2bb2feebe6db9414588a43cf7d31ce1389641f9fe73617a814d6e3f60a035f2c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.7MB
Sample260804-jq5wkaff44
SHA256 2bb2feebe6db9414588a43cf7d31ce1389641f9fe73617a814d6e3f60a035f2c
MD5 2d79ec6eceeccdb7f039e43c968c4805
SHA1 7f13ad3f01eb25569634591241b9f504e7046e9a
SHA512 72b8e7301fc396d205134dcb6d012dd0e65b7a78ac611c5e9dbb5bea354fea442e8fda29d1499784b6190ffce93f8453ffe1c06f4adc609339fefb547ae329fe
SSDEEP 49152:W3ybeJFvq9yhNDN5wpbZTErI9cTHlAC1vzX3sYf3mQYEb/YOYtyodRVK7vq6L:W1rbas1vzX3731oFG
TLSH
T105368C17AE9408E5C19AEB35C9B75211BA74B80D8B3123D32E50BEB83F723D1AD75790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 5848 created 352	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 5848 created 248	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 5848 created 4656	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 5848 created 2920	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 5848 created 5048	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	96
PID 5848 created 2844	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	94
PID 5848 created 1256	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 5848 created 352	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 5848 created 352	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 5848 created 2920	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 5848 created 2920	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 5848 created 2472	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 5848 created 1756	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 5848 created 5324	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 5848 created 4312	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	114
PID 5848 created 4440	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 5848 created 3568	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	117
PID 5848 created 6108	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	119
PID 5848 created 5704	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	118
PID 5848 created 2472	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 5848 created 2472	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 5848 created 5324	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 5848 created 5324	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	113

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5848 created 5732	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	81

Loads dropped DLL 1 IoCs

pid	Process
5116	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2472_547690180\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1470954932\_locales\az\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2920	chrome.exe
5324	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303036987282224"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{DBD50CE0-3D2B-4ECE-816A-ABCCB6659872}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
352	chrome.exe
352	chrome.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe
Token: SeShutdownPrivilege	352	chrome.exe
Token: SeCreatePagefilePrivilege	352	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
352	chrome.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 352	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 352 wrote to memory of 248	352	chrome.exe	90
PID 352 wrote to memory of 4656	352	chrome.exe	91
PID 352 wrote to memory of 4656	352	chrome.exe	91
PID 352 wrote to memory of 2920	352	chrome.exe	93
PID 352 wrote to memory of 2844	352	chrome.exe	94
PID 352 wrote to memory of 2844	352	chrome.exe	94
PID 352 wrote to memory of 1256	352	chrome.exe	95
PID 352 wrote to memory of 1256	352	chrome.exe	95
PID 352 wrote to memory of 5048	352	chrome.exe	96
PID 352 wrote to memory of 5048	352	chrome.exe	96
PID 352 wrote to memory of 2284	352	chrome.exe	97
PID 352 wrote to memory of 2284	352	chrome.exe	97
PID 352 wrote to memory of 2136	352	chrome.exe	98
PID 352 wrote to memory of 1896	352	chrome.exe	99
PID 352 wrote to memory of 1896	352	chrome.exe	99
PID 352 wrote to memory of 3008	352	chrome.exe	100
PID 352 wrote to memory of 3008	352	chrome.exe	100
PID 352 wrote to memory of 3332	352	chrome.exe	104
PID 352 wrote to memory of 3332	352	chrome.exe	104
PID 352 wrote to memory of 2356	352	chrome.exe	105
PID 352 wrote to memory of 2356	352	chrome.exe	105
PID 352 wrote to memory of 1492	352	chrome.exe	106
PID 352 wrote to memory of 4224	352	chrome.exe	107
PID 352 wrote to memory of 1492	352	chrome.exe	106
PID 352 wrote to memory of 4224	352	chrome.exe	107
PID 352 wrote to memory of 4468	352	chrome.exe	108
PID 352 wrote to memory of 5112	352	chrome.exe	109
PID 352 wrote to memory of 4468	352	chrome.exe	108
PID 352 wrote to memory of 5112	352	chrome.exe	109
PID 5848 wrote to memory of 2472	5848	2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 2472 wrote to memory of 1756	2472	msedge.exe	111
PID 2472 wrote to memory of 5324	2472	msedge.exe	113
PID 2472 wrote to memory of 4312	2472	msedge.exe	114
PID 2472 wrote to memory of 4312	2472	msedge.exe	114
PID 2472 wrote to memory of 4312	2472	msedge.exe	114
PID 2472 wrote to memory of 4440	2472	msedge.exe	115
PID 2472 wrote to memory of 4440	2472	msedge.exe	115
PID 2472 wrote to memory of 3080	2472	msedge.exe	116
PID 2472 wrote to memory of 3080	2472	msedge.exe	116
PID 2472 wrote to memory of 3080	2472	msedge.exe	116
PID 2472 wrote to memory of 3568	2472	msedge.exe	117
PID 2472 wrote to memory of 3568	2472	msedge.exe	117
PID 2472 wrote to memory of 3568	2472	msedge.exe	117
PID 2472 wrote to memory of 5704	2472	msedge.exe	118
PID 2472 wrote to memory of 6108	2472	msedge.exe	119
PID 2472 wrote to memory of 5704	2472	msedge.exe	118
PID 2472 wrote to memory of 5704	2472	msedge.exe	118
PID 2472 wrote to memory of 6108	2472	msedge.exe	119
PID 2472 wrote to memory of 6108	2472	msedge.exe	119
PID 2472 wrote to memory of 1300	2472	msedge.exe	120
PID 2472 wrote to memory of 1300	2472	msedge.exe	120
PID 2472 wrote to memory of 240	2472	msedge.exe	121
PID 2472 wrote to memory of 4200	2472	msedge.exe	122
PID 2472 wrote to memory of 240	2472	msedge.exe	121
PID 2472 wrote to memory of 4200	2472	msedge.exe	122
PID 2472 wrote to memory of 5096	2472	msedge.exe	125
PID 2472 wrote to memory of 4156	2472	msedge.exe	126
PID 2472 wrote to memory of 4156	2472	msedge.exe	126
PID 2472 wrote to memory of 1452	2472	msedge.exe	127
PID 2472 wrote to memory of 1452	2472	msedge.exe	127
PID 2472 wrote to memory of 1576	2472	msedge.exe	130
PID 2472 wrote to memory of 1788	2472	msedge.exe	131
PID 2472 wrote to memory of 1576	2472	msedge.exe	130

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5732
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_2d79ec6eceeccdb7f039e43c968c4805_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8c55dc728,0x7ff8c55dc734,0x7ff8c55dc740
      4⤵
      PID:248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,2941717456888710732,2670640597903580744,262144 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:4656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,460524764872742269,8020027148235796679,524288 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      System Time Discovery
      PID:2920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,5908966850558259295,14812731538799878457,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
      4⤵
      PID:2844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,3442868359911542924,2018856178346580018,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      PID:1256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,16312244597312846577,519427115195515812,524288 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
      4⤵
      PID:5048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,14904843705528028687,3422856010963594769,524288 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
      4⤵
      PID:2284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,4000798595480345171,3975888108475894942,524288 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,4924532120541519877,8360417045680615827,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
      4⤵
      PID:1896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5484,i,17473135171429602308,14768941900823341867,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5784,i,16815058971471633054,5126599267235772554,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5880,i,11007704291470632829,17084283222312728085,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5524,i,14596805967167802705,10642709367193198792,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,16104048809164105080,14363976242126696359,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5808,i,3473041529486963500,8126192383763137198,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4736,i,4923573921873130614,16493545466175509013,2097152 --field-trial-handle=1920,i,9445228409273888510,10755614613243900426,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
      4⤵
      PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8b9bbc188,0x7ff8b9bbc194,0x7ff8b9bbc1a0
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,7412592971984923681,17088653848484510000,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
      4⤵
      System Time Discovery
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1956,i,2119781933405954272,6936882404086642650,262144 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,8310252945718324702,13547018384834785341,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,10265600861788325553,11359650110537867773,2097152 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,12211774565500065533,16658083077519651088,2097152 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3996,i,3721636474977479081,13134262851503076724,2097152 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,2307015639121807648,2277486826010824832,2097152 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15351980503120053998,12499234684571907029,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4303997009961483171,10960085635203406132,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14184744042897802073,14243640040529247986,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,10114115427133992736,18024796253077225826,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,10114115427133992736,18024796253077225826,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13537548952015343382,13375006481303662164,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,11506083382088276942,12719010775532953230,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,15537327760850607221,9826618612536439377,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,5922158885834523843,1506618464305048617,524288 --field-trial-handle=2432,i,8317301466215830267,3135666716701576613,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:1788
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2e040990\07e98569.dll",Collect C:\Users\Admin\AppData\Local\Temp\2e040990\2f139469.job
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4a517bdcf61fb34d04b782c14972bb74ee81087cdf4812cd6eb5bcfc19667833
MD5 cdef772e2ea2aaeae7205118ace88907
SHA1 6f832d325d6bb369111e66999fdc1662a6a85ee5
SHA512 cdb0d43b5f97c84f39370bb8439cef608c65db5b1f6bc987b2556b64c8bf1b543ed63e5ddacf47d7b748c03590dbb4977d21b456f3dd4ad4102be2e94ed0adec
SSDEEP 192:7REgfLTv7KvAPRp2Q9NLHsb+WNnC3PXlYy+kwTVyIsnAUgR:7REgjru6XD3wKPVaVR
TLSH
T12032B82EBD24683B6ECAC61AF9657753DBFA102121D42E84E7FC592C14D75DC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 9e25965eaeabb068d37e9b08692e34b34da961a016f1cc1a6fe9bb3b3d5f9773
MD5 73af693d51694baee684e97d7e6f7445
SHA1 d348e843d82bc7620a648972bc69c6a3f158fbbb
SHA512 4fdd9f9654cfcc6dd6bd1953ff6e7994e9c2ad1e2ced9bef65c6f3084c7b598975512ba09180d6d5dfed561ad8c335df9056495455e3ca4383eb3345ddc7dee4
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2ORdcVum3nqV:1nbZeMrv/hGtRd4nA
TLSH
T1AAD3864B3A743102EDE58A722CE051BF5E3C716D8F5595D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 afa1505e7692b9366218da0b57e25c113d6158a4f03e0d017002ec72f5fdabc6
MD5 11cb6c0813c56c28e26e8f8628e18810
SHA1 c65bbfade965e0ba6bd84e063578988303c792cb
SHA512 339420f0080310280f1500139b4f95d69e55f78be8a631149e92b77b13efb9b1d591265cce85a347b8faeb9234f8ff0235af00f1500c77812e011d4265bf32de
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5fqDcB6WGyvUU+qsbL/Mmv4a:BC0qDHUgvIdaDUDUwCI+qsbL/N
TLSH
T12FA12932A02D4D735A76D909F8662E43CEB8606BE932BE94D9DE0E0C11E70EC1302617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 990b5577014b541e97a47d5c958e137ab885c286d9b96509befcbdc30bb15c50
MD5 9c57b0bf9cb1b8296a6dfee02356fb95
SHA1 d834c9f281847450678ea26e71f478eca6a9d2dd
SHA512 f4f7c2399f0aef941683ed446caffec38e3c9127b2c6f870e781145c9e6fe33338815cc3d6f71da964a895d1ede3a29427d423648afea6c2884a035d8fa9ff64
SSDEEP 96:hC6Zld+hDK+UyKovbfaNQYJmtVSl8h4otop5f6DcB6kGyvUgIlG1QzbOQ85PfqIN:hCIqDHUgvIdkiU2EwksIlTLEPfqIoUd
TLSH
T1C8C11935B47CAD7359B3D649F8232E43CDB6206B9951AEA4D6DA0F0C02D74EC1343527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 77d2a3144d826b9e207a886cba1981085fc2604db736ac62e3a65ee400f5937f
MD5 75a1e93aac8c993a3485e1ffe1c18d57
SHA1 05ee9cb6a0b733a65c90797c33dc8da7de115e83
SHA512 1f43f3bbc4dbec9e7b478d6bd09e933af10514b6190584d184ecd331ecabf7ac73389bc3c66342e4ba6eb29c3f3188b3be5444aa2d26c1f5456d052a7e28a454
SSDEEP 768:aW5WKL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAc1s2ro/Mg5xA:aW5WKdE710Wg/XfCfu1jafysN/Md
TLSH
T1C4E2FB3B280CCB7E4F444A9DED297D9BAD9802CB96DCCD5447EA840C03C6BEB56164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 369aaf07422396949b9cda6114f7b5ff716bfa1d75439f8dff4337633562f253
MD5 1b89f7e2c80ffa70a51c6d76c48134c8
SHA1 a8d386ad1940eb7b09a7e5970927f8797158e483
SHA512 f1b9014f2883d7c5d84945e600bd9f8280e73a49072496ed3d9a679b0476713c6eb8919f711569679922ee0f5986e9d3c7187f8973b1f4392a3146cf969002b7
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHc9oMmqesWa33gUsK45gesc8M32c8X8A8O:C3gFB31lERe1JDggH2vHG5FaHc9oMmq7
TLSH
T15DB10840717A069538BFAA0980BE8C1F82C1B4657315E52B3FA902E64F67E339DFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 27215468d69a4a8fcb1dfdd0e42e03ab99a84b33016631d9f8c8e21b228aa2a7
MD5 9edce4f7b390e1b289f922b12edb318c
SHA1 d8c68c73f77146a8be84227e97da3a72877a09d3
SHA512 7372f748937c25ececb746379087af0fd28910165378dbdae36f59cbea08d69e26b8bd2f566d23fbbe38f3dae1a676da22591cc9cb203d0ee2858b5873dea3cb
SSDEEP 384:DNrRZyCSDnxTICJkMEhIKyll7svbFKfk7:xFZJSDni+yI1l7svbF9
TLSH
T15F44840A7B747001EDE6D9721CB080771E3C716E8F22A6D16DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b42be24c-21d3-4499-ba26-9a53e627d842.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b42be24c-21d3-4499-ba26-9a53e627d842.tmp
Size 14KB
SHA256 36361dd924ad1aa5f79cdbe59208b9697d563c96f2e936a6c092982a9b3a9287
MD5 2d81f76f8b485b74af003adbc4859e4e
SHA1 5eeb96f38d7c8d6f15c6a1b1d31bbaf612ef46aa
SHA512 7539f1b68f66c9fe9000fe5f8e599b34549c8db17992c2c0c51987382a3ef5bdf5c57dd0a682146312c2d9e009b37689d11bdc4f9aa1f1940f68f9f7be9564c2
SSDEEP 192:sxRWRYyM/jK1Ml8wCI/fOssEKCA94/YzoA8pi/g6+WNIYD986SeGtHIgVsJ:sxRWC8I/fOssEZ88i/5ISSb+
TLSH
T15852E9056A349D7BCCDBD20DFA557F93D6F91533A1901E44AAFC9A0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5e885f359f0ea66bc95f765dd5de6d6ec02ab14ca2ed0da85a1077974d6a7706
MD5 c215a8a60c50084bc3eff4ce4c698c92
SHA1 6525a8891c1d59c3861a8d7ac13dcdc15a167585
SHA512 6de0af77f28070e80790c7b8d61b1453fa483c889ce21177b929f02d98c84fc8c64d5e942e3392cdbad328f4994a3e7974ecd877e4f3b38a65c8790f19292618
SSDEEP 384:nrZcIt38NmxSEDK69iuWZlf8hyEGojF4QFky2rEoajo4cdR8eHhVODjYPNDUMC3t:zt31Ei0frEnjN3Gac1FC3ojKgqmUQ+
TLSH
T1F2F2AF7469749EB3C9EAEB8675477B43AFF1571391D00AE4DADC6A0D018369C230B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 04e0e2b910d749564fdd1e40e61d2a7fe846f491f22cb557e1eac7cd33e7dd35
MD5 3bf22c01783d0c60a527c779eb68a1e1
SHA1 fa2e2ec48b7bc29ea30be27a1660e5795c3d857a
SHA512 712bc6a95ef39b7afa6d4a4d0274c3a214024a887f40d0199b7dccf6c7791caa27ee77f52ab2d1c70653f9cb3a37ae7105d036297c4fecd65b7b399ab0421733
SSDEEP 768:rrv+4UNbdS35mi00rEnjN3Gac1ZieVH1SCz:rbsbg3e0QnjMalEH1V
TLSH
T1A503CF3269B88A738CE7E38571877A037EF4525386D40BE4CACD6B0D46975EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a8d116a-4573-4e96-acb6-981c20d8b657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4a8d116a-4573-4e96-acb6-981c20d8b657.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59bc9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59bc9f.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

07e98569.dll

Path C:\Users\Admin\AppData\Local\Temp\2e040990\07e98569.dll
Size 15KB
SHA256 ce5143f042ae1a256a802cb51ac9c478e912cd29d2467df0b76c51aacbdc7226
MD5 6e473aec97c139ff90bc15e486b4cb77
SHA1 0526444dff784032762217b73bf64953198920f9
SHA512 d4ebb14ff87c040af1b7bdf6d461bc1d1a3cb974fa20dd2ac3dc53721353e86c48e7238220df185f0c7afe509c52f515d0100234e8f71497e3bc04a49fc7acc0
SSDEEP 384:3SmFjZHQYOleMiQQmTBpngWDPGjaw2CGiR5F:itYOle/yBpngkPGGwfR3
TLSH
T10C724B46BB2996F0C473C07CA44A6743E462389813B19B7F1BC0CD6D265AB17A77E713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f139469.job

Path C:\Users\Admin\AppData\Local\Temp\2e040990\2f139469.job
Size 3KB
SHA256 e3fc221a21a51c9a3786444ceb73ee417d2319712308b14c20cba5692906a2b4
MD5 8b77223cce317b622d2a5ec18534eea1
SHA1 e44c7679e5b99e1d9e946636d1feeafb6b068b8e
SHA512 17577feabff753a5a3e0e78a902643a218f8783c3cddb1946c562a867461087642e02a7c68d565c76abf5df0eca67a508c826f5594904f299ec7f869d6bf0ccd
TLSH
T1B2518F57B2D6C69F2881E8B32360E18CD4F25D0CAB893B16D705CA4D71CAA5EF1D63C2
MD5 SHA1 SHA512 TLSH

Submit Download

2f139469.job.ok

Path C:\Users\Admin\AppData\Local\Temp\2e040990\2f139469.job.ok
Size 1KB
SHA256 1ef1d7a685dc239fcd63c62178f38f4050ffcb50f9b7a945137497146f1a78c9
MD5 371db07624c65944d68ebd4f29f7a937
SHA1 7ecdadd97ccf79ea5d35bd7d92eea406804741f5
SHA512 a2c73e836461fe8c211f09d39d8cf9449a1f98afcc31257fb02c62b3954fcfbc535777b9ceffe18e4423438bf5575449da4569fa23d087c9ab286f706fb87164
TLSH
T1C521EB5672CBC63E4985E42715F1E54C94F00C0DAF473FA0E251CA8D12D665EF6D2383
MD5 SHA1 SHA512 TLSH

Submit Download

6f1ba260-b635-4769-9c91-df2d36fea608.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f1ba260-b635-4769-9c91-df2d36fea608.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2472_569855500\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5848-67-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-64-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-120-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-136-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-140-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-139-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-138-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-137-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-129-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-128-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-127-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-126-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-119-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-118-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-117-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-116-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-115-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-114-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-113-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-111-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-108-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-107-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-106-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-96-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-100-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-99-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-98-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-97-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-78-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-77-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-76-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-75-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-65-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-112-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-63-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-57-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-56-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-54-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-55-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-48-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-110-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-86-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-79-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-74-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-66-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-0-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-53-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-47-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-46-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-42-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-18-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-14-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-15-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-13-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-12-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-11-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-10-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-9-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-8-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-7-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-6-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-5-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-4-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-3-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-2-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-1-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download

memory/5848-2571-0x00000001E0000000-0x00000001E024C000-memory.dmp

Download