20985bda95e390d40ff6a2b968998ac9e13d20497ef17c087cb59828f18383bb

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.1MB
Sample260804-llsfsawhrc
SHA256 20985bda95e390d40ff6a2b968998ac9e13d20497ef17c087cb59828f18383bb
MD5 ce836c60e36f69b282bf5856bb4d22e2
SHA1 a5bc171af4ddda8664e254532f9a5d918282e26d
SHA512 62fc031d1f2c1f75a18f5082e7fb6a9feb241ec10792c8becc47c2818ad6881b3b2741175086d7ec6049da5a2c372da300536bab3db8d98706fb37ddc1f3b2eb
SSDEEP 49152:mjDt+LNAG0ZGpYdavq8lfWK8RfXJdIvEzzQD22D0m2/:mVNPeWK8pPIvGzQD2fb
TLSH
T1C616AE03A95548FAC1E9D73984B262267A74B80D4B3073D72E22BFB92F763D05E39744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 5576 created 980	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 5576 created 4104	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 5576 created 256	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 5576 created 3260	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 5576 created 628	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	94
PID 5576 created 1384	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 5576 created 4568	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	96
PID 5576 created 980	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 5576 created 980	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 5576 created 3260	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 5576 created 3260	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 5576 created 3536	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 5576 created 2736	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 5576 created 1280	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	114
PID 5576 created 760	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 5576 created 1196	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 5576 created 5588	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	118
PID 5576 created 4732	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	120
PID 5576 created 672	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	119
PID 5576 created 3536	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 5576 created 3536	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 5576 created 1280	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	114
PID 5576 created 1280	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	114

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5576 created 3588	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	80

Loads dropped DLL 1 IoCs

pid	Process
4104	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3536_1535484832\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3260	chrome.exe
1280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303098894596596"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{391803EA-1F1F-4D2E-B555-41DF932CABEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
980	chrome.exe
980	chrome.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe
4104	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe
Token: SeShutdownPrivilege	980	chrome.exe
Token: SeCreatePagefilePrivilege	980	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
980	chrome.exe
3536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 980	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 980 wrote to memory of 4104	980	chrome.exe	91
PID 980 wrote to memory of 3260	980	chrome.exe	92
PID 980 wrote to memory of 628	980	chrome.exe	94
PID 980 wrote to memory of 628	980	chrome.exe	94
PID 980 wrote to memory of 256	980	chrome.exe	93
PID 980 wrote to memory of 256	980	chrome.exe	93
PID 980 wrote to memory of 1384	980	chrome.exe	95
PID 980 wrote to memory of 1384	980	chrome.exe	95
PID 980 wrote to memory of 4568	980	chrome.exe	96
PID 980 wrote to memory of 4568	980	chrome.exe	96
PID 980 wrote to memory of 4364	980	chrome.exe	98
PID 980 wrote to memory of 4364	980	chrome.exe	98
PID 980 wrote to memory of 5720	980	chrome.exe	99
PID 980 wrote to memory of 4512	980	chrome.exe	100
PID 980 wrote to memory of 4512	980	chrome.exe	100
PID 980 wrote to memory of 4216	980	chrome.exe	101
PID 980 wrote to memory of 4216	980	chrome.exe	101
PID 980 wrote to memory of 4588	980	chrome.exe	104
PID 980 wrote to memory of 4588	980	chrome.exe	104
PID 980 wrote to memory of 3184	980	chrome.exe	105
PID 980 wrote to memory of 5712	980	chrome.exe	106
PID 980 wrote to memory of 3184	980	chrome.exe	105
PID 980 wrote to memory of 5712	980	chrome.exe	106
PID 980 wrote to memory of 5472	980	chrome.exe	108
PID 980 wrote to memory of 5472	980	chrome.exe	108
PID 980 wrote to memory of 2120	980	chrome.exe	107
PID 980 wrote to memory of 1468	980	chrome.exe	109
PID 980 wrote to memory of 2120	980	chrome.exe	107
PID 980 wrote to memory of 1468	980	chrome.exe	109
PID 980 wrote to memory of 1476	980	chrome.exe	110
PID 980 wrote to memory of 1476	980	chrome.exe	110
PID 5576 wrote to memory of 3536	5576	2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 3536 wrote to memory of 2736	3536	msedge.exe	112
PID 3536 wrote to memory of 760	3536	msedge.exe	113
PID 3536 wrote to memory of 1280	3536	msedge.exe	114
PID 3536 wrote to memory of 760	3536	msedge.exe	113
PID 3536 wrote to memory of 760	3536	msedge.exe	113
PID 3536 wrote to memory of 1196	3536	msedge.exe	115
PID 3536 wrote to memory of 1196	3536	msedge.exe	115
PID 3536 wrote to memory of 5116	3536	msedge.exe	117
PID 3536 wrote to memory of 5116	3536	msedge.exe	117
PID 3536 wrote to memory of 5116	3536	msedge.exe	117
PID 3536 wrote to memory of 5588	3536	msedge.exe	118
PID 3536 wrote to memory of 5588	3536	msedge.exe	118
PID 3536 wrote to memory of 5588	3536	msedge.exe	118
PID 3536 wrote to memory of 672	3536	msedge.exe	119
PID 3536 wrote to memory of 4732	3536	msedge.exe	120
PID 3536 wrote to memory of 672	3536	msedge.exe	119
PID 3536 wrote to memory of 672	3536	msedge.exe	119
PID 3536 wrote to memory of 4732	3536	msedge.exe	120
PID 3536 wrote to memory of 4732	3536	msedge.exe	120
PID 3536 wrote to memory of 1392	3536	msedge.exe	122
PID 3536 wrote to memory of 1392	3536	msedge.exe	122
PID 3536 wrote to memory of 5000	3536	msedge.exe	123
PID 3536 wrote to memory of 5000	3536	msedge.exe	123
PID 3536 wrote to memory of 2760	3536	msedge.exe	124
PID 3536 wrote to memory of 2760	3536	msedge.exe	124
PID 3536 wrote to memory of 2140	3536	msedge.exe	126
PID 3536 wrote to memory of 3340	3536	msedge.exe	127
PID 3536 wrote to memory of 3340	3536	msedge.exe	127
PID 3536 wrote to memory of 112	3536	msedge.exe	128
PID 3536 wrote to memory of 112	3536	msedge.exe	128
PID 3536 wrote to memory of 3692	3536	msedge.exe	131

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3588
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd24f1c728,0x7ffd24f1c734,0x7ffd24f1c740
      4⤵
      PID:4104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1540,i,8994193989489133863,3483301219645955270,524288 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
      4⤵
      System Time Discovery
      PID:3260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1724,i,19495601355591967,5023404610792757862,262144 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
      4⤵
      PID:256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,11452752869918219820,8709151361715384904,524288 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
      4⤵
      PID:628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,12330124552695892432,9167324629177124687,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:1384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,15017790941214327855,16185619879498715252,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:4568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,7643440033429840725,16084725181490959653,524288 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,7232666336919935314,17697965697137610493,524288 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:5720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5476,i,3656575714110816694,731700331513505990,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:4512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5520,i,1689398339427052008,11242716372649020898,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:4216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4804,i,4821157222161084166,3619646291564310850,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,6994549952098762239,9048426689336023564,524288 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5812,i,7789291343872229642,3292086347757760479,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5944,i,15970398267409642434,7541145311427176827,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:2120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,14761493225153942559,10974761992223953028,524288 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5660,i,13833963342592390111,15594400547053351980,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      PID:1468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5756,i,8036181110533013087,3215470546530990289,2097152 --field-trial-handle=1924,i,1594352975200442278,9453361572398917760,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2bc,0x7ffd1a74c188,0x7ffd1a74c194,0x7ffd1a74c1a0
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1636,i,5059205578578113843,14280667653045216883,262144 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4150877202163678797,1080428320244995953,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      System Time Discovery
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,2886933038818538558,8615862549497926737,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,11446579917676487888,6714771747993463416,2097152 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16566365102585950508,11053734693190318144,2097152 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3592,i,6990343358862979423,2473054198668692901,2097152 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:9
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,7253318301111516143,5314003962183123252,2097152 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,8338563850030327188,16313402520137013066,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,7276480827185116001,3506103808469214851,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,4685707992051922632,2029222306411118257,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,12466137232493543639,9241160553807130762,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,12466137232493543639,9241160553807130762,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7779047383778907865,6155517983635156490,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,2124365386329682520,1630714351465554511,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
      4⤵
      PID:112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,11459723331108980939,7111797109190072191,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,2726136221313174153,15134826862930804815,524288 --field-trial-handle=2372,i,12078716205924320059,701027524450139965,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
      4⤵
      PID:5708
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2cc441a4\f559945a.dll",Collect C:\Users\Admin\AppData\Local\Temp\2cc441a4\02b18975.job
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4fe90bd1f4df7d94092ff355bca123e18f33ef84ab6a614ba54178b39265b2b6
MD5 ce32ef490a0b7ceea432a0d3d1ab9dab
SHA1 207ebbd23d3c2f322d5f7f09b9ade53e78800a85
SHA512 eb7694e79ee9f4b37d51583c8558bacd49206b71cb8cf43460cb517f40c3f990643675755351de98e676963a5289e0c6828ceb82622ff64799c0f870a5c0300f
SSDEEP 192:5BRfMa7zv7QvAPRp2o9XxHsb+WNnNKP4rHukwtVyIsnAUgR:5BRfMOL86XjfwwPPbR
TLSH
T11F32842EBD14793B6DCAC22AFE627753D7F6102121E42E84E6FC9A2C11DB5CC522741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a3315ef41891f6623ecb304d88733b58cb269b2af1ff77b62a295607a6d5187d
MD5 0733756e99284d6be1503053b6d9f43f
SHA1 7c733e489f6bca8561574c487748e436c0472ef6
SHA512 37ed0d4607a86225df5b9a403c0c47233f37074ac0df9561f2e1a11f157e53b665cfb794c9f7efccb4794bbf40658428b77b5bd40f2bff1cafecc5ac3a6f7ca3
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN916jBTK8vS:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTC
TLSH
T1FC32D627A48D9E3F4FD8D519DC026F8B6DF5029272780D24A7FF5D0403A978E215A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 d835fcb4567de8819960016f47c91ede25fe40cf5e76eb92836ab4618509b29b
MD5 ba620a3041564981bce83fc123369bff
SHA1 cc79b37622c24fd393384cbab654856412a3e562
SHA512 bce5dd36d5a018e558677ef862211f8db47a80afac84ced53a95de5d6ccd6d02829f4ef46554f80426ce0eb496c9c52006af4629dc5d8d3f7c44be14dac11580
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oa1khVumSVn+a:1nbZeMrv/hGta1ksn+a
TLSH
T1EBD3984B3A747102EDE59A722CE0517F5E3C716D8F1595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f8219730a2ac1b9fad56f721ff56af17094134b8f2d841fe3a8f5750b9f3ee9f
MD5 565202a3e11c7eda49e2540919603430
SHA1 55e5162e8402ea68f770c8f7649dc0b138d53591
SHA512 207745185cd340f34c785a0275187c4f961b5f4ff424aa7b91187a5552f666401cb8f3805484ae1f1fadb8997eb151165f2ef4f34ecc1b0b5fb2c98762c05ef1
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5emDmB6nGyvn0b4T8lybJv4a:xC0ITo+TQ0InDUDV2PPb4T8lybl
TLSH
T10DA10835A0285CB74476D446B1626A43CEB9706BE972AFA0EAD90E0D24F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 27f76bac8b723c4edfcefb7436d9fcfb5c897a13f3a773af8eef70756c451be4
MD5 01b45c20b1e2cdae96e259016958d9c2
SHA1 1fd9079889c94710e73f78f9d8b472fdd4bdffba
SHA512 4424d4ea9b2a27b47becae6f904ad257bf55516c4915854f8471967ad7da4aa80aba85931e0ec762590c19676130cb4a1574642cafd36a6496a8d2f9baf81df9
SSDEEP 96:RC6pd+r2io+TJ/E0f6m934YMSMSl8h4otop5eicDmB6JGyvn0SvQxwzQihjm+9ld:RC2ITo+TQ0I2QiU2o2lPSIx+hjm+9lFP
TLSH
T19FC13931A46C6C7705B7E446F1222A5BCEB4206BD952BFB4EAD51F1D12EB0EC2382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5c4163bc0f69fd10a72862ba7dfb1110032fe95bb6dff38035cbeb4133ecfafc
MD5 f02ae217df133ac84a8ebb8ff5694675
SHA1 34489508e863176fbcb2a79c1071d23125589290
SHA512 5e2e884fb4c80dbdc0549366481bf1ea0d7cb29e72feb80899b4f2a95206220b05269053d6ab79aeee7fba64ba62c8ac086533b4a6a38184ba0546a78dff0499
SSDEEP 192:sxRDRLCe/fjsMyYGwGVzoA8pi/g6+WNIYoXCYuGmIgVMJ:sxRDQe/fjsuGp4i/5Iy/2
TLSH
T18232B7166A68A93B4CC7D21DFB69BF53D2F92033A0D46E58B6FC960C04EA6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7a0da44e19ed8b7caea279c088b235ac392930c2f1d64e08784673d631374095
MD5 29ce0c1a9714ccb5eb8b31a406a842c8
SHA1 75fc559e008f99918e96029c67bb61d4535eb580
SHA512 7e08f7f5e7ef707b33c7510d841e16449951962b1b343ba88417131c9cc4ee71b778c4381ea6e2735521104ba23c745e934aa64d88362d57c9f8d88e680650f8
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVhVuwero9We0Ur+:j26HWUE7MRWgs2f02u1jae4w1V+
TLSH
T138C2DA6B740CCABF4F800ADDDD197E9B6D6802CB9698CD8047FE951C02C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 98e42bbc1ade263af6e765d1e25d86743af1558e3951f2588d642e993db9d996
MD5 ae426bcf20bc01946f2549701cc4d9b2
SHA1 7713f8a7529590478ee37731a90b43ab17321dbc
SHA512 49eda2fea90d8476e2aff5de1612c30b585ddbf8808ea0dece2de9562a5435499a8b0ec8b5b5354ebef9a9ce6b2f9ffe2db8f004e7ab7e14cbbdf60cc7c5f20b
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrHlyLf1vz3W7gugn3K4Wg53cdF4L6jiKUk3:CCHuC0UE9MZSy6ngoJSaBgCrHlyLf1vs
TLSH
T177917150327E1744387E794D81749D1BD6C2B0B2380DB86BB7A852A61F67E024DFE8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 936d25fa9aa28761c3899af8b0907dc5f0b378143e32c466f8c1b5a81c02d515
MD5 08b8e4367e732d15fb1958c5f26cff98
SHA1 8730010f5b65e7210c97c0c88fe544333c87ccfd
SHA512 95bdd9255f892dbbc64a06788ab0fcffd2dd2a8385a6affb07fd5bad79d2f168fc67e4b8b2d94246b6440e7179eea019bcb103543b63ebe5c8909ac7c0f0dae1
SSDEEP 384:DNrRZyCSDnxTICgPMEhIKyll7svbFKfk7:xFZJSDnidEyI1l7svbF9
TLSH
T18B44740A7B747001EDE6D9721CB080771E3CB16E8F62A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa3831fc159c6fe260fefe0e7cdd847ec86e4be5a1888355caf68bf2d14aa1ec
MD5 682a197d97e1e8afc7e00b8c3ea62151
SHA1 010caaa70da7b51661e11fc65694bdf288d16ef2
SHA512 f765e3ed7024961fb13795a89771f72691eb40fbe108e14a2eea5420589c41cb826f3ce26844230e239c56f1ac89a65ed3fab5b44c1603415338b9d6d399792e
SSDEEP 768:MM3Y9/TBOWS3ztlONXyer1IRCzni96ojKgqmUav:MM3WuSIqn9fgRUu
TLSH
T153F2BF30A5A5AE738DF5EBC7B106A7876FF42027D1C05AA0EDEA6F4E054395D130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2aa33ca1af541fa30c4ea296febaeb6f08f9c04c40c13323e7031f313cff7d40
MD5 0ce4cd170d53ef9ac36f8f6f65afa6f1
SHA1 cf11d92d1c50d4d0d7762837b07994aa7ca93d56
SHA512 c9e4d2beffe77c62b2749985b26a6349b70bce9a78f07b8f4db981986aa62e71f3fa5648d71d548e687d089b0c05490925db7776b71b478a0030a8143a6beaa3
SSDEEP 768:hrv+4UNbdz3Iq/TBOWSYONXyer1IRCzniBYeVH1SK7:hbsbV35BSIqn3EH1l
TLSH
T1F203B032E4A89E338DE2A3C5B14776437FB86057D6800790EDDE2F4E069B59E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d391d0d-ffab-4223-bf54-5d0fcdc257c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6d391d0d-ffab-4223-bf54-5d0fcdc257c4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a1ee3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a1ee3.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

02b18975.job

Path C:\Users\Admin\AppData\Local\Temp\2cc441a4\02b18975.job
Size 3KB
SHA256 1e396334470dff38a898d6138a7dcd492110e1004d8f3c59f5f61e0c9f78e8ee
MD5 74e4dceff0e26916e2720859dfc9a1c8
SHA1 68196e0e60866b4d1d356af9ce2771a7744cb467
SHA512 a4a5783c668bcb058ff797ef6cca80a2a909d4b0470468789003cad261d7c6dc54466b81c3c8e021a6acc371c6ccc9d78f59e1bf32700fd39b5824e650bd5af8
TLSH
T107516D4772C5C69F2591F4B32761A58CD4F29D0EAB853B1AD704890D71CAA8EB2D63C3
MD5 SHA1 SHA512 TLSH

Submit Download

02b18975.job.ok

Path C:\Users\Admin\AppData\Local\Temp\2cc441a4\02b18975.job.ok
Size 1KB
SHA256 62cc6cf839af81a729d2e484ed417a09f438584260ad6b35b766ce0e0d886e83
MD5 5962a987d7b062c4a81ee7bf63b8ef3b
SHA1 4e6d74d4320d67f0bb0c7456a59326a03b441e30
SHA512 05e05ab0b724cbbd5e75991d64d4e27a3940cc457f8a3a376bd6f3f6b56f656d37a34b160dfe943754da5b3d80e2e5cfc850d29fa69903ef7ecf8aecb969a9d8
TLSH
T16A21E64672CBC63E0685F52329E2698CD4F51C0FAF863B24E211C94C1ADA5CFF692783
MD5 SHA1 SHA512 TLSH

Submit Download

f559945a.dll

Path C:\Users\Admin\AppData\Local\Temp\2cc441a4\f559945a.dll
Size 11KB
SHA256 e3d57d57e8c2b6e58ab15b62ae23dc4d8d7beb8755115df293f838bddda0b5e4
MD5 dfdb9f5ef5a5fb7b209a93d90dfeef30
SHA1 30b7c717f0ee62e2da4137ac3d54f7751f832e43
SHA512 835e63dc632f9a7d7be92df72a583a30c530777f130e3ab1a56382386891e016532019860355f1342e1256674fd52230cc826c8d82f70ec270a7c04fe064f5b1
SSDEEP 192:kshdspbhgYKgE8KgwN5oBlB82z9bCNUXQj+ThzBEsz4:kKdsJhdKcgkBH5z9wEpC
TLSH
T12D324A56BF1786E4E05680FCE022A723D7B5F31671A98A5F5912C85D1FCB6F370A4B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9aab67bd-0ff8-4b81-8649-41ba640b1293.tmp

Path C:\Users\Admin\AppData\Local\Temp\9aab67bd-0ff8-4b81-8649-41ba640b1293.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3536_1787377354\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5576-98-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-52-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-125-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-124-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-123-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-117-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-116-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-115-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-114-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-113-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-105-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-97-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-104-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-103-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-102-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-101-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-100-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-99-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-89-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-88-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-87-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-86-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-85-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-84-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-83-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-82-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-81-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-70-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-69-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-68-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-63-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-61-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-60-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-137-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-59-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-58-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-57-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-56-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-53-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-54-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-138-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-139-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-122-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-118-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-112-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-0-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-71-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-64-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-55-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-44-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-17-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-16-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-15-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-14-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-13-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-12-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-11-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-10-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-9-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-8-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-7-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-6-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-5-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-4-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-1-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/5576-2604-0x0000000410000000-0x000000041023B000-memory.dmp

Download