory of 5428	4044	msedge.exe	107
PID 4044 wrote to memory of 256	4044	msedge.exe	109
PID 4044 wrote to memory of 3176	4044	msedge.exe	110
PID 4044 wrote to memory of 256	4044	msedge.exe	109
PID 4044 wrote to memory of 256	4044	msedge.exe	109
PID 4044 wrote to memory of 1568	4044	msedge.exe	111
PID 4044 wrote to memory of 1568	4044	msedge.exe	111
PID 4044 wrote to memory of 3600	4044	msedge.exe	112
PID 4044 wrote to memory of 3600	4044	msedge.exe	112
PID 4044 wrote to memory of 3600	4044	msedge.exe	112
PID 4044 wrote to memory of 2040	4044	msedge.exe	113
PID 4044 wrote to memory of 2040	4044	msedge.exe	113
PID 4044 wrote to memory of 2040	4044	msedge.exe	113
PID 4044 wrote to memory of 3352	4044	msedge.exe	114
PID 4044 wrote to memory of 3352	4044	msedge.exe	114
PID 4044 wrote to memory of 3352	4044	msedge.exe	114
PID 4044 wrote to memory of 1464	4044	msedge.exe	115
PID 4044 wrote to memory of 1464	4044	msedge.exe	115
PID 4044 wrote to memory of 1464	4044	msedge.exe	115
PID 4044 wrote to memory of 428	4044	msedge.exe	116
PID 4044 wrote to memory of 428	4044	msedge.exe	116
PID 4044 wrote to memory of 3440	4044	msedge.exe	117
PID 4044 wrote to memory of 592	4044	msedge.exe	118
PID 4044 wrote to memory of 3440	4044	msedge.exe	117
PID 4044 wrote to memory of 592	4044	msedge.exe	118
PID 4044 wrote to memory of 5964	4044	msedge.exe	121
PID 4044 wrote to memory of 3356	4044	msedge.exe	122
PID 4044 wrote to memory of 3356	4044	msedge.exe	122
PID 4044 wrote to memory of 3272	4044	msedge.exe	124
PID 4044 wrote to memory of 3272	4044	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_2cc45e54db15815c229cfe3b420c9cd4_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff302bc728,0x7fff302bc734,0x7fff302bc740
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1740,i,5114330828376335509,15558465594328814893,262144 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1552,i,1342292563741508260,17105554036247071207,524288 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,3035779718942400723,6619871651719130977,524288 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
    3⤵
    PID:4872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,9528266654948905688,15600375089986845372,2097152 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,17988406767415817638,16817061475908199480,2097152 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,8242773421726376285,8587297551739851222,524288 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,7368308377436850260,419220854370585496,524288 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:1304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5448,i,2016650045836936732,459106360585716112,2097152 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:1552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5476,i,16301700628093835463,6221320063326613921,2097152 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:2428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5756,i,10177369794824561503,3985130029579321791,2097152 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,6715967836607591923,14096262829789256742,524288 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5012,i,3573805879366889825,10209000975250423561,2097152 --field-trial-handle=1916,i,6307832904912723598,1572808343719921902,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff2b14c188,0x7fff2b14c194,0x7fff2b14c1a0
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1988,i,4819906998754380221,2821506110985968490,262144 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,2230727780364164769,9175114611601346505,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,18120871066855242075,2862819902897715709,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,9309354325000193591,13581006783991270830,2097152 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,17702900260213319504,4588991792597197945,2097152 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,11220320596482214060,16405115585644253224,2097152 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,881494886683484753,10622251588328567217,2097152 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,9192604268235501850,12693876535259923941,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,6528955116498812773,17189862387257167834,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3063745057454102968,6859099138725880194,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17201652282073819002,9684077160013937312,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17201652282073819002,9684077160013937312,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,14520442881899367144,16380177254549737915,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,4119796038157806045,14245274439464458384,524288 --field-trial-handle=2768,i,15918802048611867081,13129039535143449203,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
    3⤵
    PID:3272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 cb6acae7f15895dd3395f980c542232a61d4d2b4fdf83d292f6303831fa6248e
MD5 506a3d217a49486b817b35ba46ae6e64
SHA1 07672669d7bdf72ed111a3c699d42d296d933cad
SHA512 50f5ba4a1f0f492ea469e44bdf4477c1cb84520d1ec4d43198d8b269dfa90bb9ccd585ed23b63daf8fd828cc871f3df779599983eb5f25326dde2a3ceed7a4fe
SSDEEP 192:KRVDrY6G7quYGThv7AvAPRp2O98Hsb+WNnVk2PK38QFHVyIsnAUgR:KRxSH3E6Xd+wvPTWR
TLSH
T17722952EA914653B5CCBD219FA25B763E3F6103272D02E44DAFC8A2C12E75CD322B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fec9d45a94394596cda5127fbad50d62abc45986ae6fd07197bfa738630a7abb
MD5 0478e32072fe82c13f101d9bded6f074
SHA1 83fc107ddae8e7c0429203d4207410157e58754c
SHA512 abdf8e7fc7e64dc57af631c5d1ba812f2f63cacc33fc38ed148287406207573779718d7254266e5e48a0f61cff598a0eaf699bcd4e12e336a6eaed17dd5f1e9b
SSDEEP 192:ep+4K6h97KxkXqK4I40pUZNCgVLHrKHfFKslERL1XzKD/qd+ErUkKN9lWayzjPZ+:U+jS97KxkXqKf/pUZNCgVLH2HfgslI1U
TLSH
T11632FA27A48D9A3F4FD8D50DCC176F8B6DB5015262680D2497FB9D0403A97CE215E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 c4739e2af63826e8cb4c1a6d6d4d3ed61c79366adf0160df9cf51809d1000134
MD5 f8b083bc9d4ff4df9ae30c332e2c2066
SHA1 0ddc98eb33df2009eef99da0c984fb9910e756d8
SHA512 8c3dfaeb1a283d0e3beac9041584c5fb13ef45cf0e06f5f061a2962bf54f2014e80432c8e75aeb6274166ac5e350ee7925f2dbbbfa1f466376146b0e80cd28e6
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OjpX6yq3VumL8wkOW:jeuvBnhJsueMEGvIW1DcP2Ot0VumgnOW
TLSH
T178D3774B3A747002EDE59A721CE051BB4E3CB16D4F15A5D438B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cb3b89bd1fdb863afd35b709f8efba1d4db0683363e8d416fed5cff17b054666
MD5 008d9cd2db3a7c3354f9d1b72ce39246
SHA1 9753ff60bc87993af2d7d74a76868cd46d83c72e
SHA512 b5a2d2eeb3f4c824e1ffc1bd4c8394a0884096301c695624f4aa1fbb5bd1336e147909e8f04b1b0d075bc281524223c9538d87f160aec1f83d0cdf0c7e9351be
SSDEEP 96:4C6jd+pp4Cd1B3fkg2XLrO25Sl8h4otop5VVXDV9B6hRGyvhrWgFI1QzbWl0OWiz:4CIg4Cd1Og2XLrBiU2VxVjEsKWgFJk0Y
TLSH
T13CC12A31B47CAEB325F6E990B5033A43CFB0A16FB6106FA4D9ED0F1812E71A91387512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d3179910a206507c6ad340940519a11e07778f0d812d0bbb03635a874338ab63
MD5 5db9299965f5235e275a267c846d31f4
SHA1 abed3ffaf85ea610862d02ade2a9ef8a1b0954f6
SHA512 5e49ae28490c8a05b921b3d227b550b0567912381e3cbd0a931e6ca6e5cea0857c3a458789aea2ba32c3db5d5e1098435bd9a0fa3a06c3621c410ba4acbd5ca3
SSDEEP 96:4C6Md+pp4Cd1B3fkg2Xf2iRDotok5VVRDV9B6KzGyvhrL3ikybLHAv4a:4CPg4Cd1Og2X7DUDVzVjzaKL3ikybLK
TLSH
T155A12A31B47D8AB725B9E488BA063A03DF74A09BE6516FA8D8ED1F1C11F71E81352607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2ef856214ec0c9b0174c4a70c77b1505be85f70d7db533f7727aed9bd674ba87
MD5 06ce950cab001943ef4757e9e823eaac
SHA1 0b3bd12c6c94b61ecaec4253038a3051c0457ce6
SHA512 4c6f9916c8b5ee232dc036a6dde4bd6c02a688b0b276941b28eb88c762ed8556e2ed4240977c67c295b10acc5ca21fea3359685c8d7507b76363731ff5dd7cac
SSDEEP 192:sxRV+5RI7yM/jK1Ml8wcYB/fHjsPi2wHZxA6v+zoA8pi/g6+WNIYyNJk1lGieuIq:sxRkwC6/fDs655Ji/5IZG3
TLSH
T12552E915AA3459378CDBD20DFA517F53D6F91573A2900E48AAFCCA1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b53225b60479e6e3145313e5d43159677ff8e66b70922a712859873deb36d1
MD5 88737dc44d0adec3e757fbf6c5661822
SHA1 2fa219ea6ee31d410c21299fd308c8aceba53fd0
SHA512 ef340a82e31de38d7bbd5e6c700496853b01d19bda346e6eccc1706b0d7bc765d2a63ab8276a9f835c23aeebdcfa166a154d59f2f32958c1bd647bdf791fa6f8
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjXgcciDro5llZ7:AIox/OE7p0WguMfnAu1jawXgXiw5lv
TLSH
T14DE2EC3B680CCB7F4F80499CEC29BE9A6DA801CF96D8CD5447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 695a2d87297070fc978ff8e11928911d6beb0687f403a6b00a25db8cdc62dff1
MD5 6cfde7b2954810ecebe1c68374f49469
SHA1 2cab8753015b99051c86f362fe8add3b0c4ea6e2
SHA512 ba384cb3425006566d6f871661b58f9e9091350559a8a5caa98491452e00940e3740d97dbf63a99ea8663878ddff5f59d388c60cef7b1b3ea58e1ebfa931276f
SSDEEP 96:Kntgj/tzTxufes4nxKw44NxUVdGnTSOBWKiM6BwBBBUBAByBeBSBIWBWBLBbgBIl:OPhxqP2qc8c1kBKay/ggRKiJ46jHRu/d
TLSH
T176917E45747B1B803C7E290F82A8A46A568234E33299B52B3BE851E11F67E104FFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4bd265db31de236ea22c1a395c35a565ffe4d6f6e115febc7a601046207b7efc
MD5 cb938b671e8dfdf05fdb3d7d7f665632
SHA1 643e66cbb2380273eff8d7230ab3f554edf6723b
SHA512 5fbfa1e3fd16efaa5afbb6bf6a7d88003ceb5753cdf8fab95165d8a72248c02e03148742c2284455acd087eb7a93359b3dbe864b4e25c9e217c69b30061eee77
SSDEEP 384:DNrRZyCSDnxTIC4MEhIKyll7svbFKfk7:xFZJSDnicyI1l7svbF9
TLSH
T1EE44850A7B747001EDE6D9721CB080771E3CB16D8F62A6D16DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dd4ec188e5323cd0c4a9c3ead99164b6bb179ebba21c9b521d87c2df99de67d7
MD5 eb0adae13242b6b9f87f5a7c145592c5
SHA1 b93a08f6c660f384c7fa8ab1e85cf4d4dd60fae5
SHA512 56cd3afc6fd1258ed4ff7c66510b099082b2e45c3a391e899e110bdea0e208b63e67ab7c1c3f1e2591fa51ff24a35c59c9ec969c4c0e8f22775140addf0d67bc
SSDEEP 768:Gj+9r3nrBnrQOJIv5B/hUAFjQIMyOV3N5E9EVc8Kz0:V9r3UhNFUIpONNm0ctz0
TLSH
T16FF2AE35B8A19FE78CEADBC577067357AFF0026781811D84CDDD6B0D468729E234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0265c4cbec4d5057d79213775450d84aaad8b715452722a3742aef9b058991c3
MD5 bf7f271c30447e7cc00b092623004bb2
SHA1 1f1f6d46799adbeb97771bb647581fdbe290d04e
SHA512 e188529fd4a4e3cc7b0f7bfd3b52370a84eb7c631f5c4ef6999fa5f6ba6b746f3c9d83da7dcd0a171bfcce6d44bac88f8923f67063985dd8279f35a7fbd6469f
SSDEEP 768:9rv+4UNbdF3ZTlQOJIvc/hUAFjQIMyOV3N5E9ML5+8r0mL:9bsbf31hNFUIpONNmcDrv
TLSH
T1B803BF32E9A8DAB39CE7D6C5760A72037FF4416399C10B84C9DE2B0D824B1DD231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

100f20f0

Path C:\Users\Admin\AppData\Local\Temp\e5e3581c\100f20f0
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4044_262897149\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3116-166-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-146-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-98-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-105-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-115-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-124-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-143-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-156-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-169-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-171-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-193-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-192-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-191-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-190-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-189-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-188-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-187-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-186-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-185-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-184-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-170-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-168-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-167-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-79-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-161-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-160-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-159-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-158-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-157-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-155-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-141-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-148-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-147-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-99-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-144-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-133-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-109-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-108-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-107-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-106-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-95-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-93-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-92-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-97-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-82-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-81-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-80-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-78-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-52-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-53-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-43-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-25-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-14-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-13-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-12-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-10-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-8-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-3-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-2-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-1-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-77-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-51-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3116-2314-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download