stormkitty | f7750ae896f6ad8ebf4e4ce19e7f7b304c74f909a1aa8e558ecfb9682de2059f

Analysis

max time kernel
101s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2025, 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe
Size

21.4MB
MD5

fddeee6a843d81889f8bb627fedc83be
SHA1

a712cde6fafbbff41d2c80aab63871950013158a
SHA256

f7750ae896f6ad8ebf4e4ce19e7f7b304c74f909a1aa8e558ecfb9682de2059f
SHA512

908187b5137448f4a1fd67575fb5516d25beeaccc0550230a07ce470c6bb1c479f7e38a9f32d08da0d693b4a2a19b3aef5f7678fb84e270eca6595640aabd7c9
SSDEEP

393216:9NVKoYRwcInv/8CnSjJy1hMwFjC5KXsIsL1agh05ZSnI1hg:9NV3YRno0CgKsIsxagh0nE

Score

10^/10

stormkitty collection credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3400-2-0x0000000000810000-0x0000000001010000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2976 created 3292	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	51

Uses browser remote debugging 2 TTPs 12 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1052	msedge.exe
3572	msedge.exe
240	msedge.exe
232	msedge.exe
232	chrome.exe
1268	msedge.exe
2764	msedge.exe
1144	chrome.exe
1680	chrome.exe
3164	chrome.exe
4328	chrome.exe
2700	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
2	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2976 set thread context of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4776	cmd.exe
2304	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe
2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
3400	RegAsm.exe
232	chrome.exe
232	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	RegAsm.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
232	chrome.exe
232	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 2976 wrote to memory of 3400	2976	2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe	79
PID 3400 wrote to memory of 2700	3400	RegAsm.exe	80
PID 3400 wrote to memory of 2700	3400	RegAsm.exe	80
PID 2700 wrote to memory of 4020	2700	msedge.exe	81
PID 2700 wrote to memory of 4020	2700	msedge.exe	81
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 2252	2700	msedge.exe	83
PID 2700 wrote to memory of 2252	2700	msedge.exe	83
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82
PID 2700 wrote to memory of 4852	2700	msedge.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3292
- C:\Users\Admin\AppData\Local\Temp\2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-04-19_fddeee6a843d81889f8bb627fedc83be_elex_frostygoop_ghostlocker_sliver.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ffc4cf7f208,0x7ffc4cf7f214,0x7ffc4cf7f220
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1952,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2060,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2632,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3564,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4176,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4332,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4192,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4324,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3684,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5392,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5428,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5364,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6068,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:4188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6244,i,2331542175077263821,12319068048123267964,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4776
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2304
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1612
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4c9cdcf8,0x7ffc4c9cdd04,0x7ffc4c9cdd10
      4⤵
      PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2000 /prefetch:2
      4⤵
      PID:3736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2124,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2224 /prefetch:11
      4⤵
      PID:1188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2424,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3196 /prefetch:13
      4⤵
      PID:2532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3068,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4244,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4288 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4796,i,3404877310871022915,10745918616309402138,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4332

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
4f55251c690a4ad4e87031a7d14725da

SHA1
c6b77468c69b6527a1525ea9e3af81aad598d344

SHA256
84c906267501ac30862e9a6fbeeb30eaa67983ccf35d2edf668168cfbe9df56f

SHA512
759e833de0c65c61ef6001a12cf6556643c7748567b5eb3d1ea6abd498ac69a42d49ef84db73c7e18a57eb8df8e61621fa68676e1e774438309c8234174c8bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a53b3cbb0cc185974876c4556f351bdf

SHA1
b5a4ca66aeb47754d96066cfa8eda882deda5216

SHA256
214faeabf977636099613878cce8a01ab4012b0cd27cf85f21c85575d2a8374d

SHA512
c3efc6c6b49912a6fd5f0d83607a08973df087d9bb31c2166c1cc925deae032ca9b5db50a2f2a5df0527e6d9e2807fb17daa59830bf8e34a210765811d3c9780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
2502fffc9101ec3d37edf5e3e15abccc

SHA1
f7d4cf6d5f266ec40a33798223d074a678c1315f

SHA256
d9d740ef72fcadcb0ffbec9765b88bb1667a58d9e884b47806dbe788f86fdd7b

SHA512
d3bf08ef52051fb15f68efaacdd3e73898c1cef2ebc315bd8a83867de80307a756e78284daff8b0c9025bd59664ac0e87e09822609821d33c3f041e793884df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
28KB

MD5
fe39868d99fc1e0a9f76602d01702601

SHA1
17892f8505d5fff25903ad7e221cb9c588e9d9a9

SHA256
2cda018fa469f49f95c098a9c157ec69b828606c23853f4f6b8284c57bb8dcee

SHA512
8fecf5b274a5def87f0dd26a0d5ccc7fb9707cc28bcb95d88bc4ad09f36dd54ba89c5a4f9fc4d36d7648078d6d7d74eb9b66adebbb6360fa62d73b4f10177273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4af9721e-9956-4269-a2e0-f60fad8d4d43\index-dir\the-real-index

Filesize
1KB

MD5
ec7c252d960379f3356be43306ae5c8c

SHA1
570cbf1c14c570f4312e793c37c8539061016d10

SHA256
1b3889484af7fff193eb2c26cb4041d777fc5010b853a1377122df7bfd3e2a46

SHA512
4042067b96f11f2328e4a88533b778e0d14359475e2186eb31dacc47e2172cd3fba6892b6ce777ae8bdebfe9e79434d7392bf0c4b72cce6de15e111b09a972ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4af9721e-9956-4269-a2e0-f60fad8d4d43\index-dir\the-real-index~RFe6231a9.TMP

Filesize
1KB

MD5
a9c41d697604dc78edbef7300209ead7

SHA1
7765fe4f84b741dca6e734613b420bd53d51e15c

SHA256
c183f9a93b281e472a96b5d60aa8e185b868dd4c60082acc55c33159113292bd

SHA512
57325984cb2545f2ac087a5468ff69de2172a885191f93bfd07fde6215eba15edb312429c7fa40b3c9efde2b25e29282138441deac02404f0d6f9a506b4ddc25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
f0f3d69f34e5b052ccc12f29e0ee132e

SHA1
5805bff23e67fef551dd521bbf76bdb6dfc1ad44

SHA256
87fce8f0aaf45fea13bdb301c03d671d96f932e28c1792bae990ef092f76bb54

SHA512
a0e31f6e1f2b9ca630db61b35712ac41bba87d43e9a7274485dc63cf0bb6d659dd3bbb1b9c11100899af8301642067889ad58e240109b0ad528992659047d669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
77adec85fd66e64fcd25e93fc68775ac

SHA1
d726bcf43872c9f1d8b6b9a0f1b773fae1326ac5

SHA256
9f8e78d9a6abb33b73320f84a4f2e15309c3711301d471dc655577d61ab03f94

SHA512
6f1a96e12fd391b7589c42c92f233dba1b20b2c2bdfdf13621df686b1e1b90bb65cb066d2b845eb9b436d6541fd27d571b318d8185ce39a7828569a61db61c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43.zip

Filesize
422KB

MD5
337f816ae3effa9a0c58b6848a4411c6

SHA1
569e4375ec6841e6d6d19f3fdde9e33833c3c493

SHA256
84e1211ac9867649479089874a2f36eeeb8ba3ccc58fb6443181fe7dd6a21c8b

SHA512
0c8a019e308c6cdec01d736940787f4d0d395e362a7894100808ff9c14f7e7c3915e9577b32a7e1572737f18c0fe3a4042b3a0134f805547a8f994334c4968bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
81B

MD5
ea511fc534efd031f852fcf490b76104

SHA1
573e5fa397bc953df5422abbeb1a52bf94f7cf00

SHA256
e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

SHA512
f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\System\Process.txt

Filesize
4KB

MD5
17b18ce873bccd9632983d0a44558f41

SHA1
e0df3c6dd4a15105a94d468b9dcfa132c4d4fb48

SHA256
384bd946c3f5a0713eb97b4bb540754b6a39ab44fb36fa7cd66474ecb1a21481

SHA512
55e763eb76006bfe569893243eabb59551bcdf12751b775a676edb134339d414575c506700b6c4e00822fe6c74a75e4e1f9dd768f4dea702d082ff968a868b29

Download Submit
memory/3400-368-0x0000000007030000-0x0000000007052000-memory.dmp

Filesize
136KB

Download
memory/3400-588-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/3400-372-0x0000000007060000-0x00000000073B7000-memory.dmp

Filesize
3.3MB

Download
memory/3400-410-0x0000000007E10000-0x0000000007EA2000-memory.dmp

Filesize
584KB

Download
memory/3400-409-0x00000000078C0000-0x0000000007926000-memory.dmp

Filesize
408KB

Download
memory/3400-6-0x0000000006750000-0x0000000006C7C000-memory.dmp

Filesize
5.2MB

Download
memory/3400-533-0x0000000008560000-0x0000000008B06000-memory.dmp

Filesize
5.6MB

Download
memory/3400-572-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Filesize
4KB

Download
memory/3400-5-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/3400-0-0x0000000000810000-0x0000000001010000-memory.dmp

Filesize
8.0MB

Download
memory/3400-4-0x0000000005900000-0x0000000005AC2000-memory.dmp

Filesize
1.8MB

Download
memory/3400-606-0x00000000077A0000-0x00000000077C0000-memory.dmp

Filesize
128KB

Download
memory/3400-607-0x0000000007980000-0x00000000079CC000-memory.dmp

Filesize
304KB

Download
memory/3400-3-0x00000000056E0000-0x00000000056F2000-memory.dmp

Filesize
72KB

Download
memory/3400-2-0x0000000000810000-0x0000000001010000-memory.dmp

Filesize
8.0MB

Download
memory/3400-1-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Filesize
4KB

Download
memory/3400-664-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download