Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 22:20
General
- Target 2026-08-17_4ab54a57aac2f7ae49d3f7bdcf8ff415_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe
- Size 88.0MB
- Sample260817-19grhs1bnb
- SHA256 88453c959db7e2bde7609fd3d77ed668383a0679996c12fb5cbecf046b3b9687
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
- Detects Windows executables referencing non-Windows User-Agents 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of FindShellTrayWindow 37 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_4ab54a57aac2f7ae49d3f7bdcf8ff415_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4ab54a57aac2f7ae49d3f7bdcf8ff415_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe"2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\3d1a711e"3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\26ee8542"3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\817019ad"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" about:blank2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\817019ad /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\817019ad\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\tasSnc\817019ad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0xfc,0x134,0x108,0x138,0x7ffdcfabc728,0x7ffdcfabc734,0x7ffdcfabc7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2256 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2216 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --force-high-res-timeticks=disabled --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2284 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3116 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3164 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3656 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3676 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\817019ad" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2220,i,18098325886961892339,7578480236172060965,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4448 /prefetch:93⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" about:blank2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\26ee8542 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\26ee8542\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2cc,0x7ffdbd64c188,0x7ffdbd64c194,0x7ffdbd64c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2504 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2552 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2852 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3552 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4236 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4292 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4448 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4452 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4456 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4528 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1680 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4764 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4652 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\26ee8542" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2520,i,7943425782842071376,6019249505106584886,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5220 /prefetch:93⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\3d1a711e" about:blank2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\3d1a711e about:blank3⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdcfabc728,0x7ffdcfabc734,0x7ffdcfabc7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1340,i,10154069806342841554,12400670896965835978,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,9832992048015338890,11405218105010612231,262144 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,12531621383468925108,2018987986521828228,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,8925571334091154377,1278628248422649381,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,5700816926256735335,12592587807345882002,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,5967944785638310595,2006500534799536856,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,5252660123869702804,9272311833074200084,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5152,i,8371295990992247611,5681038557064197449,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5164,i,9784066256918631246,211987798817129896,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5248,i,2740900702311579753,8945930142240571714,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5156,i,17267847610653317535,16551094231866619782,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,2936545719455492681,9914438287223506359,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5908,i,5268909905385667402,9040295442786857892,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5324,i,5670735376308656602,17447053933947930679,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5524,i,3510184619641585004,7518484236981862423,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,11099253135544635413,12525457337378435816,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5724,i,3009292821011761172,17181375477562912686,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,1283261085416429352,10483284715991885012,524288 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3256,i,9455838255250740528,6296586808046849751,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5112,i,5833829717080678233,15362760936243265120,2097152 --field-trial-handle=2056,i,13333673950471266928,2460116645280415004,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:93⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ffdbd64c188,0x7ffdbd64c194,0x7ffdbd64c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,9268090963573969289,2578424432125641879,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2020,i,1016115628690857079,3282034254074544012,262144 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,11565340085646099417,7747984554903827154,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,9372988822871661463,6399548503082801133,2097152 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,6511345298411297150,5884412671360785461,2097152 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,12998713764997565198,2138152576344963742,2097152 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,575087160600395569,365804863544118694,2097152 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,3543927200848465385,11831096986591941154,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,15078348458870280152,13700311147032911864,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,1062992355183223342,4762013987010664694,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,3287500047004762903,9658632189357917393,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,3287500047004762903,9658632189357917393,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,16004292832347680081,8220889619672963986,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,346846980454823760,12494367830251026566,524288 --field-trial-handle=2540,i,16685821945311503502,5233212737186085959,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
messages.json
craw_background.js
Preferences
Secure Preferences
Local State
Local State
settings.dat
settings.dat
SiteList-Enterprise.json
Edge Profile.ico
Sdch Dictionaries
Preferences
Secure Preferences
Local State
Local State
Local State
7deaeac2-02b1-4d19-b40a-c7e3ea390899.tmp
0948beb3-72b9-49e6-90c0-f213ccb3c15c.tmp
messages.json
content_new.js
settings.dat
settings.dat
throttle_store.dat
ARBITR~1.JSO
data_0
data_1
index
data_0
data_2
data_3
MANIFEST-000001
SCT Auditing Pending Reports
CURRENT
index
data_1
Local State
Local State
Local State~RFe5a26e2.TMP
settings.dat
ACCOUN~1
AFFILI~1
THE-RE~1
compatibility.ini
memory/3236-780-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-832-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-394-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-396-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-397-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-388-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-389-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-387-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-773-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-779-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-784-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-0-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-785-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-786-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-787-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-778-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-777-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-789-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-791-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-793-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-796-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-794-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-804-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-803-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-802-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-801-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-795-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-384-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-382-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-381-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-826-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-829-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-828-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-395-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-840-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-839-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-838-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-837-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-831-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-841-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-848-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-847-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-853-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-846-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-845-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-380-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-315-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-21-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-20-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-19-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-18-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-17-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-16-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-15-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-14-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-13-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-12-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-11-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-10-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-9-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-7-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-8-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-6-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-5-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-4-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-1-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/3236-1354-0x00000001B0000000-0x00000001B0260000-memory.dmp