8d2498fc4ea88fd70ff6b6b085baf7d9fb7342192b06c80e2ade8ae6a8c0762c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
Size 4.8MB
Sample260604-jmcqlscs8p
SHA256 8d2498fc4ea88fd70ff6b6b085baf7d9fb7342192b06c80e2ade8ae6a8c0762c
MD5 59194944d68baff906b7d6023b9e6ed0
SHA1 c5ef96fbf36b127d265f09a0fba8f80454f13073
SHA512 ad2427f9f00947901a796668575adc1137fa5d37bed59f75c10d27b9e9255c25be42d0db76ca76db2b1f928a504707d21697d40698a879fba11ef200cf3821ae
SSDEEP 49152:LXY2TgUTOniRuK/LS5lE1SI9zEueZkYYYD1:LXtMUS+T/Lmy2Z
TLSH
T14F369D51F8DA58B1EA51223219B7E2EF3331B90A1F359FC7C6447B7AAC335A10D23265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3896 created 3292	3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe	54
PID 3896 created 3292	3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe	54

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1336	chrome.exe
1448	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
1240	chrome.exe
1240	chrome.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1240	3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe	80
PID 1240 wrote to memory of 436	1240	chrome.exe	81
PID 1240 wrote to memory of 5268	1240	chrome.exe	82
PID 1240 wrote to memory of 5268	1240	chrome.exe	82
PID 1240 wrote to memory of 1336	1240	chrome.exe	83
PID 1240 wrote to memory of 3188	1240	chrome.exe	84
PID 1240 wrote to memory of 3188	1240	chrome.exe	84
PID 1240 wrote to memory of 5668	1240	chrome.exe	85
PID 1240 wrote to memory of 5284	1240	chrome.exe	86
PID 1240 wrote to memory of 5668	1240	chrome.exe	85
PID 1240 wrote to memory of 5284	1240	chrome.exe	86
PID 1240 wrote to memory of 5512	1240	chrome.exe	88
PID 1240 wrote to memory of 5512	1240	chrome.exe	88
PID 1240 wrote to memory of 3672	1240	chrome.exe	90
PID 1240 wrote to memory of 3672	1240	chrome.exe	90
PID 3896 wrote to memory of 4972	3896	2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe	91
PID 4972 wrote to memory of 3264	4972	msedge.exe	92
PID 4972 wrote to memory of 1448	4972	msedge.exe	94
PID 4972 wrote to memory of 1280	4972	msedge.exe	95
PID 4972 wrote to memory of 1280	4972	msedge.exe	95
PID 4972 wrote to memory of 1280	4972	msedge.exe	95
PID 4972 wrote to memory of 5852	4972	msedge.exe	96
PID 4972 wrote to memory of 5852	4972	msedge.exe	96
PID 4972 wrote to memory of 5772	4972	msedge.exe	97
PID 4972 wrote to memory of 5772	4972	msedge.exe	97
PID 4972 wrote to memory of 1228	4972	msedge.exe	98
PID 4972 wrote to memory of 5772	4972	msedge.exe	97
PID 4972 wrote to memory of 1228	4972	msedge.exe	98
PID 4972 wrote to memory of 1228	4972	msedge.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3292
- C:\Users\Admin\AppData\Local\Temp\2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-04_59194944d68baff906b7d6023b9e6ed0_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a98fc728,0x7ff8a98fc734,0x7ff8a98fc740
    3⤵
    PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,3906249699201736429,11445911144073362853,262144 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:5268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,9371312495337048992,3186255524188228794,524288 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2248 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,2972215266638705748,11717147041126339331,524288 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2392 /prefetch:13
    3⤵
    PID:3188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,18110690789946016825,11357271989286611317,2097152 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,7110993058434757973,5055979647976789538,2097152 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,9192348016638606363,13065999925685423826,2097152 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4216 /prefetch:9
    3⤵
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,1580149149520025094,2996496787628276654,2097152 --field-trial-handle=1964,i,7008899495993265147,18136084589153193559,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff897dec188,0x7ff897dec194,0x7ff897dec1a0
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11849842914883474295,3541620163989078438,524288 --field-trial-handle=2260,i,10901450004267377029,16886707460599776723,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,17192515859507981114,13811897965370236253,262144 --field-trial-handle=2260,i,10901450004267377029,16886707460599776723,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,10185435897626727193,12834887500773292123,524288 --field-trial-handle=2260,i,10901450004267377029,16886707460599776723,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5070925772984071038,2872445709398737959,2097152 --field-trial-handle=2260,i,10901450004267377029,16886707460599776723,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14460993716326568020,7485236608711107437,2097152 --field-trial-handle=2260,i,10901450004267377029,16886707460599776723,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:1228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 56eefcb2f92b52c0e9a584ce82d4a5ad52ca2623745ad3e102e9058022fc2adb
MD5 9e8c49a342a0c9d3fc5d545c444ef796
SHA1 d2742ddca9da54ca91c6717260bcfffa77d15f8e
SHA512 8395c263fa402d3ca511ad7daccb7921e9d38d8aba4822d1f67fdf3c375c43801adf9d890c07c021d8efd0cca319cf60508e6c6d57c020552d4518faffb7ae7a
SSDEEP 1536:nqueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:lDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T126B30212CEAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4023DDE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9a03f82b290684dff715d9ae64dcb348728433e7e15980bb62c16c680a0f3f71
MD5 90726e8babd322bce9e575bcbaec69f3
SHA1 a1d8daf1c7043032856c073a9b55e0a06280a2ca
SHA512 faf5a8289c011075db16b639adcc41c3acdef3b22cab8a3862ff8bc50b965a76bd77c8c6aecd1175381e1c9d48d586173891286f6056f74225b6878655947c35
SSDEEP 384:n6iF9CcmyWCs38Na8TUNTUlIxBPm3ek32nn9B8QWs4Jfb8GmrEcgwLFF9e4KV8p5:xFccps31wgPKekm0JwGkEc/T9I8p0C
TLSH
T116B24B36EC58CABBECEB4F99F74A6A03DEE01267859C59E4DAD85D0C00971DD130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 af6c574ace8b367e494d50d275221a901acfb3982620a770d0ff9e33471bcf38
MD5 4519f6b16675fe97dacea0cfec7d05f7
SHA1 9c7014d6a8a4a302573f17128cb8651c099d000c
SHA512 c0c51a35369878036dcd496d2ffd4d94dae07fc9eec3144c994980cd00ef823badc67444d603fc773e53f1668f2f8812744598e4a9d8bd942225dd8c870eed2b
SSDEEP 384:n6iF9CcmyWCs38NH8TUNTUlIxBPm3ek32nn9Z2p4Jfb8GmrEcgwLFF4oMe4KV8p5:xFccps3kwgPKekmiDGkEc/pMI8p0C
TLSH
T113C25B32EC58DABBEDE64FDAB74B6A07DED05267858C59E8DAC81D0C00971CD130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3896-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3896-1-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3896-2-0x0000000000400000-0x00000000004C9000-memory.dmp

Download