7f4662ce851dc5f9c66b7dbad7a2f93a9653bb1ea78580af7d6c1090df42dd8a

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 2.8MB
Sample260706-n666saew3y
SHA256 7f4662ce851dc5f9c66b7dbad7a2f93a9653bb1ea78580af7d6c1090df42dd8a
MD5 5494322366be75c3a444447f0749f876
SHA1 f3eb429bf9ee1e20264845b6687f2ac4ef8a4c4f
SHA512 a946cf9e247be3eb7ffbc84777299141245b16977f7f28f70ff427a1b0960e2fb83a861ae22bcd7b023272598e793236e7991cb420ba7a2367e09b9cf40c0df0
SSDEEP 49152:eo7TRtTkS8f6tzUl9PV5+oh2a3vmrYCpWzepOldTwPDC:eoBwrPV5+oh2UvmsuWz6OldT4e
TLSH
T19BD58D0B7CD409EAD4A9A33259B242927B35BC094F362BD72E90B6783F767D09C35781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 22 IoCs

description	pid	Process	procid_target
PID 864 created 5740	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 864 created 6272	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 864 created 7160	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 864 created 5016	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 864 created 2608	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 864 created 4632	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 864 created 3852	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	96
PID 864 created 5740	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 864 created 5740	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 864 created 5016	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 864 created 5016	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 864 created 1072	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 864 created 5932	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	116
PID 864 created 2696	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	117
PID 864 created 3872	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	118
PID 864 created 6872	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	119
PID 864 created 6652	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	120
PID 864 created 5596	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	121
PID 864 created 1072	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 864 created 1072	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 864 created 2696	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	117
PID 864 created 2696	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	117

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5016	chrome.exe
2696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278129199835699"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{F0DB692E-B74F-4E94-AC40-338F6F4BD247}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5740	chrome.exe
5740	chrome.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 5740	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 5740 wrote to memory of 6272	5740	chrome.exe	90
PID 5740 wrote to memory of 7160	5740	chrome.exe	91
PID 5740 wrote to memory of 7160	5740	chrome.exe	91
PID 5740 wrote to memory of 5016	5740	chrome.exe	92
PID 5740 wrote to memory of 2608	5740	chrome.exe	93
PID 5740 wrote to memory of 2608	5740	chrome.exe	93
PID 5740 wrote to memory of 4632	5740	chrome.exe	95
PID 5740 wrote to memory of 3852	5740	chrome.exe	96
PID 5740 wrote to memory of 4632	5740	chrome.exe	95
PID 5740 wrote to memory of 3852	5740	chrome.exe	96
PID 5740 wrote to memory of 7000	5740	chrome.exe	97
PID 5740 wrote to memory of 7000	5740	chrome.exe	97
PID 5740 wrote to memory of 3108	5740	chrome.exe	98
PID 5740 wrote to memory of 2228	5740	chrome.exe	99
PID 5740 wrote to memory of 2228	5740	chrome.exe	99
PID 5740 wrote to memory of 6956	5740	chrome.exe	100
PID 5740 wrote to memory of 6956	5740	chrome.exe	100
PID 5740 wrote to memory of 3688	5740	chrome.exe	104
PID 5740 wrote to memory of 4056	5740	chrome.exe	105
PID 5740 wrote to memory of 3688	5740	chrome.exe	104
PID 5740 wrote to memory of 7076	5740	chrome.exe	106
PID 5740 wrote to memory of 4056	5740	chrome.exe	105
PID 5740 wrote to memory of 7076	5740	chrome.exe	106
PID 5740 wrote to memory of 1640	5740	chrome.exe	107
PID 5740 wrote to memory of 3856	5740	chrome.exe	108
PID 5740 wrote to memory of 1640	5740	chrome.exe	107
PID 5740 wrote to memory of 524	5740	chrome.exe	109
PID 5740 wrote to memory of 3856	5740	chrome.exe	108
PID 5740 wrote to memory of 524	5740	chrome.exe	109
PID 5740 wrote to memory of 2288	5740	chrome.exe	110
PID 5740 wrote to memory of 6180	5740	chrome.exe	111
PID 5740 wrote to memory of 2288	5740	chrome.exe	110
PID 5740 wrote to memory of 1968	5740	chrome.exe	112
PID 5740 wrote to memory of 6180	5740	chrome.exe	111
PID 5740 wrote to memory of 1968	5740	chrome.exe	112
PID 5740 wrote to memory of 4500	5740	chrome.exe	113
PID 5740 wrote to memory of 4500	5740	chrome.exe	113
PID 5740 wrote to memory of 3176	5740	chrome.exe	114
PID 5740 wrote to memory of 3176	5740	chrome.exe	114
PID 864 wrote to memory of 1072	864	2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 1072 wrote to memory of 5932	1072	msedge.exe	116
PID 1072 wrote to memory of 2696	1072	msedge.exe	117
PID 1072 wrote to memory of 6872	1072	msedge.exe	119
PID 1072 wrote to memory of 6872	1072	msedge.exe	119
PID 1072 wrote to memory of 3872	1072	msedge.exe	118
PID 1072 wrote to memory of 3872	1072	msedge.exe	118
PID 1072 wrote to memory of 3872	1072	msedge.exe	118
PID 1072 wrote to memory of 6652	1072	msedge.exe	120
PID 1072 wrote to memory of 6652	1072	msedge.exe	120
PID 1072 wrote to memory of 6652	1072	msedge.exe	120
PID 1072 wrote to memory of 5596	1072	msedge.exe	121
PID 1072 wrote to memory of 5596	1072	msedge.exe	121
PID 1072 wrote to memory of 5596	1072	msedge.exe	121
PID 1072 wrote to memory of 1968	1072	msedge.exe	123
PID 1072 wrote to memory of 6472	1072	msedge.exe	124
PID 1072 wrote to memory of 1968	1072	msedge.exe	123
PID 1072 wrote to memory of 6472	1072	msedge.exe	124
PID 1072 wrote to memory of 6660	1072	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_5494322366be75c3a444447f0749f876_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaa889c728,0x7ffaa889c734,0x7ffaa889c740
    3⤵
    PID:6272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,477075507878205084,4336532130696247690,262144 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:7160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,15200014808749800859,14381434337531011998,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,5021326369649518462,13019540117763757186,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
    3⤵
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,8829810866510418995,17523534154729089924,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,8204108838918574129,14483434449359161372,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,16181810013614632070,1463643289263063821,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:7000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,5461368469591427132,14020262985466152725,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,1479198943531172147,10128650602240428013,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,15219425326871270118,6789203685310534657,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:6956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5780,i,2981481289747749125,10783672577918356478,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,10674687525462818738,14753518951043006562,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:4056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5172,i,6136048834995996498,6956469992745177926,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:7076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4672,i,10242245109171637478,12034061604377896948,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,11844307334419205640,5174985353403442738,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:3856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4636,i,6813225492896213383,10649530173912291175,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,11769365317709792888,14024022223038429382,524288 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5132,i,2085971401837725213,8534961111592365355,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:6180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5652,i,15829052114242426803,7719892437017270838,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4696,i,13290875141701657524,11876170151160005180,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5500,i,11387427689393670228,7216172703468408849,2097152 --field-trial-handle=1900,i,8363115683984916077,9692229245780611651,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:9
    3⤵
    PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffa89bcc188,0x7ffa89bcc194,0x7ffa89bcc1a0
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8261693491420676061,450555449005759647,524288 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1720,i,12979654093735717074,13022622486643447944,262144 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,4064691351814110242,9701419298671276455,524288 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2434148361368079070,16502483083998042269,2097152 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:6652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,11619929458191575303,15429584024402190860,2097152 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,15689800046996147011,17005387326914470289,524288 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9257364046646130419,11199981376072136842,524288 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
    3⤵
    PID:6472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10410655786928560842,14059752544936933243,524288 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10410655786928560842,14059752544936933243,524288 --field-trial-handle=2368,i,14799998518774254338,14527569908545766665,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:6660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 848b8b6937f9d4cb5bc3f30f41b0e23be0d3d1ac86e4b2b2ece86b86a9a45955
MD5 5b4b8d5707891a1f4102916d57c61ad6
SHA1 135663e00956e7c99ec78a8e80beda9bf413d1a0
SHA512 5855536e4676783faf4045b384efee9089564def1f193c3338c5b32eca4fa8a4cd52ca86d2c215ec410cff30dd86f614f40632632cff583c1f52ab224bddc6dd
SSDEEP 192:3RZsn/lezv7j5lvAPRp2h9BHsb+WNnG1PhP2Oe3GVyIsnAUgR:3RZsncLn5l6X6vwqP926R
TLSH
T17932B82EB910693F5DCBC21AFA657763D7F5012135901E84FAFC8A2C16E7ACC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 5f2fb804e51b64859561b1fb33b568ccc4eb359dd12c791289fbc2a90fb145fc
MD5 a22efe974584a464cc1b7977a0b22139
SHA1 a75cf2986c41563fff69167c33b8cf17121346be
SHA512 f9fc0aa45ff78ee942cdc42502c38631a35f6684ac5f42c45565386d96370ee2f731e6cf156273233e3b364dbb6442cf611d3057d969982a1f0dad14990f83a5
SSDEEP 192:eYT4K6iw7KxkXqK4I40pUZNCgVLHrKHfFKslEzAyXzKD/pw+ErUkKN9monIyoR2O:9Tjhw7KxkXqKf/pUZNCgVLH2HfgslNyz
TLSH
T15D32E927A44D9E7F0FD8D51CC8166F4B6DB5029272680C34A6FB9D0403A9BCE225A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 d3e4bdfa18580de0493eebaef25229513284a970c782ed6abbfd1464dbed3bb8
MD5 59f75f45c7bd31682ee7800a481cc91a
SHA1 bb1b731ca14dd45aaf9466f05def4b2cac5d67a3
SHA512 4f65b83425b2dca920c0a27d93ee2d49e30bf2ab263409d7cb00844045fbdfc120abd263a1a470cef19573c2364696021aa103d97113c1128f897b11d584dc88
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OOpX6VRq+LVumjwkVv:jeuvBnhJsueMEGvIW1DcP2OG2VumjnN
TLSH
T1FAD3884B3A743002EDE59A721CE050BB5E7C716D8F55A5D428B620698EF1963A23E0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 22a91c48571fb897f12ccbf96babe8b8cb22bcff35f3421be89aeae7633975cb
MD5 fa68745b2575a66dec12ff090f8c5c1b
SHA1 f3ee5ad7317d2c727d8a56c9469570858a33efaf
SHA512 3b1efab55f84b07fbd373b0a93fe7e9c66cbe43a014c3c455a7fad8950b13214e2fd656c5e27e95ef0e2c2ff8f2a7cbcfa8bf83463f2c4da71291d6fff715918
SSDEEP 96:1OlC0d+iT7Z+HXQ5U6fqlY6GCuXoRDotok565DgB6AGyv8aMChbubv4a:1AC093OQ32DUDGEkeMChbu/
TLSH
T12FA11A33A47D9D77A076E845B6527A47CEB8612FEA616E84EDDC0B0C16EB0E40341633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 152ead50d5f05b49c915babc9267f9fc8f7b9defd261d595914174c48cf28872
MD5 ab8067fa42846fccea0e76853e1ea4e7
SHA1 68dd384f428f499f0b00935b0c2c6887f2c51e73
SHA512 7e6a3b35b7da169ff0d5356fa442b294422c37b2ef00c2cd2e75c9cef30779c9974a1ffc8c5553064b27bc9ce401a145934d6a53348a807de3abf99423c165f1
SSDEEP 3072:Lbm01kv8eB0lciunwye1B/INRdVbjNoY7lEw2h9UDBOMr/z:PL1kkk0anFe1OPdVbZ/yloO2z
TLSH
T172C302B1DEA221B707A4FD53E503986F8CE4D5539B51FD889E741F8A11ED8CC2702AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 163672f9a704649f8da57420a4afebf8fe29029f6c95f71561304161e6a21dcb
MD5 e8cdc7579e08519db3c0c969d5e512e7
SHA1 c8c76b549b524c55583e534bd709c96b6d2547b2
SHA512 62b3395b693159ae828d685ce12e0ae2cee1365eb9e744bc21c2012e8a786e71736bc2e705e6cc7d562c5e4d345de3b9d000a238e2708e07a5cac7e58fccd407
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931I0:UVI1zrZi+JK9ALXEAdr
TLSH
T157B26D5171BA2740383D280E93B9942F164630A230DEA97B7B6931E56F67F004FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 9ea028f18d6af460bfbf44ddf4a630043c6121cd2e48c6e7f38c66259bdd4f17
MD5 fbba9ba33e75b6fecfabe24086305c48
SHA1 0982bbfb7389cdb28f127443169ca65b5a9b1d65
SHA512 7d58226e1ca36c9c219daf62f1129089bcf50da06bc49e2aa559e468819478a6055adf455c0635cc94f940e9f64255eee6d17b6711cea37a0fef5b05d142994d
SSDEEP 384:DNrRZyCSDnxTICaeMEhIKyll7svbFKfk7:xFZJSDnibyI1l7svbF9
TLSH
T14244840A7B747001EDE6D9721CB080771E3CB16ECF22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 310861f21498d424819f2a4ed704be2c6396f0daa50fd47ee0af80a1a168b3f0
MD5 c5a0c1e09d2fc9c2a846d95ba23b3d68
SHA1 b3d76b1e32e9ab2ca5ea4890290e4b9660ded299
SHA512 f9058c8c0cdfda3e1d303b8bc56cda5e6ac9dcdfbfd41b5dfcccf63ae72aa97fb36eef8529156ce3d87211c60a3d7b9303abe1fd16dc16d6c5bb037aa76f8bf7
SSDEEP 768:6F1j+9KVwgKKevn9NG4N1IYxZCmn12bfJXM:f9KGxYYrC0yJXM
TLSH
T137C24A36D8A4CA77ADE78FC9B70A764AEEE40267C1D85AD4DADC0D4D01D329D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f2b5a2d

Path C:\Users\Admin\AppData\Local\Temp\0321ef3f\7f2b5a2d
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5740_1783589600\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/864-134-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-121-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-46-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-45-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-50-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-49-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-53-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-64-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-65-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-67-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-66-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-54-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-71-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-86-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-88-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-93-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-97-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-103-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-109-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-116-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-125-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-42-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-150-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-149-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-147-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-141-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-138-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-135-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-129-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-127-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-122-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-43-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-119-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-118-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-105-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-106-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-101-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-100-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-96-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-91-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-90-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-87-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-84-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-83-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-82-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-81-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-80-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-70-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/864-2420-0x0000000410000000-0x000000041021A000-memory.dmp

Download