70b379bab5463affb172c93fc69724ff72c1b84f87a1cb34cf041a426521032d

Analysis

max time kernel
151s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 133.8MB
Sample260710-bss1sacy8s
SHA256 70b379bab5463affb172c93fc69724ff72c1b84f87a1cb34cf041a426521032d
MD5 776eb960e632f19393d6266b93aaf3ae
SHA1 60153f5365b97598e949adbb118f3a87232feb8c
SHA512 4dec22c4f30825837230392d468e6f581c5cf882a625e1eef3ba8ce3555eaff3832bec5b7a45fde2068a48382e73ce119fb70cb7e0fa2ade90b10b24929828e0
SSDEEP 49152:zDRx8jJEsrE6+tai23IJ6IOcNVSZr5gagTav1z7+UvT+N85:zDyY24JrOnr5PZ+4T++5
TLSH
T1E4688C0BBDE008E9D4AA923649B652967B31FC0A0F3263D72E9076382F72BE05D75754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 3564 created 2368	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	86
PID 3564 created 5448	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	87
PID 3564 created 2776	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 3564 created 2396	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 3564 created 2540	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 3564 created 256	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 3564 created 260	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 3564 created 2368	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	86
PID 3564 created 2368	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	86
PID 3564 created 2396	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 3564 created 2396	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 3564 created 2696	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 3564 created 1796	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 3564 created 692	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	114
PID 3564 created 1560	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 3564 created 4968	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	117
PID 3564 created 3152	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	119
PID 3564 created 4768	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	120
PID 3564 created 4104	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	121
PID 3564 created 2696	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 3564 created 2696	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 3564 created 1560	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 3564 created 1560	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	115

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2396	chrome.exe
1560	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{68C53A57-4824-416D-8038-D71C7872576D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
2368	chrome.exe
2368	chrome.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2368	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	86
PID 2368 wrote to memory of 5448	2368	chrome.exe	87
PID 2368 wrote to memory of 2776	2368	chrome.exe	88
PID 2368 wrote to memory of 2776	2368	chrome.exe	88
PID 2368 wrote to memory of 2396	2368	chrome.exe	89
PID 2368 wrote to memory of 2540	2368	chrome.exe	90
PID 2368 wrote to memory of 2540	2368	chrome.exe	90
PID 2368 wrote to memory of 256	2368	chrome.exe	92
PID 2368 wrote to memory of 260	2368	chrome.exe	93
PID 2368 wrote to memory of 256	2368	chrome.exe	92
PID 2368 wrote to memory of 260	2368	chrome.exe	93
PID 2368 wrote to memory of 4548	2368	chrome.exe	94
PID 2368 wrote to memory of 4548	2368	chrome.exe	94
PID 2368 wrote to memory of 3604	2368	chrome.exe	95
PID 2368 wrote to memory of 796	2368	chrome.exe	97
PID 2368 wrote to memory of 796	2368	chrome.exe	97
PID 2368 wrote to memory of 1792	2368	chrome.exe	96
PID 2368 wrote to memory of 1792	2368	chrome.exe	96
PID 2368 wrote to memory of 200	2368	chrome.exe	99
PID 2368 wrote to memory of 200	2368	chrome.exe	99
PID 2368 wrote to memory of 2936	2368	chrome.exe	100
PID 2368 wrote to memory of 2936	2368	chrome.exe	100
PID 2368 wrote to memory of 2876	2368	chrome.exe	103
PID 2368 wrote to memory of 4636	2368	chrome.exe	104
PID 2368 wrote to memory of 2876	2368	chrome.exe	103
PID 2368 wrote to memory of 5336	2368	chrome.exe	105
PID 2368 wrote to memory of 4636	2368	chrome.exe	104
PID 2368 wrote to memory of 5336	2368	chrome.exe	105
PID 2368 wrote to memory of 1608	2368	chrome.exe	108
PID 2368 wrote to memory of 6112	2368	chrome.exe	107
PID 2368 wrote to memory of 1608	2368	chrome.exe	108
PID 2368 wrote to memory of 6112	2368	chrome.exe	107
PID 2368 wrote to memory of 4496	2368	chrome.exe	106
PID 2368 wrote to memory of 4496	2368	chrome.exe	106
PID 2368 wrote to memory of 3292	2368	chrome.exe	109
PID 2368 wrote to memory of 3292	2368	chrome.exe	109
PID 2368 wrote to memory of 2084	2368	chrome.exe	110
PID 2368 wrote to memory of 2084	2368	chrome.exe	110
PID 2368 wrote to memory of 1540	2368	chrome.exe	111
PID 2368 wrote to memory of 1540	2368	chrome.exe	111
PID 3564 wrote to memory of 2696	3564	2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	112
PID 2696 wrote to memory of 1796	2696	msedge.exe	113
PID 2696 wrote to memory of 692	2696	msedge.exe	114
PID 2696 wrote to memory of 1560	2696	msedge.exe	115
PID 2696 wrote to memory of 692	2696	msedge.exe	114
PID 2696 wrote to memory of 692	2696	msedge.exe	114
PID 2696 wrote to memory of 4968	2696	msedge.exe	117
PID 2696 wrote to memory of 4968	2696	msedge.exe	117
PID 2696 wrote to memory of 3568	2696	msedge.exe	118
PID 2696 wrote to memory of 3568	2696	msedge.exe	118
PID 2696 wrote to memory of 3568	2696	msedge.exe	118
PID 2696 wrote to memory of 3152	2696	msedge.exe	119
PID 2696 wrote to memory of 3152	2696	msedge.exe	119
PID 2696 wrote to memory of 3152	2696	msedge.exe	119
PID 2696 wrote to memory of 4768	2696	msedge.exe	120
PID 2696 wrote to memory of 4768	2696	msedge.exe	120
PID 2696 wrote to memory of 4768	2696	msedge.exe	120
PID 2696 wrote to memory of 4104	2696	msedge.exe	121
PID 2696 wrote to memory of 4104	2696	msedge.exe	121
PID 2696 wrote to memory of 4104	2696	msedge.exe	121
PID 2696 wrote to memory of 5156	2696	msedge.exe	122
PID 2696 wrote to memory of 5156	2696	msedge.exe	122
PID 2696 wrote to memory of 2556	2696	msedge.exe	123
PID 2696 wrote to memory of 3320	2696	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_776eb960e632f19393d6266b93aaf3ae_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc7ff2c728,0x7ffc7ff2c734,0x7ffc7ff2c740
    3⤵
    PID:5448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,759318763576436391,969101907348775908,262144 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:2776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1328,i,12180157149720301915,14659970709714183617,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,15395698424991390884,10035531312121388406,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,6931769865261981016,1709681047190520706,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    PID:256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,18239460072107674157,7460854995339011627,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,7888688091383626801,10613117017932311287,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,10079835251836046026,7285008799973293704,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5496,i,1711057112026980612,3510365319073322703,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,17452892565780865649,12645663958710594377,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5828,i,2337177516154791159,16892534990239796139,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5572,i,1565686875953393200,5921738892217113538,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:2936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5484,i,3192002290121169377,15848873606840480533,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,4527480093897685963,10122757616240237836,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6044,i,761441923818522272,17093029998117391587,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4696,i,6406722476911791938,4604737378798733037,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4728,i,17876251364673145421,2677411230792668455,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:6112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,17198117184070658871,11420811051317897944,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,17727683542543840571,10133672576855957442,524288 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5532,i,2189232498264140748,13307193605281790787,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5884,i,16883410652330144852,13365023236004412814,2097152 --field-trial-handle=1920,i,9345803080921859032,4712175646865246916,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:9
    3⤵
    PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x11c,0x328,0x7ffc6459c188,0x7ffc6459c194,0x7ffc6459c1a0
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,5191360251566707924,16639334422505940265,262144 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9666454073830740445,1536451533499539969,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,11822395748865789909,2074283410673794477,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,18210616057283197054,10205193876194526124,2097152 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,1904494031999027485,1611456955075215368,2097152 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,5841408527276367477,7239417404558689344,2097152 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,4039345147648588784,332281352522435103,2097152 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3190813244191202516,7750347245599642879,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,18017820389557080068,18310999088520083569,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13778684606005776974,5632208559377649402,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,13223087977911833949,15431164895292601394,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,13223087977911833949,15431164895292601394,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,5903016968510138653,6534633414014768362,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,2167787487764907165,2400115291196106930,524288 --field-trial-handle=2248,i,17909437557642335844,5944674621483565848,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:5512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0c3cf7b3b150043061bc54970e6d4fcc4465fbe935322f26b1807e0b17e28e40
MD5 1efe32447176d98000b3cc6dd07e4aed
SHA1 3b8f4cfc4bec857c98507605235fe0e3e22e9d13
SHA512 d5d524ac1ccb77edb40007a405d47156b1b46c1b1c8efec346b3d0ef9bec74df2ee2bb0c2f42643ff2032a49af6c6b9d8bc8a8e7cadcac440c3552e860626977
SSDEEP 192:5BR4razUv7QvAPRp2o9XxHsb+WNnYIs2nnVyIsnAUgR:5BR4riQ86XjfwY/2BR
TLSH
T15C22742EBD10653B6DCBD22EFA627793D7F6102225E12E44E7F88A2C15DB5CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 d4aee5ba7ef2c8f537f5d663be19ab4b77f2e089ae6ebb8b27f424b5b29b6545
MD5 5d6badd73ed14ae2a4724cdac4c4b5ae
SHA1 50439a1b44a6d6bb3ef9312df6282b463804c810
SHA512 c0dc11ccab6c63572a77c8bcdcc83b7fc3dbbcfd5bdf4b2531a6b2b9d07c16db7d5e5bae6fcd17a282a2dca4109319e8e6561ee41b69e207cbe432d1cb9fd54d
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oa1MhVumSVn+a:1nbZeMrv/hGta1Msn+a
TLSH
T1B1D3984B3A747102EDE59A722CE051BB5E3C716D8F1595D428B620688EF2853B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 058b4c33d2f0dbde26c78e96925a081b72e91ab0a5604f512103c4324f0cb728
MD5 b7d0e4430ad2090b1e7c1dfcc9511284
SHA1 95a6a39fbe78908ec078d8a6228422a69c58e422
SHA512 bc6815acad66365c93d2c2b5d8e3376653e1d686f0d79d47759aa268fa6c3f73f29c788e2ce1947d4b0931a8d3954827e7ae2817214e7d8dae366b7ed7bf65a3
SSDEEP 96:xC61d+r2io+TJ/E0f6m934zM4RDotok5E1mDEB6nGyvn0b4T8ZybJv4a:xC2ITo+TQ0InDUDBoPPb4T8Zybl
TLSH
T160A1F736A0284D775076D44AB1626A43CFA9706BD9B2AFE4EAE90F0D15F74EC1342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 eb76be1f9bd91ec56aecbd60a8213a77e1d7b4414c805841b569d1e4a19a0135
MD5 eb9941d0e00863c776a3e698787bd855
SHA1 32d441a65f26120388198a15eff9ba2f6a120cbb
SHA512 a27542bf09fa106c1d73b7469ef567a98ccfa2708c886f41a25a83ee606261fa09a60ab5df31566511e9e572ab89c5d19a8115dfcad3ebe8671123fd70eb3d49
SSDEEP 96:xC6Yd+r2io+TJ/E0f6m934zMT9Sl8h4otop5E1icDEB6nGyvn0SvQxwzQ9hj+9Zm:xCXITo+TQ0IqziU2koPPSIxRhj+9ZCUA
TLSH
T116C12B32B46D5C3712A7E446F1233A47CEB47057DA51AFA4EBE50F0D01E70EC2392526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e8b6f83d7384a0286ad3ff67b283fde46f56d18a762b4b191266ad1eea3fa4b
MD5 e07007e84d735799b7709bfc9bde650b
SHA1 4d22415162d3e1e2f27c52a6ba26f29d4e54c4cf
SHA512 1fdc969203ddb6ff894d03271f3476f934127997a80adf545ae84d279678b8e1cd007f217ef4f37bfaf0ca1fa4c70086f915dda06714d0de10a7802033b1b7f1
SSDEEP 192:sxRnRNyM/jK1Ml8wCU/flsjlfwZTBPzoA8pi/g6+WNIYoXCYWGlIgtJ:sxRnJ8U/fls5fuTsi/5IyA3
TLSH
T1BC52FA156A245D3BCCDBD30DFA557F93D6F91573A2901E44AAFC8A0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0f32035e498d66219ad4b75bd31fa0b4fc141d936afa1e2d3b0483b19dc640e2
MD5 b7a60f41bcd91ac71b91f69f5b62936d
SHA1 0ece0ace5b181317fa6f5a849d1f0bc282b22490
SHA512 7e32dea3d51e80dea9db766f0e069ac9a5efefd1e13d9af9e8207aeaabc26482f849487c2a66924ee83706b36806dd380bc45bbd3ce98ac349cf11c4d20be654
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OV6UpVuGWrockieZ:jXwHnUE7gRWgs2fJ2u1jaVUp4GtdDT
TLSH
T18BE2FC3B680CCBBE4F404A9DEC29BD9E6DA801CB96D88D5447FA440C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 944cda633a21c8bdaa08b29910924c7821abccd5b117fb0af08cba369e5bb894
MD5 e892ea6a3ba35bb7b0241182b8742f64
SHA1 f7edc96b1587501fbca2418dbad99cd5a25477ae
SHA512 0f67e3c646ba9ec4d49557186c1bf9ea517ef8a19691dc649962384539da0bb22989562860c97241e40119b414eba0800be152c8ddac6aa74f4bf775a32c1e77
SSDEEP 384:DNrRZyCSDnxTICOAVKMEhIKyll7svbFKfk7:xFZJSDniPq7yI1l7svbF9
TLSH
T16D44950A7B747001EDE6DD721CB080771E3C716E8F22A6916DA254698DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b43e2c1a-76c1-43e8-b799-7a941801a300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b43e2c1a-76c1-43e8-b799-7a941801a300.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aae98dc89d552944b0e19b14861f2c1383da2a5ffd2f1cf65b7c062cebc70988
MD5 694ef06f3064dd4b0f99f2895748e6e0
SHA1 a825b189865eeb6d2c0aeab21dc5bd3fe5ac2595
SHA512 227bff7be6ba2727077b204dccfbf56c1fccb6f9864875457fbc80f1001ced7e78c6b96bb2994be462d373dad321180799531420b3ca6c48c984e1bf1fbc0eec
SSDEEP 768:Qj+9h3B//TBOWhjiGONXyer1IRCzni9GMVcLCO7w/z8:v9h3hrSIqnZHCt/z8
TLSH
T1BBF2B035E5A66E238CE1A7CAB20377877FF86067C5C50A90EDDA2F4E05C765D130B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0881fdafdf989f79697587e0119489ba307530965a281666a61c9c40d3af6f3f
MD5 6c094fdcf093ff3db871073ff78d18d5
SHA1 a885570b43de8804ffd7354eadbecc749bfcbec4
SHA512 93332d6eaf53de250d3c154f13d2a34a0210f88903b3b077f1b4087fd891cd2026ef56aa737d8227355777b4a3ab9713fce3f32f13ae9742fb240f24f93248f0
SSDEEP 768:hrv+4UNbdz3gN/TBOWhDONXyer1IRCzniB+eVH1SK7:hbsbV3C/SIqntEH1l
TLSH
T12B03CF32A4A89E338CE2A3C6B14777437FB86057C6840B90D9DE2F4E069B59D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6316610a

Path C:\Users\Admin\AppData\Local\Temp\df9daec4\6316610a
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2368_2128385548\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_1331863982\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3564-104-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-73-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-76-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-85-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-107-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-125-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-132-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-142-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-141-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-131-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-130-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-129-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-128-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-127-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-126-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-117-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-116-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-115-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-114-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-113-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-105-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-56-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-103-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-102-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-101-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-100-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-92-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-91-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-90-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-89-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-88-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-87-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-86-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-75-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-72-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-71-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-70-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-68-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-69-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-74-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-53-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-46-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-55-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-54-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-60-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-45-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-42-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3564-2600-0x0000000410000000-0x000000041021A000-memory.dmp

Download