salatstealer | 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8

user interaction
yes
max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-es
resource tags

arch:x64arch:x86image:win10v2004-20260130-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
20/04/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
keshka.exe
Size 3.4MB
Sample260420-tlfe8aat2p
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 16 IoCs

resource	yara_rule
behavioral1/memory/4620-3-0x0000000000BC0000-0x0000000001817000-memory.dmp	family_salatstealer
behavioral1/memory/4620-4-0x0000000000BC0000-0x0000000001817000-memory.dmp	family_salatstealer
behavioral1/memory/4620-6-0x0000000000BC0000-0x0000000001817000-memory.dmp	family_salatstealer
behavioral1/memory/4620-15-0x0000000000BC0000-0x0000000001817000-memory.dmp	family_salatstealer
behavioral1/memory/5040-20-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-21-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-23-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/3104-85-0x0000000000E00000-0x0000000001A57000-memory.dmp	family_salatstealer
behavioral1/memory/6084-116-0x0000000000FF0000-0x0000000001C47000-memory.dmp	family_salatstealer
behavioral1/memory/5040-152-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-174-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-188-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-196-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-214-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-216-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer
behavioral1/memory/5040-227-0x0000000000520000-0x0000000001177000-memory.dmp	family_salatstealer

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
88	3488	powershell.exe
99	3488	powershell.exe
100	3488	powershell.exe
101	3488	powershell.exe
102	3488	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5040	dwm.exe
3104	dwm.exe
6084	dwm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4620-0-0x0000000000BC0000-0x0000000001817000-memory.dmp	upx
behavioral1/memory/4620-3-0x0000000000BC0000-0x0000000001817000-memory.dmp	upx
behavioral1/memory/4620-4-0x0000000000BC0000-0x0000000001817000-memory.dmp	upx
behavioral1/memory/4620-6-0x0000000000BC0000-0x0000000001817000-memory.dmp	upx
behavioral1/files/0x00070000000244d0-13.dat	upx
behavioral1/memory/4620-15-0x0000000000BC0000-0x0000000001817000-memory.dmp	upx
behavioral1/memory/5040-17-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-20-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-21-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-23-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/3104-65-0x0000000000E00000-0x0000000001A57000-memory.dmp	upx
behavioral1/memory/3104-85-0x0000000000E00000-0x0000000001A57000-memory.dmp	upx
behavioral1/memory/6084-111-0x0000000000FF0000-0x0000000001C47000-memory.dmp	upx
behavioral1/memory/6084-116-0x0000000000FF0000-0x0000000001C47000-memory.dmp	upx
behavioral1/memory/5040-152-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-174-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-188-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-196-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-214-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-216-0x0000000000520000-0x0000000001177000-memory.dmp	upx
behavioral1/memory/5040-227-0x0000000000520000-0x0000000001177000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\dwm.exe	keshka.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dwm.exe	dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe	dwm.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\22d34f3e-ed97-1c93-702c-a7daa9c53eed	keshka.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keshka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5504	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211750652588584"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	keshka.exe
4620	keshka.exe
4620	keshka.exe
4620	keshka.exe
5040	dwm.exe
5040	dwm.exe
1180	chrome.exe
1180	chrome.exe
5040	dwm.exe
5040	dwm.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe
5040	dwm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe
Token: SeCreatePagefilePrivilege	1180	chrome.exe
Token: SeShutdownPrivilege	1180	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe
1180	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5040	4620	keshka.exe	102
PID 1180 wrote to memory of 2716	1180	chrome.exe	111
PID 1180 wrote to memory of 312	1180	chrome.exe	113
PID 1180 wrote to memory of 312	1180	chrome.exe	113
PID 1180 wrote to memory of 5504	1180	chrome.exe	114
PID 1180 wrote to memory of 3484	1180	chrome.exe	115
PID 1180 wrote to memory of 3484	1180	chrome.exe	115
PID 1180 wrote to memory of 5432	1180	chrome.exe	117
PID 1180 wrote to memory of 5432	1180	chrome.exe	117
PID 1180 wrote to memory of 900	1180	chrome.exe	118
PID 1180 wrote to memory of 900	1180	chrome.exe	118
PID 1180 wrote to memory of 5732	1180	chrome.exe	119
PID 1180 wrote to memory of 5732	1180	chrome.exe	119
PID 1180 wrote to memory of 1836	1180	chrome.exe	120
PID 1180 wrote to memory of 1836	1180	chrome.exe	120
PID 5040 wrote to memory of 3488	5040	dwm.exe	121
PID 5040 wrote to memory of 3104	5040	dwm.exe	123
PID 5040 wrote to memory of 6084	5040	dwm.exe	126
PID 1180 wrote to memory of 1824	1180	chrome.exe	128
PID 1180 wrote to memory of 1920	1180	chrome.exe	131
PID 1180 wrote to memory of 5656	1180	chrome.exe	132
PID 1180 wrote to memory of 2644	1180	chrome.exe	133

C:\Users\Admin\AppData\Local\Temp\keshka.exe
"C:\Users\Admin\AppData\Local\Temp\keshka.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Reference Assemblies\dwm.exe
  "C:\Program Files (x86)\Reference Assemblies\dwm.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Program Files\Google\Chrome\Application\dwm.exe
    "C:\Program Files\Google\Chrome\Application\dwm.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff90795c728,0x7ff90795c734,0x7ff90795c740
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,1647667289758392965,3853707722025312137,262144 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,17585980608178042817,9458090061847026708,524288 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,6884107789260493734,1764320160507577818,524288 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,9865464995566727814,4126555440735139414,2097152 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,188287419190616801,16704248111323244441,2097152 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,15381910881332526839,3883510095979876627,2097152 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,13820452142288543467,5038385046554354466,2097152 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,5732586748820339897,188034097153674322,524288 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,1337291074818533326,6491771246003960898,524288 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,5815900038245044519,5486748837185784180,524288 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,13451928353199773518,11688702121117870887,524288 --field-trial-handle=1992,i,5648010108096264627,13467942070079280515,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Program Files (x86)\Reference Assemblies\dwm.exe
Size 3.4MB
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eda6ac6b094a80efca0bfe3e20dec501a6b61c94fc73108cd85b70bb4726c8b5
MD5 c00679c3819da6d87343fcf1513b6624
SHA1 7e3f18fa480ff168812786b180e32daec8f78911
SHA512 27f6434c728534650dc6dc9c1ccdf866929cd6cd461a1150ea7cdfb34317356e4eb3d688dfe8265b7bad67f77f57cfb2b08873f0222ce58f324c550552026f79
TLSH
T10FE02BABC862EC2708F91B3860540B46EE1017572B51950F7A3C964C8FF123F458681C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b4239e39a7ebd081b955f2f448257a9adfb3f0a247ad491d707926fbe991e79
MD5 952a7481ddd425b83fcfbf0432aae22f
SHA1 73fad06d9cca74df7bd4cf37f4ddac79dd2f643e
SHA512 50de1a97599042c866d59bbea1a54daa413f9aadabcad936d4c5a51a0cf549ba8ddc7fa2a9d97e8c38b23c651ee648af0d3423e708864eb175b305fda60efa9e
SSDEEP 192:JQRZNfSYd/OHv7japAPRp2w9mHsb+WNnyp0u3e+kaFUVyIsnAUgraJ:uRZNyPaUXbIwQ0LaFQe
TLSH
T10D42C92DA914757B5CDBD219FA667B57D7F5102120D42E84EAFC8A2C14EB7CC222F02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 13ada5ed79d0d797fd70fc50ffc8ef571a2061563ed2e562d767fb6b1ad3eaf9
MD5 c41ac070d0dc938a730a3abc93bea172
SHA1 2456bd00719d26f135227addfffce57680fd2166
SHA512 26cd2c292b38995f05e003dad5a8d95360fc9053858bc0eb6e5677104fb73d46cdc16be242a54c637a548cbd2d7cacf4b578de889203e582c1e486c294138fd7
SSDEEP 192:JQRZNfSYd/Ohv7japAPRp2w9mHsb+WNnyp073e+kajUVyIsnAUgtaJ:uRZNyxaUXbIwQ06ajQ8
TLSH
T1B842C82DAD14757B5CDBD219FA667B57D7F9102120D42E84EAFC8A2C14DB6CC222F02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c9d190693e44aceb03727e50758ab1d53ccb9fed6035e1ea54d549454b2a9b0b
MD5 e3ed439f9790af438c854b29de1f3f34
SHA1 71f9e602931b674769d063c72b4d5cf140a8eb9b
SHA512 fb6cf21d99b1208b96a7350b439f2f499ab72b7bfeb4dcc6fd34cd19338ba578f71ceee7307933c06b0064d95da0b52880ef3ec386f4f85d8cbeb8b567290488
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLILcmfIpXODGJ+ErU3DXH18aklgfNPC:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pd
TLSH
T13072F9A7684C9A770F94CA8CC8177F4FACB9015B65D9C86497FB582603D8BCB110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2b85394e74eda326707d5b5efc6732e2427f1bf0b3bf4cd6a755994045f4ce55
MD5 9f525078521dce3b3560333c1e47115d
SHA1 cafef7903a8dcafa36ce597121256833b6c55074
SHA512 6f275034d8a28c5e140cecd7426014d5a621611abe37d824b69b501f52a5bcabe7962d6d14f8a7d0439979bd9ff915ad4bb867fa52567a5d0cdf2d96ccfdd7ee
TLSH
T1D6B0127088019501C15302F4119304883254AF148705330253F07A7198375994124160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59be16.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59be16.TMP
Size 96B
SHA256 5da549d2ba29443505b30168c5093ba6f3215aaa5a9e67527cbc6305c54f73b7
MD5 c8e88e006f4ec736a99e2c7b5ac885b0
SHA1 fccc2c6ef4a24307dc59be9b1ffac31b051e2034
SHA512 e7b11193d31d002a983864d34a77225aa8aa675a95b2e521a0c5d57aa22ffd40ea54c4caaf9e4ba9d12a9e8210c73cfd189f2f2fb413a7f6856fed199fbc44a0
TLSH
T17CB00265C246A663C04343F129A5A9D87570FF25D6131A16A2E11A6BDC257A08636DA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 822cda59030946ffc030fe8b1ba5775f52c0536d7d16a62acc67b6037e254fb8
MD5 4b226cb6784f4674ad9e19e412030228
SHA1 04131407ea265934147d3f9d7aed47f1001395e5
SHA512 e20dbe7615c581e84274dd0419ec7ba36b887e638dc9cd5e3a7caafbb214ab4ea8170edda32b99780bb99053335ecbc05c8e3c043b939e4a923cd2e875c53e02
SSDEEP 1536:0cCncYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0D3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1F99302BA9E2646EB957E468176AE7808CE13134D709FA8CC315C639C21D42C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 be41bb861b06b3d2ff8952cedd0103edc25e7631de3b14e8a76f5738e5ada5bc
MD5 d673f69e5a0db62aba65a7b3b984e077
SHA1 a014b1a257575194793240ff0d19e37119956aa2
SHA512 bcebeef173212c1985804cbb82ad735fee4d8afe8adca13708cebd6344db2509a7ef5176fcadd1b02d1e542caeb2df44aebf3f8a400d08c1afb500d2da665858
SSDEEP 3072:0/r8meOVKHWRzQQK4xPtv3iebGXGy4WZm0U3Qw/xLANk0mUW5GmRntSFCjEEN2:0/r8CVKqnZo2ynZJUrOk0HOGm/SFyEEw
TLSH
T1741423D7AE378A75DCDE9395B26E9C01C815108FE05EF5CD62C49B2D11EA08C233AF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 d9c038cf1df43282a97498796446d34005f6337412dea48b02b9070b50cedf99
MD5 cef8856aab8d939b3072b9a0b331ff52
SHA1 3af167a2b9489adf28140dec28f26076964c3569
SHA512 a68108f0c7b8a304d2e4fe6541d91ff051982f8a51fbb32390dd4eba3f0611e0208eba1a20b755a8846c8b419a05261aaffe5bc6eb404c48b65f885808389313
SSDEEP 6144:0g4r8CVKqnZo2ynZJUrOk0HOGm/SFyEEw:0vbfO2yQrOjuGdF2w
TLSH
T1341422EAAD334975CCEF9758B12E7C018C61519FE05EF9CD71849A1921DF04C1A3AFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 9ace82d1b8931a6996e5b56a2d95b381444d61ffb867581bcc10b439545a0a0a
MD5 2a794286ac657c14f5fe0c616c50ab14
SHA1 05c549b765f1430d51caa85adfc739920a0eaa3c
SHA512 246da5eabaf41446ba443a4bb1420b86817147dfab949d79cbe884cd896b88a37d112d73f2ef2fffcc8c9d298372c7119e14e24aac40b4ec3fd25ab6f8e263f8
SSDEEP 3072:0Wr8meOVKHWRzQQK4xPtv3iebGXGy4WZm0U3Qw/xLANk0mUW5GmRntSFCjEEN2:0Wr8CVKqnZo2ynZJUrOk0HOGm/SFyEEw
TLSH
T11E1423D7AE378A75DCDE9395B26E9C01C815108FE05EF5CD62C49B2D11EA08C233AF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

770096997

Path C:\Users\Admin\AppData\Local\Temp\770096997
Size 138KB
SHA256 a3b25b6c6fb863c933842d223fb6337c1f1e9bfdcc6d46de209a1f9a700644aa
MD5 732e898226012779dd14bf2d71bd0ab1
SHA1 f157271d74c2369975264b161ac8eac99e80af4e
SHA512 ac83eff8a0082e368e6b3800d548ce972a26eef5784af435a368e1c3dfdd3c8f1f944858adef0d63c184d822dbec1669f841321253868197cdf3d272785ffd6c
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OFpX6iq2Vump2wkn:zeuvBnhJsueMEGvIW1DcP2OjNVump2nn
TLSH
T1C8D3974B3A743102EDE59A721CE051BB5E3CB16D8F5595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ytnwffef.z3l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ytnwffef.z3l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-114-0x0000029072600000-0x00000290727A1000-memory.dmp

Download

memory/3104-65-0x0000000000E00000-0x0000000001A57000-memory.dmp

Download

memory/3104-85-0x0000000000E00000-0x0000000001A57000-memory.dmp

Download

memory/3104-82-0x0000000022240000-0x000000002231C000-memory.dmp

Download

memory/3488-117-0x0000000008240000-0x00000000088BA000-memory.dmp

Download

memory/3488-171-0x0000000001190000-0x000000000126C000-memory.dmp

Download

memory/3488-70-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/3488-68-0x0000000005500000-0x0000000005522000-memory.dmp

Download

memory/3488-78-0x0000000006070000-0x00000000063C4000-memory.dmp

Download

memory/3488-79-0x00000000064D0000-0x00000000064E0000-memory.dmp

Download

memory/3488-80-0x0000000006640000-0x0000000006742000-memory.dmp

Download

memory/3488-67-0x0000000005530000-0x00000000055B2000-memory.dmp

Download

memory/3488-64-0x00000000058D0000-0x0000000005EF8000-memory.dmp

Download

memory/3488-84-0x0000000006800000-0x000000000684C000-memory.dmp

Download

memory/3488-83-0x00000000067D0000-0x00000000067EE000-memory.dmp

Download

memory/3488-62-0x0000000002C90000-0x0000000002CC6000-memory.dmp

Download

memory/3488-105-0x0000000006D60000-0x0000000006DA4000-memory.dmp

Download

memory/3488-193-0x0000000001190000-0x000000000126C000-memory.dmp

Download

memory/3488-112-0x0000000007B40000-0x0000000007BB6000-memory.dmp

Download

memory/3488-194-0x0000000005270000-0x0000000005282000-memory.dmp

Download

memory/3488-190-0x0000000005360000-0x00000000053A0000-memory.dmp

Download

memory/3488-69-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/3488-118-0x0000000007B10000-0x0000000007B2A000-memory.dmp

Download

memory/3488-172-0x0000000005270000-0x0000000005282000-memory.dmp

Download

memory/3488-173-0x00000000054E0000-0x00000000054EE000-memory.dmp

Download

memory/3488-125-0x0000000007D60000-0x0000000007D92000-memory.dmp

Download

memory/3488-126-0x000000006FF10000-0x000000006FF5C000-memory.dmp

Download

memory/3488-127-0x0000000070670000-0x00000000709C4000-memory.dmp

Download

memory/3488-135-0x0000000007DA0000-0x0000000007DBE000-memory.dmp

Download

memory/3488-136-0x0000000007DC0000-0x0000000007E63000-memory.dmp

Download

memory/3488-137-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Download

memory/3488-138-0x0000000007F20000-0x0000000007F6A000-memory.dmp

Download

memory/3488-139-0x0000000008080000-0x0000000008116000-memory.dmp

Download

memory/3488-140-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Download

memory/3488-141-0x0000000007F70000-0x0000000007F7E000-memory.dmp

Download

memory/3488-142-0x0000000007F80000-0x0000000007F94000-memory.dmp

Download

memory/3488-143-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

Download

memory/3488-144-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Download

memory/3488-145-0x0000000008010000-0x0000000008032000-memory.dmp

Download

memory/3488-151-0x0000000008E70000-0x0000000009414000-memory.dmp

Download

memory/4620-16-0x0000000022680000-0x000000002275C000-memory.dmp

Download

memory/4620-2-0x0000000022680000-0x000000002275C000-memory.dmp

Download

memory/4620-3-0x0000000000BC0000-0x0000000001817000-memory.dmp

Download

memory/4620-4-0x0000000000BC0000-0x0000000001817000-memory.dmp

Download

memory/4620-15-0x0000000000BC0000-0x0000000001817000-memory.dmp

Download

memory/4620-6-0x0000000000BC0000-0x0000000001817000-memory.dmp

Download

memory/4620-0-0x0000000000BC0000-0x0000000001817000-memory.dmp

Download

memory/5040-21-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-19-0x00000000220F0000-0x00000000221CC000-memory.dmp

Download

memory/5040-152-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-20-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-188-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-23-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-227-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-216-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-196-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-17-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-174-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/5040-214-0x0000000000520000-0x0000000001177000-memory.dmp

Download

memory/6084-111-0x0000000000FF0000-0x0000000001C47000-memory.dmp

Download

memory/6084-115-0x0000000022A40000-0x0000000022B1C000-memory.dmp

Download

memory/6084-116-0x0000000000FF0000-0x0000000001C47000-memory.dmp

Download