4521f532bf22c3155a95a71c4797253680dc60618c74c18522506a603ef43a03

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 2.8MB
Sample260702-gglefsb161
SHA256 4521f532bf22c3155a95a71c4797253680dc60618c74c18522506a603ef43a03
MD5 eb0da5f19b4395355e77c8da57d7266a
SHA1 ae22f19ee1036f18f42a9fb9cfd203d0f15d6766
SHA512 6ffd00f2d99a2324b66428de89a70d528b286a5f4cfae166d321de9aec9af490d80f235022bd49be21e3203cb575fc19c644d766aa1b49e3a426bbfde12b0e93
SSDEEP 49152:mv8RCDoF8Zt/ZTqYH26qbumU/FphRlMWcazv70CSg:mvFDJKumUtLRqWcabw
TLSH
T111D59D0B7C9109E9D8AA633688B251927B79BC450F3623D33E90B6783F727E19D39741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 1388 created 2388	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 1388 created 908	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 1388 created 6132	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 1388 created 3976	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 1388 created 2348	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 1388 created 2532	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	94
PID 1388 created 2492	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 1388 created 2388	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 1388 created 2388	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 1388 created 3976	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 1388 created 3976	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	91
PID 1388 created 5512	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 1388 created 5892	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 1388 created 236	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 1388 created 2996	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 1388 created 3164	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 1388 created 1572	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	116
PID 1388 created 2672	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	117
PID 1388 created 5476	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	118
PID 1388 created 5512	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 1388 created 5512	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 1388 created 236	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 1388 created 236	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	111

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3976	chrome.exe
236	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274448244015066"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{7E7B4A8F-D36C-4A72-A6F8-83D47D7E9B18}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
2388	chrome.exe
2388	chrome.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
5512	msedge.exe
5512	msedge.exe
5512	msedge.exe
5512	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	2388	chrome.exe
Token: SeCreatePagefilePrivilege	2388	chrome.exe
Token: SeShutdownPrivilege	2388	chrome.exe
Token: SeCreatePagefilePrivilege	2388	chrome.exe
Token: SeShutdownPrivilege	2388	chrome.exe
Token: SeCreatePagefilePrivilege	2388	chrome.exe
Token: SeShutdownPrivilege	2388	chrome.exe
Token: SeCreatePagefilePrivilege	2388	chrome.exe
Token: SeShutdownPrivilege	2388	chrome.exe
Token: SeCreatePagefilePrivilege	2388	chrome.exe
Token: SeShutdownPrivilege	2388	chrome.exe
Token: SeCreatePagefilePrivilege	2388	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
5512	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2388	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 2388 wrote to memory of 908	2388	chrome.exe	89
PID 2388 wrote to memory of 6132	2388	chrome.exe	90
PID 2388 wrote to memory of 6132	2388	chrome.exe	90
PID 2388 wrote to memory of 3976	2388	chrome.exe	91
PID 2388 wrote to memory of 2348	2388	chrome.exe	93
PID 2388 wrote to memory of 2348	2388	chrome.exe	93
PID 2388 wrote to memory of 2532	2388	chrome.exe	94
PID 2388 wrote to memory of 2532	2388	chrome.exe	94
PID 2388 wrote to memory of 2492	2388	chrome.exe	95
PID 2388 wrote to memory of 2492	2388	chrome.exe	95
PID 2388 wrote to memory of 1676	2388	chrome.exe	96
PID 2388 wrote to memory of 1676	2388	chrome.exe	96
PID 2388 wrote to memory of 4940	2388	chrome.exe	97
PID 2388 wrote to memory of 5884	2388	chrome.exe	98
PID 2388 wrote to memory of 5884	2388	chrome.exe	98
PID 2388 wrote to memory of 5324	2388	chrome.exe	99
PID 2388 wrote to memory of 5324	2388	chrome.exe	99
PID 2388 wrote to memory of 5848	2388	chrome.exe	102
PID 2388 wrote to memory of 5816	2388	chrome.exe	103
PID 2388 wrote to memory of 5336	2388	chrome.exe	104
PID 2388 wrote to memory of 5848	2388	chrome.exe	102
PID 2388 wrote to memory of 5816	2388	chrome.exe	103
PID 2388 wrote to memory of 5336	2388	chrome.exe	104
PID 2388 wrote to memory of 4812	2388	chrome.exe	107
PID 2388 wrote to memory of 5744	2388	chrome.exe	106
PID 2388 wrote to memory of 5396	2388	chrome.exe	123
PID 2388 wrote to memory of 4812	2388	chrome.exe	107
PID 2388 wrote to memory of 5744	2388	chrome.exe	106
PID 2388 wrote to memory of 5396	2388	chrome.exe	123
PID 1388 wrote to memory of 5512	1388	2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 5512 wrote to memory of 5892	5512	msedge.exe	110
PID 5512 wrote to memory of 236	5512	msedge.exe	111
PID 5512 wrote to memory of 2996	5512	msedge.exe	112
PID 5512 wrote to memory of 2996	5512	msedge.exe	112
PID 5512 wrote to memory of 2996	5512	msedge.exe	112
PID 5512 wrote to memory of 3164	5512	msedge.exe	113
PID 5512 wrote to memory of 3164	5512	msedge.exe	113
PID 5512 wrote to memory of 3736	5512	msedge.exe	115
PID 5512 wrote to memory of 3736	5512	msedge.exe	115
PID 5512 wrote to memory of 1572	5512	msedge.exe	116
PID 5512 wrote to memory of 3736	5512	msedge.exe	115
PID 5512 wrote to memory of 1572	5512	msedge.exe	116
PID 5512 wrote to memory of 1572	5512	msedge.exe	116
PID 5512 wrote to memory of 2672	5512	msedge.exe	117
PID 5512 wrote to memory of 2672	5512	msedge.exe	117
PID 5512 wrote to memory of 2672	5512	msedge.exe	117
PID 5512 wrote to memory of 5476	5512	msedge.exe	118
PID 5512 wrote to memory of 5476	5512	msedge.exe	118
PID 5512 wrote to memory of 5476	5512	msedge.exe	118
PID 5512 wrote to memory of 5800	5512	msedge.exe	119
PID 5512 wrote to memory of 5800	5512	msedge.exe	119
PID 5512 wrote to memory of 2792	5512	msedge.exe	120
PID 5512 wrote to memory of 2792	5512	msedge.exe	120
PID 5512 wrote to memory of 3224	5512	msedge.exe	121
PID 5512 wrote to memory of 3224	5512	msedge.exe	121
PID 5512 wrote to memory of 4816	5512	msedge.exe	124
PID 5512 wrote to memory of 1868	5512	msedge.exe	125
PID 5512 wrote to memory of 1868	5512	msedge.exe	125
PID 5512 wrote to memory of 5320	5512	msedge.exe	128
PID 5512 wrote to memory of 5320	5512	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_eb0da5f19b4395355e77c8da57d7266a_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff805d8c728,0x7ff805d8c734,0x7ff805d8c740
    3⤵
    PID:908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,7657009321024091988,13945228947913784178,262144 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:6132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,1267475878314558922,3109256473961037067,524288 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,6957388405789819681,11404123713875095958,524288 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
    3⤵
    PID:2348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,239836232422301675,15140266598078528862,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3064,i,2558037077941937174,9713424039295806097,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,7616132979413814728,18438449260478790462,524288 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:1676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,15385915548086635530,7382880373454847937,524288 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5412,i,16959272620241504339,1576889372290863550,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:5884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5456,i,12533337385082653587,1612236299223514750,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5608,i,9658290374159487185,16856717446430122268,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,10655429456564856341,6438548369679534918,524288 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4860,i,9366486605387751601,11331745454165552334,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5800,i,10834619220454918876,14118465573843545841,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,17346147480840869963,15766469264472662760,524288 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5936,i,10152890869807223187,6164001896991043688,2097152 --field-trial-handle=1856,i,10519267630520375676,2512231891082511157,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fffea53c188,0x7fffea53c194,0x7fffea53c1a0
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,14352886514866722304,11430355856307077485,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:11
    3⤵
    - System Time Discovery
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1668,i,10186790565507929165,7640630982742662501,262144 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,11305981639312579446,12552980927138133875,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,18375529898247077181,5476489838402880158,2097152 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,6662250210276540617,10564812290574491284,2097152 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7033991239939224397,7975561998204487998,2097152 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,14333030000698114992,8025297064463745141,2097152 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17809188122231917363,1469085929294883600,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9169982229389407092,11470193769139492227,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14344441835953295244,3024682436538845489,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11987130456630853763,5532055462769013978,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11987130456630853763,5532055462769013978,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,13413981897555613171,16434281949280245591,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,7854554279970412158,8041045289362383411,524288 --field-trial-handle=2232,i,77814660269942822,15199459017837819765,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:5320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8d7c074edcd9ee6bdcd5c7affae879d00b3ce3dab1b5a7728f00cd70f501fec2
MD5 8c4d7488906899f92948a865ea45587e
SHA1 3a7fdeec56e031dece3822638f00d034bed3885f
SHA512 403c332170bf05f40cdcb5716e9059902e05fb3f6af26bf20f43e01b42784580784b6dd6c1faec10ac294d9749b3d2476cdafb0083ebc75cef2423e51ec40e79
TLSH
T15DE02B9BDC21ED3708FD1719A0544747E75013672740554F7E3CD2098FBA63A4196C7C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c7135f40085038777cc17ab9a36872abdb0bc014a97daa5cafff218380134799
MD5 2e58689f146e5644a795ca0844005a20
SHA1 88527ad445dec490988bea03061d3b161196bd95
SHA512 5bcb2d040e2501316a3c6659ac11484723278a4b88a17eaee53b1c9fa30b9508b7417576033f7fa361d54111f7a2996d5e424a4637d047cff9c50d7ee9766921
SSDEEP 192:0R4HZfzOv7CvAPRp2791Hsb+WNnawP6sVyIsnAUgR:0R45bqm6XELwtP3R
TLSH
T11E22941EA914653B9CCBD21EFD25B763E7F5102226D42E44EAFC8A2C16D76CC3227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 789e66be178c41c5f50af32d6dcf573abd7917ed9e986f0a8165817d7dbf2936
MD5 007c887f3a039a99f986a058d7675171
SHA1 84ff1eae9c1ffb573633e09be36a4c950c695bf4
SHA512 8c8117b792cbc9f30535f074f6d9dd4dee50a72e510a494100d584494c704c5a7e59c446b57b79c355067ae009bee1539babd6fe435a12ade7e975552211e5a5
SSDEEP 192:eIH4K6mc7KxkXqK4I40pUZNCgVLHrKHfFKslErA+XzKD/JE+ErUkKN9lBGlwZA9M:VHjxc7KxkXqKf/pUZNCgVLH2Hfgslp+M
TLSH
T13432FA27948DAE7F4FD8D50DCC12AB4B6CF4029766680D2497FB9D0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 82484aa88db4bc99580c9aa071e405dbc211dd3d608b453a242065beacd3a271
MD5 429f2cd7ee878f066cdf99a8ce145bd7
SHA1 20d0c87a084e8e589dfde282e0c3fc2a99793061
SHA512 c7167805b35e22a8ad4b397e6f4b752b4215579423bab98fcd576e38ebb09648468f511c26b3ed851092bf6e84c08b46df0e4cafbf2e7921a1325042486ad545
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OSTQuTVumPynPW2e:1nbZeMrv/hGtScnm
TLSH
T1E1D3874B3A783002EDE59A721CE051BB5E3C716D4F55D5D428B620688EF2863A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1d65ca6-0480-4b7d-9e3f-4bdc6082ecfb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1d65ca6-0480-4b7d-9e3f-4bdc6082ecfb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 efe402e749434db3d7c8241be9faad96857a95c77df5865ee3ba16e5fc464611
MD5 85413e4b864d4e0719e872b96e5ef31d
SHA1 f20cdc2cdd3eb46f0d85580b86b9dc2231c9a8fd
SHA512 bd7ce002813e24184477534e05bb6f758e2c684788d90a32d5cc1ea3caffe96e8f7bddb117636e4ebc40c72ca66e678007515f805e216a36746414ff3da1701f
SSDEEP 96:OC0d+R07wEk/0a3kCfYG785RDotok5vp0DnB65GyvfoqCCZbcv4a:OC0K07wDc9GCDUDhCBJiCCZbO
TLSH
T135A10A31A46A987765B3C649B4522A57CFF8619BA5205F84E9EC5F0C26F70EC1342733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9890d89f33b6320e4531402be400e2dfdd3c7873c89f44c005ebbe97a8b1b427
MD5 4fefee20be66ea5767c962444cb4c7b9
SHA1 7b4db8b23cf39de7120ca321a02d570b98e8c892
SHA512 8765468de364814fd49f580984d05567affb905b017a3eb8a7adff280e39ac0c3ed61ce6b8bbaacafc8b6cebafcd0bdf2a00cbf10e578be7a443b67e7f43f909
SSDEEP 96:OC6Od+R07wEk/0a3kCfYGD8ASl8h4otop5vpUPDnB6/GyvfoHctRxwzwsT335zCQ:OCxK07wDc9GniU2hMBvPoxU5zCvUP
TLSH
T142C13C71B86E6C7726F3D648B0132A578EF420AB9B105F94D9EE4F0C12D749C1382222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
MD5 0a273f57544ca9c385c90abd2fb2f8b8
SHA1 663d351037054236aaa58a924f66180602045244
SHA512 8a731bd22460fb3b026847be48aab957fe90f0ad7e2dcb291305580f3553409cfdff67355886d3d2f95cd8f8ff1d2726447bc2b96bce2cdcc51a8a15cbcb9d0c
TLSH
T1CFD0C010324DB00CC040203214210360F2309610602B47084020F02CCC78DA173466CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
MD5 b694af012c621426ee8e90a8ed586333
SHA1 e839cf90b93d2693f8046fc19ae1373628f0cf99
SHA512 b9142bc76c532d8974de0c5db727ec4870a44225dc222a9fdc138b1278d0f4cb8cef786ed6b936ee6b436177a50e31c07b489d69dd8d25de345ea17638a55e56
TLSH
T188D08055364DB40CC151253254615365F6749651B42B57185460B01CDC78DA173576DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5d518802d67fca75af02455654aae3e97c3a2bc3ab50eba8ec36081cfae41c01
MD5 7963b401918be10b614ca0edfc584696
SHA1 c32b6e18c423bbce5984abb03f23edf08c2bc743
SHA512 f2f2a7d2dbcfd6b46fe499180a890d40e74840a3ec5edc043cda5aeed270b5748c1a77a88525bb9bffb24907629a32fa5edf15a9811555dac04f42edab82f43e
SSDEEP 192:sxRDRjyM/jK1Ml8wcc/fasTOlswoFezoA8pi/g6+WNIYH1HMxGbIgtJ:sxRD1Cc/fasTgQFDi/5Iob3
TLSH
T19F52EA166A289937CCDBD20DFA557F53D6F91533A2941E04AAFC8B0C01E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 193377c3634268e1a15d13f1670a6885112a37e1fd8cfa1b5ebc7a13e8fde171
MD5 2bdfc329ddac748a2bec3790e4a6eaf1
SHA1 fefb2e318c0a03cc8ded0d6c62b3959560b85c05
SHA512 dd8bda769c39317851a9468e83398265e1f8e16f39671ca2534915514658fdfe778f08a5ae70857038716d4491de5e9b7f3e53ccfa40692da5e0c79346d6bf59
SSDEEP 768:JOVPHO7pLuL7E1WgesfvQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0qjPE+droXIhJ3:JOVPHOE7E1WgesfvQu1janqjc+WiJ3
TLSH
T13AE2FB3B680CCB7E4F804A9DEC2E7D9E6DE802CF56D8C95447EA880C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 37d499af0a2ed0d853e5334699814dc155190cb5a1f90de20513f7ba6aca473f
MD5 15cf47bbbd316173314c43b93866e103
SHA1 cf757ac1ae21676bd853b91cc8796e6af363dbdb
SHA512 bba03241cb6cf4855c8e4b922ca6572060fd1a4898c8b7a24fb9219a8d1b5d4f9e73e0b1f52e6bd2113c792c28eabac3f9c6679d55c4d1a3c02a2504991e5f97
SSDEEP 96:KghSKiEiKWkKDKR6/masMs6WURJgK6K4PgQ6caS5oqzH8dIsGKr:I9XM6/masMsFURaKCPgQBaS5oqzH8dIo
TLSH
T18C914110757E9704393D751D92F8985A428730A2319AF83B77A811E71FA7E408EFCED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 8c178562f0b34dfd96ae41ca7a7bedbe75170ee478e7e59e97a46e26c55bb2aa
MD5 3b9ca28ec3169b2ad6eac66911e9d77a
SHA1 de7922f302fd989bf0aabfc4b387c2fe7dcb80d4
SHA512 ce627118cec9c151dac9fc562f994cfb73c42e3d5ce284d77343ce2aa73041222d8c65b00587512af341ddf3efd442917fecb1fa71d7edb82ce65953ce80f6f0
SSDEEP 384:DNrRZyCSDnxTICAMEhIKyll7svbFKfk7:xFZJSDnigyI1l7svbF9
TLSH
T11644840A7B747001EDE6D9725CB080771E3CB16ECF22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 03879271cea7f0c803fc659cd05b7b775f88ac5d8e3182f387223dd7e5b4a229
MD5 ce7cbda00ec1810d2f65abc01c83e500
SHA1 4f53e305b93e8fc89ae611f220aaffa808c23393
SHA512 2d1448bad058e94e0aa57c5d52e0a055c1a3be542b0ad8ef92f42ecdf5256ec3bda8d08b66532798930dc2ead305f724d9f3415bc418716de2d8c83e1cae91f0
SSDEEP 768:Dj+9L3nEUR2BgNl8PYyDPm6MGjzJU3Dl8BvTPaUwo:G9L31osSQyDnMiCDl0WUwo
TLSH
T169F2AE31AC946E775CB2CE8972477B8BAFE452A791841E80DED92F0E018771D134BC76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f45372ef1f56c5ae61e57d1ba98c631197a3b894bcdf87c734a122a720f964a0
MD5 0ceaf183c2e7e212b5b5d65e3bf0a34e
SHA1 625ed601045e96ab785d991e02207e5d9c5d5d57
SHA512 33e3997722efd9e89d7011331bf4ff553a2469409d221087454f6fd09adab1dc585e2784822dff91952f5e4301fad6c92aed159215e79c4ed81d64c4ba7d8d5f
SSDEEP 768:Vrv+4UNbdl3oaNR2BgN4PYyDPm6MGjzJ8w+8rY0n:Vbsbn3nos4QyDnMihDrY6
TLSH
T19903C0319CA4AA736CF2CA89364B36077FF4915396C50F8499DE2F4D429F96D130B8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9998c7ba-84ae-434b-a511-f1bbef8e749a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9998c7ba-84ae-434b-a511-f1bbef8e749a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7f5fe99b

Path C:\Users\Admin\AppData\Local\Temp\2c3ad93f\7f5fe99b
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5512_1480223630\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-181-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-127-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-77-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-75-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-81-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-85-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-92-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-96-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-101-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-105-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-115-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-126-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-131-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-137-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-155-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-167-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-184-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-185-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-183-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-182-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-69-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-180-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-173-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-171-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-169-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-166-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-163-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-162-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-154-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-151-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-145-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-135-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-129-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-72-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-125-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-121-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-119-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-113-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-104-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-100-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-97-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-91-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-80-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-76-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-71-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-64-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-63-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-51-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-48-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-45-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-43-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-27-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-14-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-13-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-12-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-10-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-8-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-3-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-2-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-1-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-61-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-58-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/1388-2414-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download