Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 04:41
General
- Target 2026-08-18_fae372beb324d31e9a6edc8f8468ce46_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 89.0MB
- Sample260818-fa6ldaw1cs
- SHA256 8acb1c2bb6786c44f9d57841aa61a6aa4d58dbcb66304b8f0180784af3f6f453
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
- Detects Windows executables referencing non-Windows User-Agents 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs
- Suspicious use of AdjustPrivilegeToken 33 IoCs
- Suspicious use of FindShellTrayWindow 37 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_fae372beb324d31e9a6edc8f8468ce46_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_fae372beb324d31e9a6edc8f8468ce46_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\f8e387d5"3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\779123de"3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\a043cb00"3⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\f8e387d5" about:blank2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\f8e387d5 about:blank3⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" about:blank2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\779123de /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\779123de\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\tasSnc\779123de --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffb7f1ac728,0x7ffb7f1ac734,0x7ffb7f1ac7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1792 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1908 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2544 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3236 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3256 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3760 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3704 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\779123de" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1796,i,4690782370177543630,7150089819020647953,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4560 /prefetch:93⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" about:blank2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\a043cb00 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\a043cb00\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2d4,0x7ffb7d61c188,0x7ffb7d61c194,0x7ffb7d61c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2720 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2696 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2768 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3568 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4220 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4180 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4568 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4484 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4276 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4600 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4648 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4720 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4776 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\a043cb00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2684,i,11266430556465115195,9313870123981036086,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4828 /prefetch:93⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb7f1ac728,0x7ffb7f1ac734,0x7ffb7f1ac7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1320,i,16579857045776896983,15239040591471337346,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1740,i,501652210592625808,11913652449918157227,262144 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,5162678052266324587,1488627636742186896,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,9001966207464227555,728876887801536061,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,9943875772784325834,7457879744474717857,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,16045198066639917881,5701818936919163660,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,8757476079593372737,12200161908408275187,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5156,i,17559933203734205388,1119017593261386403,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5200,i,18395969495918656291,3387657874664364887,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5232,i,11390373476403253654,13326525037157442784,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5252,i,11397019490458124985,18148520417240701128,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,4929368815639705501,12060469135052194022,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5156,i,6706986847857110002,7022242512041607386,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5212,i,15189413321428884258,12519360367102912709,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5908,i,3916700980374134287,3795352237898979381,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5276,i,15685812497928984121,5589366729697346561,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,10886221436946693830,17891420325944220561,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,17638244582334246827,6625697966527270276,524288 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3252,i,6896545193922710483,2653259894318593004,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5568,i,17523121949791163619,17973162193451165389,2097152 --field-trial-handle=2032,i,5209457437067027938,12983289897780152859,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:13⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb7d61c188,0x7ffb7d61c194,0x7ffb7d61c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2012,i,8458381114147659490,13895637963060007817,262144 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,13218353873599388514,9930219099772915078,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,5733745950308189442,5573912591676898732,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,3647695357871696078,742298232980089030,2097152 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,15539221459133107305,3854405468062420207,2097152 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,16507590311336795272,518254709722669740,2097152 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,17105407420614636287,8674482326710873283,2097152 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,13887877631182860498,15612541120518334372,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,12255610094997235402,11772413582946995622,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,6659897191459551227,7480740399112945388,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14810743041129082610,13518569020589982698,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14810743041129082610,13518569020589982698,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,311361430849447011,10510534328013674998,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,15763808759241479441,13571359539846441706,524288 --field-trial-handle=2516,i,17639014190774991814,8068293262517277120,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
messages.json
craw_background.js
91929c7f-63da-443a-b60e-550c2574b98c.tmp
Preferences
Secure Preferences
Local State
Local State
settings.dat
settings.dat
SiteList-Enterprise.json
Edge Profile.ico
Sdch Dictionaries
Preferences
Secure Preferences
Local State
Local State
Local State
metadata.json
f39de9ab-6bc2-41bd-9986-f90bd8dfeb73.tmp
messages.json
content_new.js
settings.dat
ACCOUN~1
AFFILI~1
THE-RE~1
data_1
index
MANIFEST-000001
4b49983f-6fcb-4ee5-aed6-91d495ef538c.tmp
settings.dat
settings.dat
throttle_store.dat
ARBITR~1.JSO
THE-RE~1
THE-RE~1
data_0
data_2
data_3
CURRENT
Local State
Local State~RFe59bd1c.TMP
compatibility.ini
memory/4532-712-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-769-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-324-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-321-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-316-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-315-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-313-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-705-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-704-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-710-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-709-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-0-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-708-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-715-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-716-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-718-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-309-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-308-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-307-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-739-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-745-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-746-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-747-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-744-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-751-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-755-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-754-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-752-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-740-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-756-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-757-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-761-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-762-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-323-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-768-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-771-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-763-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-770-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-772-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-778-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-777-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-779-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-785-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-786-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-787-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-788-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-287-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-20-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-21-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-19-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-18-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-17-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-16-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-15-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-14-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-13-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-12-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-10-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-9-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-11-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-8-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-7-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-6-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-5-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-4-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-1-0x00000001B0000000-0x00000001B0260000-memory.dmp
memory/4532-1282-0x00000001B0000000-0x00000001B0260000-memory.dmp