7656c5a7e2e2ed5d35752f6b82f28211fa932d87182a230103294f2467ecf27f

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 2.8MB
Sample260703-ythb1abz2j
SHA256 7656c5a7e2e2ed5d35752f6b82f28211fa932d87182a230103294f2467ecf27f
MD5 a076e1b3240262f1e9d5453ae9a3d0be
SHA1 b0cf6ab8b66f67888c9f06b4fab912b734b304c5
SHA512 d449bbc17651cbebad5a4c6da0ecbfaf40d05c7c243541f92e5a9da2c5b8b5262662a8d5595b6784393d4a0e1a5b9f3f49ee33686c285367a428cc654a9f836a
SSDEEP 49152:uyC1qY7toEp6F61EkakFImy2rXMGbeYdYOL77aEG3eti6j2xgQx7yJL88jyTkign:uyzdUE5kFIzWMGbe2YOLftjti6ixgQRA
TLSH
T1EDD5AD0B7CD008E9C4AA533698BB51827B75BC094F3623D72E90B6382FB67D19D3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware credential_access discovery persistence ransomware spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 928 created 3488	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 928 created 4632	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 928 created 3044	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 928 created 1872	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 928 created 3756	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 928 created 1068	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	94
PID 928 created 4200	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 928 created 3488	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 928 created 3488	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 928 created 3044	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 928 created 3044	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 928 created 4156	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 928 created 4524	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 928 created 2132	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 928 created 2756	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 928 created 5084	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 928 created 3980	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 928 created 6096	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	117
PID 928 created 4940	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	118
PID 928 created 4156	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 928 created 4156	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 928 created 2132	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 928 created 2132	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe
3044	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275826952557281"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{5C080E8F-A98C-4DBB-BC6A-0B88EB38BEF5}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{6AF72031-45CE-4F2F-8825-D017CAFC341C}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{E66BCEE7-40EB-40A1-80BA-564EAA8D3876}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
464	explorer.exe
464	explorer.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe
Token: SeShutdownPrivilege	464	explorer.exe
Token: SeCreatePagefilePrivilege	464	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
4156	msedge.exe
4960	sihost.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe
464	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3348	StartMenuExperienceHost.exe
4680	SearchHost.exe
464	explorer.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 3488	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 3488 wrote to memory of 4632	3488	chrome.exe	89
PID 3488 wrote to memory of 3044	3488	chrome.exe	90
PID 3488 wrote to memory of 3756	3488	chrome.exe	91
PID 3488 wrote to memory of 3756	3488	chrome.exe	91
PID 3488 wrote to memory of 1872	3488	chrome.exe	92
PID 3488 wrote to memory of 1872	3488	chrome.exe	92
PID 3488 wrote to memory of 1068	3488	chrome.exe	94
PID 3488 wrote to memory of 1068	3488	chrome.exe	94
PID 3488 wrote to memory of 4200	3488	chrome.exe	95
PID 3488 wrote to memory of 4200	3488	chrome.exe	95
PID 3488 wrote to memory of 4960	3488	chrome.exe	96
PID 3488 wrote to memory of 4960	3488	chrome.exe	96
PID 3488 wrote to memory of 5472	3488	chrome.exe	97
PID 3488 wrote to memory of 4660	3488	chrome.exe	98
PID 3488 wrote to memory of 4660	3488	chrome.exe	98
PID 3488 wrote to memory of 4568	3488	chrome.exe	99
PID 3488 wrote to memory of 4568	3488	chrome.exe	99
PID 3488 wrote to memory of 4528	3488	chrome.exe	119
PID 3488 wrote to memory of 6056	3488	chrome.exe	104
PID 3488 wrote to memory of 4528	3488	chrome.exe	119
PID 3488 wrote to memory of 6056	3488	chrome.exe	104
PID 3488 wrote to memory of 5428	3488	chrome.exe	105
PID 3488 wrote to memory of 5124	3488	chrome.exe	106
PID 3488 wrote to memory of 5124	3488	chrome.exe	106
PID 3488 wrote to memory of 5428	3488	chrome.exe	105
PID 3488 wrote to memory of 1544	3488	chrome.exe	108
PID 3488 wrote to memory of 1544	3488	chrome.exe	108
PID 3488 wrote to memory of 3576	3488	chrome.exe	107
PID 3488 wrote to memory of 3576	3488	chrome.exe	107
PID 928 wrote to memory of 4156	928	2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 4156 wrote to memory of 4524	4156	msedge.exe	110
PID 4156 wrote to memory of 2756	4156	msedge.exe	111
PID 4156 wrote to memory of 2132	4156	msedge.exe	112
PID 4156 wrote to memory of 2756	4156	msedge.exe	111
PID 4156 wrote to memory of 2756	4156	msedge.exe	111
PID 4156 wrote to memory of 5084	4156	msedge.exe	113
PID 4156 wrote to memory of 5084	4156	msedge.exe	113
PID 4156 wrote to memory of 3980	4156	msedge.exe	115
PID 4156 wrote to memory of 3980	4156	msedge.exe	115
PID 4156 wrote to memory of 904	4156	msedge.exe	116
PID 4156 wrote to memory of 3980	4156	msedge.exe	115
PID 4156 wrote to memory of 904	4156	msedge.exe	116
PID 4156 wrote to memory of 904	4156	msedge.exe	116
PID 4156 wrote to memory of 4940	4156	msedge.exe	118
PID 4156 wrote to memory of 6096	4156	msedge.exe	117
PID 4156 wrote to memory of 4940	4156	msedge.exe	118
PID 4156 wrote to memory of 4940	4156	msedge.exe	118
PID 4156 wrote to memory of 6096	4156	msedge.exe	117
PID 4156 wrote to memory of 6096	4156	msedge.exe	117
PID 4156 wrote to memory of 4528	4156	msedge.exe	119
PID 4156 wrote to memory of 4528	4156	msedge.exe	119
PID 4960 wrote to memory of 464	4960	sihost.exe	124
PID 4156 wrote to memory of 2656	4156	msedge.exe	126
PID 4156 wrote to memory of 4032	4156	msedge.exe	127
PID 4156 wrote to memory of 2656	4156	msedge.exe	126
PID 4156 wrote to memory of 4032	4156	msedge.exe	127
PID 4156 wrote to memory of 5796	4156	msedge.exe	135
PID 4156 wrote to memory of 6260	4156	msedge.exe	136
PID 4156 wrote to memory of 6260	4156	msedge.exe	136
PID 4156 wrote to memory of 264	4156	msedge.exe	137
PID 4156 wrote to memory of 264	4156	msedge.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd1811c728,0x7ffd1811c734,0x7ffd1811c740
    3⤵
    PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,3634727628373462681,6678746946359250331,524288 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,6750531025655805786,10433007715406748117,524288 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
    3⤵
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1664,i,232980014175066138,15064965618807565210,262144 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,16215530694832483385,17918102379467380968,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,11542987133614696906,13333192986598413850,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,6292557025085623731,2789254234547815021,524288 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:4960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,8738549357010066858,11345213831411571898,524288 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5500,i,2385724696561436064,447440781674248720,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,16291966356315646959,239232792098511274,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4884,i,6321325451878608004,51824992629785273,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,14758761289617494783,7576279175771090949,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:6056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5508,i,11495810150255125039,13656236070600717985,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:5428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5524,i,2544841835094942803,10617594052570311779,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5712,i,10107644089424639223,12779054100743830133,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5724,i,17773400091757596190,10701312497855508650,2097152 --field-trial-handle=1908,i,4927062233621345383,12455377762480764967,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffd0175c188,0x7ffd0175c194,0x7ffd0175c1a0
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1676,i,17470123816364754417,1399780504475261484,262144 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,11505163593054048918,6084591036022920893,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,7190055029565675694,5588834923554923025,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,7527350404139313328,5583622962625731517,2097152 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,17734734556325748021,16270676416754196611,2097152 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,6206627549660997824,10320672308904228696,2097152 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3147641026832388198,14482057071304447264,2097152 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,8788615731151316765,12807173567825841581,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1765228012088709998,7840670788360444775,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,10650315689592930355,14068607923524688527,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4237186253822802675,11765112510123802258,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4237186253822802675,11765112510123802258,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,12999353106885382125,2560123185569478667,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:6260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,1675224553288994603,15616267719682298926,524288 --field-trial-handle=2332,i,16889412825619883089,470356437156511978,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5404

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:464

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3348

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 159f44d0c1b6410540011b06f592fde9b487b55e7c49bebfab0dbf3167628ae8
MD5 8698f1e3291595bbe9282e3f3f7ff737
SHA1 08ef9db8cc387d10b62ca818f2ecc87a3c0159ad
SHA512 f7f6eeb8e98da13c80e17fdc1d4e9c3cbb0fabe2af2f39ebde52e9ad0d051bcf68fe947ce91f17e74377ffd397d5475ec9aa56a46c8699bab5d68b039ce8046e
SSDEEP 192:ORm1l9HBv722u/vAPRp25i9gHsb+WNnguPYDNeZRkVyIsnAUgR:ORm13HRaT6XDywVPFCR
TLSH
T15C22A72EA910643B5CCBD62EFD257753E3F5202235902E84EAFC8A2C15E75CC721742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8987cb7ada86b7c0d12884502af983ba496ecbab54a07fe7c49705f1bdbc62b4
MD5 62d83a5e23e2ae174ada6667dfc1de87
SHA1 e04ebdd001767d92eb7c6a51e7ad674bc47dcb92
SHA512 028e4dfa6929e726fe699d675cc79feed1fe9c00fc34d8c3bc092bc18e55c58da9cb81bcce17eed5ef3701dfe5f227a2123f471e33373c01481c760bcf054551
SSDEEP 192:eO94K67b7KxkXqK4I40pUZNCgVLHrKHfFKslE6ZXXzKD/QX+ErUkKN9CUS1vG6QB:T9jYb7KxkXqKf/pUZNCgVLH2HfgslNXy
TLSH
T1FA32DA27948D9A3F4FD8D50DDC166F8B6DB4029673780C24A6FB9C0803A57CE215A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a6470dd44bbadfa25f23d7dba4ea001c812d991e4628233a8260785fdd4a397f
MD5 115fe76be4c7de2a0594e64e2ea913f7
SHA1 b59fdcc5f2ae996699e6eef8003746aac899a02f
SHA512 f2f9932298b4e70420282381b9711beee268d07568059d6e48116467f46271604257c7f02ff89edaaf61517ec23b26d1d816b4a65377b475d9d64107fb04e49f
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2ORpX65EqixVumewki:jeuvBnhJsueMEGvIW1DcP2O/PVumeni
TLSH
T1A8D3764B3A743102EDE59A725CE050BB5E3C716D4F55A5D438B620688EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9f03ef873ae1ed0c240e1b644a2e4b716636110c01ee6b598a690d2d026c8e9b
MD5 9fd62371673232611e42a4e247fae44f
SHA1 f96634268ded3bdff52d38836b8bb38779964684
SHA512 9cbe5b4d3c83bf3df2baf4fbae22af45496f09820da1bd8ad7215e40ba91d3ffefac61848c310cefebcf22b142e7cb8a28fa5b6de8b093790fe3176c3c659c67
SSDEEP 96:eC6v1d+6YI1dEYQHofAK8WyoCdPRDotok5ngDcB6XGyvSO8n9PEtvZF9v4a:eCC1YIcYkVK8Wyo8DUDWwv88n9sthFh
TLSH
T1B3A1F731697C4DB358B6C58976023B43CF64B06B6A71AF88DADD5A0C15BB0FD5302223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9e984f278b15293a90b1b5db233cef3a2d78ab1ca7c615d9690453c731de72d5
MD5 11e9f833dc3b8ec0d5430f59f99ec497
SHA1 c2e72bb1b69f7fecb6dcf74e187f4842e2c5c1de
SHA512 be131ffa5fec95526ba832c8f497e905c6454c6e529e8a59b959cea048b4379c3da5f4b5b5b7bd0d69e894b50cc59bd76ee707013927bcffbfe13f4148469dd9
SSDEEP 96:8C6OHd+6YI1dEYQHofAK8WygldKSl8h4otop5nsDcB6XGyvS6XbxwHLeOf4/h9n4:8CnH1YIcYkVK8WydiU26wPULx4ef/h94
TLSH
T10FC1093168AD9CB349F6C54672133A53CFB4A16F6A109F58DEDA0F0D02EB0FC1342126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 887fe7720f2f2031b2ee6841adfe07b772477e428c94be461ee009c45231cf44
MD5 b91b8c3b2b3797bec63c9d6f2f5fe581
SHA1 3321b190e138f1e60680a127254ccbc990c3acf2
SHA512 a85225a79f2acddd0b75b8e202c27e1fc3eff9e11bfd9042ca7dfc2cef43c9202d766b46eb1b7f8421658716772cdb0ca9ae8e6375c73736f39dd93bdfae47e6
SSDEEP 192:sxRjRuck/fmslVDVWMmzoA8pi/g6+WNIYTKVcGMIgFJ:sxRjbk/fmslJgsi/5IJIv
TLSH
T19832A7166A28A93B8CCBD21DFB557F53D2F95033A1905E48EBFC860C05EB6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0f3c8528a608b422a9b767d57e19c86135a42aa16c5cbef67f0df3d19f7589f3
MD5 ce975cda6d04a259a54aa9834d231fdd
SHA1 eda4382730dd7167d45a04adcb6bdcea52a6c791
SHA512 f964b23870979a36a7d2ea52b920958bb5adfefb7ba60ab4fa083aa292c19524d0cad568367e91bcbe47ded6c95359f016d7dbfd4a781ce1349ba553468ff9e3
SSDEEP 768:RfsObJ7pLuL7urWgTvfLX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zFixroQ8/:RfsObfE7urWgTvfLXu1jaMRiKQ4
TLSH
T12BC2DA7F640CCA7E4F904AEDA8197E8F6DA802CB5698CD9047FE950C03C67FA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 025e31b75230052ac5b10a0aac5db2dd6879209d38298fa2ebc2da7af6810bef
MD5 4871c765177aa1528f454cd20061c7be
SHA1 e283f78ffb7a60023cf51d45c1d40fef046fec89
SHA512 7c4d25b69f5315227151a6d2ad6d0c2c7c7027b3dbc4dca3bf5005015d5a10f90dc2516f3b912d6b7103ba0ca242bfb39ac6a25669ebd9d56fa2ecc47aad7bf5
SSDEEP 384:DNrRZyCSDnxTIC3MEhIKyll7svbFKfk7:xFZJSDniVyI1l7svbF9
TLSH
T11244740A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b9b02c383a5b123e0596d05e1039fbba7dd2ef5921ec756755f6ce309e622599
MD5 b58ae8138772f6f07f25ccece2a5d253
SHA1 4052fb9e0a0e284ecf3f033e300b7c529bd25717
SHA512 6f9f6885209ddf17c260e772f76729d685f83fa1f1b629b15b04c2cd1873e58ca2f90d795d22943552486e9e553b3f1d2e6651bbbdd918635e244f46daaac353
SSDEEP 768:+rv+4UNbdj3EVi6OHWIXodOiIyN8Y1M1fmBnZUi:+bsbl3F8IXodI11vi
TLSH
T12F03D031E87499738DF39A89F51776477FF421938AC51A98DDE85B0E004BAEE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 68620dc278245cd4ac63cbb7111d14196a31d1f5bf3fec9d9b97d1970e2bda63
MD5 a8981dba102ee7809e43f73751437577
SHA1 24e668a2cfdcc65569ee5b5ead223c54dc1ec0d5
SHA512 dd8d46da030ba6e5ae08142d8044d4d54d617c2966c21d568eb7ba769cae605806956292be5b16faa4e1d0ff9a8bdb08a6a809327dc03a5caf1cd918d14e1f12
SSDEEP 768:Yrv+4UNbdj306wPW+XodOiIyN8Y1M1fmBnl9VNv0B:Ybsbl30K+XodI11Yj8
TLSH
T18203CF32E864D5778CF28288B54772437FF491A38BC50B94DADC6B0E4647AEE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2e173a7-299e-4c82-9f53-a9f6b0c7e0e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2e173a7-299e-4c82-9f53-a9f6b0c7e0e2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

26b9d40f

Path C:\Users\Admin\AppData\Local\Temp\3a4d5bab\26b9d40f
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4156_1139858100\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-119-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-89-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-76-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-74-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-70-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-77-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-75-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-73-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-91-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-94-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-110-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-122-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-136-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-135-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-134-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-133-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-132-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-131-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-130-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-121-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-120-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-52-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-118-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-117-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-109-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-108-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-107-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-106-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-105-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-104-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-103-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-102-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-90-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-53-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-88-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-87-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-86-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-85-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-93-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-72-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-71-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-69-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-59-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-56-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-42-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-18-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-55-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-54-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/928-2557-0x0000000410000000-0x000000041021A000-memory.dmp

Download