f719911e6a01aba649dcbd6f4767f492670df3accb6a6ba9c12af46e046481c5

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_db2cf788573fa35c2102693e2ccc28cd_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Size 4.8MB
Sample260606-dtldfaay2n
SHA256 f719911e6a01aba649dcbd6f4767f492670df3accb6a6ba9c12af46e046481c5
MD5 db2cf788573fa35c2102693e2ccc28cd
SHA1 b82c26111d270c2c49b3fa0f41c529381e248475
SHA512 e56a924ea2cc8e172140df877e1b296131762f7065cf313278c4a51a0b9da219e02082185778a6f264741050e4fcd37e4bbe2f30da8b5f37046314bc85b55213
SSDEEP 49152:+KQ8RdPqezdeNlSyEVvgCvrHiEDsWkemu0kx4QjGnu:+4jxvgCvrHVDsWkemuBx4Qiu
TLSH
T1BB367D0B6CE408EAC5AAA33289B35292BB35BC490F3263C72E51B7782F727D55D35714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4576 created 3384	4576	AutoIt3.exe	54
PID 4576 created 3384	4576	AutoIt3.exe	54

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3528	2026-06-06_db2cf788573fa35c2102693e2ccc28cd_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Executes dropped EXE 2 IoCs

pid	Process
5804	D6x3tvJXvRYesbJd6yOUSgp4.exe
4576	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	D6x3tvJXvRYesbJd6yOUSgp4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.myip.com
3	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4576	AutoIt3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	chrome.exe
5496	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
1560	chrome.exe
1560	chrome.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4576	AutoIt3.exe
4576	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
1560	chrome.exe
3280	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4576	AutoIt3.exe
4576	AutoIt3.exe
4576	AutoIt3.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 5804	3528	2026-06-06_db2cf788573fa35c2102693e2ccc28cd_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	79
PID 5804 wrote to memory of 4576	5804	D6x3tvJXvRYesbJd6yOUSgp4.exe	80
PID 4576 wrote to memory of 1560	4576	AutoIt3.exe	82
PID 1560 wrote to memory of 3260	1560	chrome.exe	83
PID 1560 wrote to memory of 1804	1560	chrome.exe	84
PID 1560 wrote to memory of 3936	1560	chrome.exe	85
PID 1560 wrote to memory of 3936	1560	chrome.exe	85
PID 1560 wrote to memory of 5600	1560	chrome.exe	87
PID 1560 wrote to memory of 5600	1560	chrome.exe	87
PID 1560 wrote to memory of 2608	1560	chrome.exe	88
PID 1560 wrote to memory of 5876	1560	chrome.exe	89
PID 1560 wrote to memory of 2608	1560	chrome.exe	88
PID 1560 wrote to memory of 5876	1560	chrome.exe	89
PID 1560 wrote to memory of 4884	1560	chrome.exe	90
PID 1560 wrote to memory of 4884	1560	chrome.exe	90
PID 1560 wrote to memory of 5908	1560	chrome.exe	92
PID 1560 wrote to memory of 5908	1560	chrome.exe	92
PID 4576 wrote to memory of 3280	4576	AutoIt3.exe	93
PID 3280 wrote to memory of 4632	3280	msedge.exe	94
PID 3280 wrote to memory of 5496	3280	msedge.exe	95
PID 3280 wrote to memory of 4192	3280	msedge.exe	96
PID 3280 wrote to memory of 4192	3280	msedge.exe	96
PID 3280 wrote to memory of 4192	3280	msedge.exe	96
PID 3280 wrote to memory of 3584	3280	msedge.exe	97
PID 3280 wrote to memory of 3584	3280	msedge.exe	97
PID 3280 wrote to memory of 6060	3280	msedge.exe	99
PID 3280 wrote to memory of 6072	3280	msedge.exe	100
PID 3280 wrote to memory of 6060	3280	msedge.exe	99
PID 3280 wrote to memory of 6060	3280	msedge.exe	99
PID 3280 wrote to memory of 6072	3280	msedge.exe	100
PID 3280 wrote to memory of 6072	3280	msedge.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\2026-06-06_db2cf788573fa35c2102693e2ccc28cd_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-06_db2cf788573fa35c2102693e2ccc28cd_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\Documents\Screenshot album\D6x3tvJXvRYesbJd6yOUSgp4.exe
    "C:\Users\Admin\Documents\Screenshot album\D6x3tvJXvRYesbJd6yOUSgp4.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Reload.a3x
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe296bc728,0x7ffe296bc734,0x7ffe296bc740
    3⤵
    PID:3260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,11583228691621983087,2315176077125888618,524288 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2028 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,16344110446529250983,3999804448497932756,262144 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:3936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1168810008942014146,6363255422419010069,524288 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2528 /prefetch:13
    3⤵
    PID:5600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,10545986398477405862,18054034672453877470,2097152 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,9086454699035858874,6996899013747580371,2097152 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,11485653271097672759,13903111804248198759,2097152 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2396 /prefetch:9
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4384,i,16801871593700372620,9771909829164144546,2097152 --field-trial-handle=2000,i,15481971895842430607,14275848891649221590,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffe04f3c188,0x7ffe04f3c194,0x7ffe04f3c1a0
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,4264893253660155474,6182251974734775139,524288 --field-trial-handle=2236,i,276404472210397230,2883725275764124006,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,14129948872838111625,7419476920822494112,262144 --field-trial-handle=2236,i,276404472210397230,2883725275764124006,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,2942582306251618637,12717967075264308251,524288 --field-trial-handle=2236,i,276404472210397230,2883725275764124006,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,13647851818823643516,15339218019303146965,2097152 --field-trial-handle=2236,i,276404472210397230,2883725275764124006,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11094320653780692042,2380116614374844730,2097152 --field-trial-handle=2236,i,276404472210397230,2883725275764124006,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:6072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d8618e6902775d16d396380413408facddb816da2b76b91e9dfb19d659d63bcd
MD5 c9c94b81cdf553be1c5e55c029b062d7
SHA1 28a40679136fa7f2ef7b00ae00f59619050b4142
SHA512 f0e376ad48b152fcbf3a13c6f2a6de1edba783b17bcbe4a3857074bc2f16ecbff2a8c1fffb489bd19dc7845723dec26495fe709ba208cc3b29f88b88726c13b9
SSDEEP 1536:nmueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:JDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1CFB30212CAAACE9BE4A45C79E4C413F3BEBE5F9523F1BA424166E4023DCE7042391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2541bdf3e019d2f25417a64bfdbcf2a39d3c2796aa3cae90322cf0220686bf33
MD5 dd786cd0ed841beaef0a52187cdd7bb9
SHA1 362a9d3568ef2a925f5e51fdde6e624599cb17ba
SHA512 286c558b775c3d297a19751d56afd0aa4377083be31190c8e289b3376a38ea9f2157a428cd2183004b301594a6fb49f55719aa5d4cca9a8be1e24d2ebb981aa1
SSDEEP 384:niiF9CcmyWCs38Nvb8TUNTUlIxBPm3ek32nn9BQQbsSuf+8GaTjKzx6ze4KV8p0J:pFccps3GbwgPKekmooYGMzI8p0J
TLSH
T135B26B31ECA4C9BBECE64F99FB0A7A07DEE01263859C5DD8DAD81D1D009719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3e00ad0580537411090f04391ed840b59285fb3f85f6ed8927dbc33b3956b0ec
MD5 d83e12ffcf8c3b16bc48d8d1144666b5
SHA1 261519eac5e517ff27685f4f072f728beec4ed38
SHA512 6e1d6ebdab90daa8e917409f44a9e461de5c0d71545c60bdf236e6fa1e4d876e890c819aa59602043b9ab224ee9f15c155c3cb1c1464b3615144dd2441a0c12c
SSDEEP 384:niiF9CcmyWCs38N/8TUNTUlIxBPm3ek32nn9iwmSuf+8GaTjKzxwIePe4KV8p0hX:pFccps3YwgPKekmbCGEPI8p0J
TLSH
T11EC25B31E8A4C9BBEDE28FE9FB4A7607DEE01263859C5DD4EAD81D1C009719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reload.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Reload.a3x
Size 1.2MB
SHA256 6cc8223987f1fc38c128a0a27b2e9dfb5d53a9937839b34221b3e3adf20d51d8
MD5 092c617c4d3ebabec17af1b3c81c48dd
SHA1 ae145d30ada80acfe3847b2657ff5a77a4ca69a4
SHA512 7bd3c9d2c2bbf7be3456b4f5fc1886cc9ca2860a0feb1760e0718137abc2908f8136a8bacea0846dbe709467f1c7371b8250d38d7d4bd6f413c8ac421a847297
SSDEEP 24576:oF8caBJtxFIc5xkQOfs0Q8VwZVAfBYBTG077ZPkFHpPuzRDMVUHZbYBcQY:oFyJqcFTDfPAfSTGvpPwRwVxY
TLSH
T13345339B940E62F3626BB776B3C1986B21BB711700ADFEE43074DFDDA620C176111C6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D6x3tvJXvRYesbJd6yOUSgp4.exe

Path C:\Users\Admin\Documents\Screenshot album\D6x3tvJXvRYesbJd6yOUSgp4.exe
Size 2.2MB
SHA256 04fae87ad99118b414439853eb0950d62a0b37bb7ef62c9bfe40fbe70c5dc00e
MD5 b8aa3afaa82d3475f95bd5e6408f5ba2
SHA1 09cb3b39bd1bc0b2e224d18728594cfae3d0c3b0
SHA512 a14cc32c19c2f8d5805cef16a91f10438c21b5649ddee3f7709441da6102ab322d19ba129b130a73f2840f37445b96664991ea229a1e4c2d68e036c74dfbbba6
SSDEEP 49152:YjQX6kX6tF+TYcJIyfK5f3uGJp2WX9evPSJlPUOYwUaEd:FqkqiccJXef3ump9XAvPSPUp
TLSH
T18EB5020B3AC91662D42FA37170B2033F2333F93816665AAB6197F6D8DE637D33512649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3528-20-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3528-0-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4576-19-0x0000000077754000-0x0000000077755000-memory.dmp

Download

memory/4576-28-0x0000000005CA0000-0x0000000005D6C000-memory.dmp

Download

memory/4576-22-0x0000000005CA0000-0x0000000005D6C000-memory.dmp

Download

memory/4576-21-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/4576-18-0x0000000077752000-0x0000000077753000-memory.dmp

Download

memory/4576-108-0x0000000005CA0000-0x0000000005D6C000-memory.dmp

Download