12713fedaa22f72e472994a2a1d72cc86b76f291c5ec5bdf88795d40be2a8724

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Size 4.3MB
Sample260804-ldbhasstgt
SHA256 12713fedaa22f72e472994a2a1d72cc86b76f291c5ec5bdf88795d40be2a8724
MD5 da6f42ef9678f5a935ad616bd24bd3d7
SHA1 69dc4969c741bbd61d4321fbc1ea85472d189e7f
SHA512 07777df36c5f668b88596aa742d72fc29dcb4fe769b93532e6e99699cd925be92b4c5e0e1d59b87789bc935e866a6b1817f841832724c00b77bdeca7eafb18e3
SSDEEP 49152:wpGhE+e7axKzgYFVht1P/3Ofamcbj64b+j9tL4ojHYCpj:wjzVDEGr04oLBj
TLSH
T1AC268C07BDA948F9C0ADE73989B64216B630B809473133E32E51BBB82F767D09E35754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 20 IoCs

description	pid	Process	procid_target
PID 5452 created 6292	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 5452 created 6304	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	91
PID 5452 created 4400	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	92
PID 5452 created 4328	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	93
PID 5452 created 1300	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	94
PID 5452 created 6196	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	96
PID 5452 created 6508	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	97
PID 5452 created 6292	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 5452 created 6292	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 5452 created 4328	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	93
PID 5452 created 4328	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	93
PID 5452 created 2784	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	111
PID 5452 created 3448	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	112
PID 5452 created 5876	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	113
PID 5452 created 7152	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	114
PID 5452 created 1676	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	115
PID 5452 created 6088	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	117
PID 5452 created 5324	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	118
PID 5452 created 2784	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	111
PID 5452 created 2784	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	111

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5452 created 4440	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	83

Loads dropped DLL 1 IoCs

pid	Process
2236	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4328	chrome.exe
7152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303091021112015"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{AD34DFCA-F3A2-4C0A-A557-55CBBDAE561D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
6292	chrome.exe
6292	chrome.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe
Token: SeShutdownPrivilege	6292	chrome.exe
Token: SeCreatePagefilePrivilege	6292	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
6292	chrome.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 6292	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 6292 wrote to memory of 6304	6292	chrome.exe	91
PID 6292 wrote to memory of 4400	6292	chrome.exe	92
PID 6292 wrote to memory of 4328	6292	chrome.exe	93
PID 6292 wrote to memory of 4400	6292	chrome.exe	92
PID 6292 wrote to memory of 1300	6292	chrome.exe	94
PID 6292 wrote to memory of 1300	6292	chrome.exe	94
PID 6292 wrote to memory of 6508	6292	chrome.exe	97
PID 6292 wrote to memory of 6196	6292	chrome.exe	96
PID 6292 wrote to memory of 6508	6292	chrome.exe	97
PID 6292 wrote to memory of 6196	6292	chrome.exe	96
PID 6292 wrote to memory of 2612	6292	chrome.exe	98
PID 6292 wrote to memory of 2612	6292	chrome.exe	98
PID 6292 wrote to memory of 5064	6292	chrome.exe	99
PID 6292 wrote to memory of 7020	6292	chrome.exe	100
PID 6292 wrote to memory of 7020	6292	chrome.exe	100
PID 6292 wrote to memory of 2560	6292	chrome.exe	101
PID 6292 wrote to memory of 2560	6292	chrome.exe	101
PID 6292 wrote to memory of 3780	6292	chrome.exe	105
PID 6292 wrote to memory of 3780	6292	chrome.exe	105
PID 6292 wrote to memory of 4276	6292	chrome.exe	106
PID 6292 wrote to memory of 4276	6292	chrome.exe	106
PID 6292 wrote to memory of 3528	6292	chrome.exe	107
PID 6292 wrote to memory of 3528	6292	chrome.exe	107
PID 6292 wrote to memory of 6264	6292	chrome.exe	108
PID 6292 wrote to memory of 6264	6292	chrome.exe	108
PID 6292 wrote to memory of 2692	6292	chrome.exe	109
PID 6292 wrote to memory of 2692	6292	chrome.exe	109
PID 6292 wrote to memory of 2744	6292	chrome.exe	110
PID 6292 wrote to memory of 2744	6292	chrome.exe	110
PID 5452 wrote to memory of 2784	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	111
PID 2784 wrote to memory of 3448	2784	msedge.exe	112
PID 2784 wrote to memory of 5876	2784	msedge.exe	113
PID 2784 wrote to memory of 7152	2784	msedge.exe	114
PID 2784 wrote to memory of 5876	2784	msedge.exe	113
PID 2784 wrote to memory of 5876	2784	msedge.exe	113
PID 2784 wrote to memory of 1676	2784	msedge.exe	115
PID 2784 wrote to memory of 1676	2784	msedge.exe	115
PID 2784 wrote to memory of 6088	2784	msedge.exe	117
PID 2784 wrote to memory of 6088	2784	msedge.exe	117
PID 2784 wrote to memory of 6088	2784	msedge.exe	117
PID 2784 wrote to memory of 5324	2784	msedge.exe	118
PID 2784 wrote to memory of 5324	2784	msedge.exe	118
PID 2784 wrote to memory of 5324	2784	msedge.exe	118
PID 2784 wrote to memory of 3248	2784	msedge.exe	119
PID 2784 wrote to memory of 3248	2784	msedge.exe	119
PID 2784 wrote to memory of 2276	2784	msedge.exe	120
PID 2784 wrote to memory of 2276	2784	msedge.exe	120
PID 2784 wrote to memory of 6984	2784	msedge.exe	123
PID 5452 wrote to memory of 2236	5452	2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	126

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4440
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_da6f42ef9678f5a935ad616bd24bd3d7_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff96819c728,0x7ff96819c734,0x7ff96819c740
      4⤵
      PID:6304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,7112937534333151688,12854540360042689479,262144 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
      4⤵
      PID:4400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,9890592525478968686,15133563926988146862,524288 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
      4⤵
      System Time Discovery
      PID:4328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,18391839713719995603,1828295489850406940,524288 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:13
      4⤵
      PID:1300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3020,i,3104856275594073820,4644007336385434105,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3008,i,12764409002828098910,17299047764284662595,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
      4⤵
      PID:6508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,17030113104171033090,14394348416184531029,524288 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,9137651277735749606,15406011474999899263,524288 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:5064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5432,i,16737116674449916691,17937345350315886904,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:7020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,2352733178394696200,573261676206346446,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:2560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5760,i,436581942085994856,10135003767045248587,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5724,i,9692797992595409905,8589097094254271818,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5624,i,13668029176134762358,7678469468428900839,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5864,i,9606477137568170989,11599470817327893344,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5996,i,5174360763634700724,12924045318779212419,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5784,i,12662020572637423624,16549944446238968295,2097152 --field-trial-handle=1932,i,3457874404787380197,531740417041679711,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
      4⤵
      PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x28c,0x7ff95bd9c188,0x7ff95bd9c194,0x7ff95bd9c1a0
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1732,i,492928531481576666,12731123536297341019,262144 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14960723198096651931,8716075496243359631,524288 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
      4⤵
      System Time Discovery
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,6077744169776196403,14893839049925196040,524288 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10194829359712241780,6223728584606705526,2097152 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8284519006805311407,3286082214497591801,2097152 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,543361606935209847,9798360630588790002,524288 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,10972869267910039594,14212489746902674868,524288 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9812232054564799416,13286109600384064965,524288 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9812232054564799416,13286109600384064965,524288 --field-trial-handle=2256,i,2665958729468519853,13572167233821372845,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:6984
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\41954c1a\639fc507.dll",Collect C:\Users\Admin\AppData\Local\Temp\41954c1a\d3943703.job
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0752e94d5adb43843f44c918e31971e606b5abfc45ad4be1145ebf29530e7970
MD5 decc0fa8d0544b79fda2518d66306db1
SHA1 7bcc79bfad9140963a307e42d2773ae67e9578f9
SHA512 50623df62d8a2bcfb639ef25d6372dd172b4cb9bdf6aae36c7342d78e71e240a2db01c4d533ff16157736c40b52a69c37412cb4640f0de7e6b6a4b0c9a5b8bec
SSDEEP 192:+RcAq7WvR9QLxxKv7FTvAPRp2c9CHsb+WNnc2BPlz8ezHLWVyIsnAUgR:+RcAq7WvfQLxxG5T6XfkwcMPlZruR
TLSH
T11D32B72EB960687BADCBD229F9617B93E7F5102532D42E84E7FC9A2C14D75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b798aa8ff1ab9122c5dc52648d6d72f2c831f1a520ebd17bb65be9bb2dccf6ee
MD5 003daaa734a46cd6ef53b351c47b9b5d
SHA1 1ff883d8082d927caa813a44cebad22c52910e2a
SHA512 25faaf3079f708e8f6544e4750f01617918c33b068d9e07c1a48cafe1af53d443293a0526dfd4469edfbd421f6cceb41416466a44635f042c0eba83e7f6f2b97
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Ol4lnln5xn61VumKn1nfnUna4:1nbZeMrv/hGtlYnln5xnfn1nfnUnP
TLSH
T142D3984B3A743102EDE59A721CE051BB5E3CB16D4F55A5D438B620688EF2823A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a3a3f59d7676d8fd2c629c93dc1062999410edcd1cf53b2d341756ff51c87b92
MD5 eb405f54f3fdfbdca3ed649a22f6d023
SHA1 6eb877b98bae183db52375a2c4852f3696b36f65
SHA512 acfc8285dd95db3013fd567fa935cfe8a6da9014b11ab5e8ccf36df283bc3b4b9fcfcf553c7c8eacf8c08a8a7b1eca2c88dba2a5f83260679c7e36674d371885
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5cLVDc2mB6xGyv1T51CqbKv4a:MkC01N2c6AGDDUDcZc31U51CqbU
TLSH
T1F7A10832686D9C7788B2C949B5522F43DEB8712BF921AF94E6ED5A0C11B70EC2381517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ca25d15e9258709580351409c238fc3e2e2a48adda09137bd1c50a672f73cbbe
MD5 c91177984df16692c72865a54c87e357
SHA1 46905bc09e9f5c1cce872c76be025bddaefde252
SHA512 21d245c848629d4dd7de196af2bb9b73b5e2b9824bc6b9dac19f49095de8102a1e1d2ecc830d72689000b2eb0f023789e4970ef893f15c055c7ea531fd7f53cc
SSDEEP 96:MWC68d+CNkx/Fc5vBh2F8vIfjnNAS3oZr4Sl8h4otop5cLBDc2mB6I0Gyv1fQBFc:MWCr1N2c6AS4+iU2cNc33JwQBF+uLI1f
TLSH
T1FFC1E876787DAC3348F3D559B5132B53CEB4612BA601AFA8EBEA5B0C01D74EC1382517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 95e4c2d813d6e78bab2872170c0fc912137b05599f556b17aef031d4775be0c8
MD5 65294ac6686ac30d5ed3ed3bb7becf0f
SHA1 18b7e45bbcdd488a5f5bc3f29af169c0341089b5
SHA512 5debee57667ab31a8fd5f4ea7afe60dc07608a377131ff3483a99e9f6e6cff2cb401b04bfa771760353a82cc744446cffd983adb65e25d416b1f765ddb2dc332
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9/5s:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR/
TLSH
T10DB25C51713F4680387EA50C81B8981E86C2B4A37519F52F7BAC06A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 48f938bcde41e80f55a2deba0df26c620d1bab640c8f67bed263805227cb64a4
MD5 a84edd9adc77f4f551b938557fb80822
SHA1 bfc87eb2d1f4aa44b78e588d3471446065bbed25
SHA512 770aebcc0ef0683c80e4640b19c0cb5e31e12a0acc941f16ed5e7c1126dfe4e47b4621186d6dc797a665155b0872806cb36aca167f788173296f403c64163833
SSDEEP 384:DNrRZyCSDnxTICwMEhIKyll7svbFKfk7:xFZJSDnigyI1l7svbF9
TLSH
T10144740A7B747001EDE6D9725CB080771E3CB16D8F22A6916DB254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a05ca7f4cddf8c10363712ff5d126639030c2d9576afb8feec291836a9748b69
MD5 c727ad69881626119762918be1d69c46
SHA1 b1e61e38703b9d9b19bcc3139fb028c65d26acb1
SHA512 7d3fece60ac8f7bdec695959de0c8fd7f1b928f3e91cc74309276c2ab784a8a3411a2a719bd5331d376b7314d9c4aa396ec9f90ee02a0fc230c04587596948f7
SSDEEP 768:fF1j+9SX6wgUun6Gexe1lXDvNVTFTAV5X5i:W9SXbuse1lXDPFTkpi
TLSH
T12CC25B31AC55DABBEDE68FD9B70A7A06EFE0519384D86DD4DAD81E0C00C72AD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

639fc507.dll

Path C:\Users\Admin\AppData\Local\Temp\41954c1a\639fc507.dll
Size 11KB
SHA256 fd71639893caa4176d9b5d960e5851481955fb92875f8627c021f24f292bcf2f
MD5 13fc111f085820e13f107bae428ac633
SHA1 4a7673449a0078b8316db485f02485038965f262
SHA512 09506362f2835459dcfaccee5d1c19236575676b9e85cfdfe9a1714633f67acf3c0d2990fa258702037900b6a736a1f33dde3a76da36a817630aac11be6fcc26
SSDEEP 192:ishdspbhgYKgE8KgwN5oBlB82z9bCNUXQj+ThzBEszJ:iKdsJhdKcgkBH5z9wEpf
TLSH
T10A327C56AF1786E4D45680FCE012B723C7B9F31671A98A4F9912C85D1FCB6F370A8B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3943703.job

Path C:\Users\Admin\AppData\Local\Temp\41954c1a\d3943703.job
Size 3KB
SHA256 bc96e13664764290c87ae401eb4ed60288635f0e2a3fe3817599e6aea9771f11
MD5 c330daa1d75efd34764b02ad09e6e019
SHA1 808007197dd01f9c6aa06fb4c98e6f6fef1f2832
SHA512 e2d925cb09ccc410986f42fc23539d1738886446cc4abfdfed97cc65dd5e0a16e6ca65e41a05eb9f5d99be5bf8b29b900df5321682c10badfb885479ce7efa48
TLSH
T1F6515A17B3C5CA9F2881E8B32721D48CD8F28D0DBB8537269705890D71DAA9EB1D63D2
MD5 SHA1 SHA512 TLSH

Submit Download

d3943703.job.ok

Path C:\Users\Admin\AppData\Local\Temp\41954c1a\d3943703.job.ok
Size 1KB
SHA256 7bed27358dfa4f403f765094f75fbca06fd4821d9c8784df3e33c7f4afe092b2
MD5 69becd8030cdcde0f8e6c72fd5a27fcd
SHA1 2ab8e9d9e386593e5630857dc6094499f6851db3
SHA512 b18db822dcad94e2c924def4ac21b241ea1b1f442e95020c4e3fb32ea4509d286b776b3284b4656c123661871291f8e18826eee8e92d241539205d7fc5b4e066
TLSH
T1D921002B72CBD65F1988E4135971D58C98B00C0EBEC737708712895C16E6D5EF6C1343
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5452-88-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-113-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-29-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-44-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-46-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-49-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-51-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-56-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-55-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-58-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-60-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-50-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-59-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-61-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-65-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-66-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-70-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-73-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-72-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-76-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-80-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-78-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-82-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-87-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-16-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-89-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-92-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-98-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-97-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-99-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-103-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-106-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-108-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-17-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-118-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-120-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-124-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-134-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-138-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-144-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-154-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-152-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-151-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-139-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-132-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-131-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-130-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-121-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-111-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-112-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-104-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-15-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-14-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-13-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-11-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-12-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-10-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-8-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-7-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-6-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-5-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-4-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-1-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-0-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-100-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-93-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5452-2121-0x0000000410000000-0x000000041023B000-memory.dmp

Download