94cf86f6aab01670ea57aa08b8c531d8dbdda8cbcebbe684b08c64b5738cc819

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Size 2.4MB
Sample260529-vftakaas21
SHA256 94cf86f6aab01670ea57aa08b8c531d8dbdda8cbcebbe684b08c64b5738cc819
MD5 81cfda6949376e4b176ee91e93396aaa
SHA1 70092b5f544ffba057e161416e7afe47593ba76f
SHA512 6bdedfa11dd937878e225adb00d106463f9bec95d4bdb6f844a5d446685850654050bf49f82a3518b089abf358094d442e1c6756402c026f71eda4a7e0fde48e
SSDEEP 49152:qytirCHqNwhhu8kJShVk8deaWBIsh7jBBQSgkIvX0z:qnVW/u87hs1/PL8vi
TLSH
T1D4C59D5A7CD049F6D4AA633389B76292BB71BC440F7223C72E9072382F766E45C79748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 5772 created 5068	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 5772 created 5068	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 5772 created 5068	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 5772 created 3296	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 5772 created 3296	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 5772 created 3296	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 61 IoCs

resource	yara_rule
behavioral2/memory/5772-6-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-7-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-8-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-9-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-10-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-11-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-12-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-13-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-14-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-15-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-16-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-18-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-17-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-64-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-49-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-231-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-252-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-360-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-359-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-363-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-364-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-365-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-366-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-367-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-400-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-399-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-401-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-412-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-424-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-427-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-425-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-421-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-436-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-435-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-434-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-437-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-433-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-438-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-431-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-430-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-420-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-419-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-418-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-416-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-415-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-413-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-392-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-380-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-368-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-439-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-440-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-441-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-442-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-443-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-445-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-444-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-446-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-447-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-448-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-449-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5772-450-0x0000000750000000-0x0000000750133000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
220	msedge.exe
2584	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5068	chrome.exe
5068	chrome.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 5068	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 5068 wrote to memory of 4364	5068	chrome.exe	81
PID 5068 wrote to memory of 744	5068	chrome.exe	82
PID 5068 wrote to memory of 744	5068	chrome.exe	82
PID 5068 wrote to memory of 2584	5068	chrome.exe	83
PID 5068 wrote to memory of 4436	5068	chrome.exe	85
PID 5068 wrote to memory of 4436	5068	chrome.exe	85
PID 5068 wrote to memory of 652	5068	chrome.exe	86
PID 5068 wrote to memory of 5200	5068	chrome.exe	87
PID 5068 wrote to memory of 652	5068	chrome.exe	86
PID 5068 wrote to memory of 5200	5068	chrome.exe	87
PID 5068 wrote to memory of 6016	5068	chrome.exe	89
PID 5068 wrote to memory of 6016	5068	chrome.exe	89
PID 5772 wrote to memory of 3296	5772	2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	90
PID 3296 wrote to memory of 5488	3296	msedge.exe	91
PID 3296 wrote to memory of 220	3296	msedge.exe	92
PID 3296 wrote to memory of 244	3296	msedge.exe	93
PID 3296 wrote to memory of 244	3296	msedge.exe	93
PID 3296 wrote to memory of 244	3296	msedge.exe	93
PID 3296 wrote to memory of 4996	3296	msedge.exe	94
PID 3296 wrote to memory of 4996	3296	msedge.exe	94
PID 3296 wrote to memory of 4712	3296	msedge.exe	96
PID 3296 wrote to memory of 4712	3296	msedge.exe	96
PID 3296 wrote to memory of 4712	3296	msedge.exe	96
PID 3296 wrote to memory of 2080	3296	msedge.exe	97
PID 3296 wrote to memory of 2080	3296	msedge.exe	97
PID 3296 wrote to memory of 2080	3296	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_81cfda6949376e4b176ee91e93396aaa_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc17f5c728,0x7ffc17f5c734,0x7ffc17f5c740
    3⤵
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,8641791476207311261,14923207635106241354,262144 --field-trial-handle=1948,i,17982870840125954897,9464133391643877904,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1936 /prefetch:2
    3⤵
    PID:744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,4820205409843837197,6056807351998174961,524288 --field-trial-handle=1948,i,17982870840125954897,9464133391643877904,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2160 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,14956280051937346222,9432650400104166799,524288 --field-trial-handle=1948,i,17982870840125954897,9464133391643877904,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2304 /prefetch:13
    3⤵
    PID:4436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,9192058036205703780,18083824415512382785,2097152 --field-trial-handle=1948,i,17982870840125954897,9464133391643877904,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,12616368848060600724,17194230759571988870,2097152 --field-trial-handle=1948,i,17982870840125954897,9464133391643877904,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:5200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,14769627324175254855,5115907660064538104,2097152 --field-trial-handle=1948,i,17982870840125954897,9464133391643877904,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4224 /prefetch:9
    3⤵
    PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffbf30ec188,0x7ffbf30ec194,0x7ffbf30ec1a0
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,8018165713510329532,13176346106080777104,524288 --field-trial-handle=2088,i,9901378311481765586,11063523342603042470,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
    3⤵
    - System Time Discovery
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1556,i,16546389907971848280,14146659079997963739,262144 --field-trial-handle=2088,i,9901378311481765586,11063523342603042470,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,14331254831259959274,17914147794251842933,524288 --field-trial-handle=2088,i,9901378311481765586,11063523342603042470,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,4208076420898299023,1074755762510256595,2097152 --field-trial-handle=2088,i,9901378311481765586,11063523342603042470,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,17566790600336688735,8555578589052220904,2097152 --field-trial-handle=2088,i,9901378311481765586,11063523342603042470,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:2080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9f7d1545b248abfc8b153cc91bf4db0f4a23f971b79247d052fcd00d35d78c41
MD5 0f4fbf666935a92791dcaf6d640194c4
SHA1 c53276bd85b9ccf396860995a5db39487d34c6e2
SHA512 1cab4b67a1535487edd56d0adabbe39e01b6a2cbb7749d8a9218d3094f5d2b7c2caba566419328d0060ef0feac7cff4ed1320a8c4282673732ca117b1fefdcf1
SSDEEP 1536:nsueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:fDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T17CB30212CAAACE9BE4A45C79E4C413F3BEBE5F9523F1B9424166E4423DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5cec7430195556100874ac70104561dcf248d7cfeaca80ba6cdb6350dffd52dd
MD5 9572d4ec4c7cfce6ad6c80de3894f83c
SHA1 1613d88096cf7794ae591948f9c1c4696d5391fd
SHA512 e22fd9f2da25d85d3f8f516cb2e4d2c5fad9dedab1e7457a5f56311c5c9f8e5441a81c599f3e63b319b87b574e18160f503246e95812926913a03d6317c9f544
SSDEEP 384:nJiF9CcmyWCs38N28TUNTUlIxBPm3ek32nn9BIQ59sSSfC8GdyKmCgAhbe4KV8pK:gFccps35wgPKekmga90GdyKphbI8p0J
TLSH
T132B25B31ECA8CABBEDE64F89FB4A6A17DEE01163858C59E4DADC1D1D00971DD134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae955cd3

Path C:\Users\Admin\AppData\Local\Temp\696f2f11\ae955cd3
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5772-367-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-427-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-10-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-11-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-12-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-13-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-14-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-15-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-16-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-18-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-17-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-8-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-7-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-6-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-64-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-49-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-5-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-424-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-3-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-231-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-252-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-360-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-359-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-363-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-364-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-365-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-366-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-0-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-400-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-2-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-399-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-401-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-9-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-412-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-4-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-425-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-421-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-436-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-435-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-434-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-437-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-433-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-438-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-431-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-430-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-420-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-419-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-418-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-416-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-415-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-413-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-392-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-1-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-380-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-368-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-439-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-440-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-441-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-442-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-443-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-445-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-444-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-446-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-447-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-448-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-449-0x0000000750000000-0x0000000750133000-memory.dmp

Download

memory/5772-450-0x0000000750000000-0x0000000750133000-memory.dmp

Download