salatstealer | 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-es
resource tags

arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
keshka.exe
Size 3.4MB
Sample260420-tlfe8aat2p
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 16 IoCs

resource	yara_rule
behavioral2/memory/4996-2-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral2/memory/4996-3-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral2/memory/4996-4-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral2/memory/4996-6-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral2/memory/4996-14-0x0000000000E40000-0x0000000001A97000-memory.dmp	family_salatstealer
behavioral2/memory/2484-21-0x0000000000890000-0x00000000014E7000-memory.dmp	family_salatstealer
behavioral2/memory/536-22-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/536-23-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/536-58-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/536-90-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/1452-125-0x0000000000E80000-0x0000000001AD7000-memory.dmp	family_salatstealer
behavioral2/memory/644-153-0x0000000000700000-0x0000000001357000-memory.dmp	family_salatstealer
behavioral2/memory/536-177-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/536-195-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/536-202-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer
behavioral2/memory/536-216-0x0000000000F20000-0x0000000001B77000-memory.dmp	family_salatstealer

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
49	3128	powershell.exe
53	3128	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
536	smss.exe
2484	dwm.exe
1452	smss.exe
644	smss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "C:\\Program Files (x86)\\Windows Photo Viewer\\dwm.exe"	keshka.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4996-0-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral2/memory/4996-2-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral2/memory/4996-3-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral2/memory/4996-4-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral2/memory/4996-6-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral2/files/0x001700000002b6bd-13.dat	upx
behavioral2/memory/4996-14-0x0000000000E40000-0x0000000001A97000-memory.dmp	upx
behavioral2/memory/536-16-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/2484-19-0x0000000000890000-0x00000000014E7000-memory.dmp	upx
behavioral2/memory/2484-21-0x0000000000890000-0x00000000014E7000-memory.dmp	upx
behavioral2/memory/536-22-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/536-23-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/536-58-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/536-90-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/1452-106-0x0000000000E80000-0x0000000001AD7000-memory.dmp	upx
behavioral2/memory/1452-125-0x0000000000E80000-0x0000000001AD7000-memory.dmp	upx
behavioral2/memory/644-151-0x0000000000700000-0x0000000001357000-memory.dmp	upx
behavioral2/memory/644-153-0x0000000000700000-0x0000000001357000-memory.dmp	upx
behavioral2/memory/536-177-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/536-195-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/536-202-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx
behavioral2/memory/536-216-0x0000000000F20000-0x0000000001B77000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\758712c5-97d5-93a9-2ab6-3cad5e19c597	keshka.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\dwm.exe	keshka.exe
File opened for modification	C:\Program Files (x86)\Adobe\758712c5-97d5-93a9-2ab6-3cad5e19c597	keshka.exe
File opened for modification	C:\Program Files (x86)\Adobe\smss.exe	keshka.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\smss.exe	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe	smss.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keshka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
680	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211750710735733"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4996	keshka.exe
4996	keshka.exe
4996	keshka.exe
4996	keshka.exe
5820	chrome.exe
5820	chrome.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe
536	smss.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 536	4996	keshka.exe	79
PID 5820 wrote to memory of 3856	5820	chrome.exe	83
PID 5820 wrote to memory of 680	5820	chrome.exe	84
PID 5820 wrote to memory of 1916	5820	chrome.exe	85
PID 5820 wrote to memory of 1916	5820	chrome.exe	85
PID 5820 wrote to memory of 2640	5820	chrome.exe	86
PID 5820 wrote to memory of 2640	5820	chrome.exe	86
PID 5820 wrote to memory of 5144	5820	chrome.exe	87
PID 5820 wrote to memory of 3872	5820	chrome.exe	88
PID 5820 wrote to memory of 5144	5820	chrome.exe	87
PID 5820 wrote to memory of 3872	5820	chrome.exe	88
PID 5820 wrote to memory of 4132	5820	chrome.exe	90
PID 5820 wrote to memory of 4132	5820	chrome.exe	90
PID 5820 wrote to memory of 3032	5820	chrome.exe	91
PID 5820 wrote to memory of 3032	5820	chrome.exe	91
PID 5820 wrote to memory of 5392	5820	chrome.exe	92
PID 536 wrote to memory of 3128	536	smss.exe	94
PID 536 wrote to memory of 1452	536	smss.exe	96
PID 536 wrote to memory of 644	536	smss.exe	99
PID 5820 wrote to memory of 1712	5820	chrome.exe	101
PID 5820 wrote to memory of 4344	5820	chrome.exe	102
PID 5820 wrote to memory of 1440	5820	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\keshka.exe
"C:\Users\Admin\AppData\Local\Temp\keshka.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\Adobe\smss.exe
  "C:\Program Files (x86)\Adobe\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- - C:\Program Files\Google\Chrome\Application\smss.exe
    "C:\Program Files\Google\Chrome\Application\smss.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:644

C:\Program Files (x86)\Windows Photo Viewer\dwm.exe
"C:\Program Files (x86)\Windows Photo Viewer\dwm.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa65f2c728,0x7ffa65f2c734,0x7ffa65f2c740
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,9651257573022093736,10731015393635781663,524288 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,17841272666176000317,9828286193194154378,262144 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,14716181707333592480,7940089167956125492,524288 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,16619274214275797966,10307188915223343754,2097152 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,10859947115066621556,9377577767602894785,2097152 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,7668631162994598721,10971209503703776999,2097152 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,6488156048930019004,5703977461999547321,2097152 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,505109051273334931,7029135665466233706,524288 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,8944742609734440759,1679627759490500405,524288 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,14863191016434449291,3452499924464490380,524288 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,10703828690374064230,389891051138916203,524288 --field-trial-handle=1992,i,17580961641115841541,4435818362657308926,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:1440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\Program Files (x86)\Adobe\smss.exe
Size 3.4MB
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b42c12ceddc1dac68c3f7a26b491c1c2d2cd95b3799410f620407303aa7f9ef0
MD5 f0d5423d58f2ac830489841ca474d18b
SHA1 ebfacce727d20dd282e4742564bbc2c8af284ce0
SHA512 f49cfe00f005d9b8cce2a6caa856976464b0af581c80f1b84b830ab5f355134925b7ba8a44e9c573c210c05db41ca92cad28ec65d21a3015f97c05f89d115ada
TLSH
T19DE0EDAAC821DC2B08F90B5C6865464AE648135A2A90899F3F3CA2498FB163A09D985C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c598419725ab8e44b5e113f66c526bf9415370f92ba6f68e7e62f724fe29061b
MD5 3d69856d7aa433b045297272f2f8a0bd
SHA1 641965f47694563cf80560cd5302b811aee62512
SHA512 ea8bd89354245f6ca82096c145c452a6209c0b80c81a8a343aeed1ebde237561cec05cf3a9bbb92c1d7b46f753c5e8ad43422dd74c6a5e9c09b754231af7e5ea
SSDEEP 192:dRcxffwQ/n1Pv7XpAPRp2A9BHsb+WNna30Kk5l3ueDbzVyIsnAUgtaJ:dRcx3wsH7UX/DwU0j5lb8
TLSH
T14642E81DBA14783B9CC7D229FD65BB57D7F5102160952E88DAFCCA2C14D76CE222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5767a4d345af36e5be7506a6e6868468ab0bd7b52ca4f6631a012ca25c797cd3
MD5 2d3e2a659202b601b2f2906355ac8e11
SHA1 43d51502178371c9833275fb7411a69cef683511
SHA512 04f790cbb94ffc6a65ebce931661c980188146c9a7881b743b65b5f0d41539f544ee40a2556b29efd5203d066a431c3e495133c33fd58bdeb893bbf86b347cbc
SSDEEP 192:dRcxffwQ/n1gv7XpAPRp2A9BHsb+WNna30Ak5l3ueDpzVyIsnAUgraJ:dRcx3ws87UX/DwU0Z5l5e
TLSH
T16542E81DBA04783B9CC7D229FD65BB57E7F5102260952E88D6FCCA2C15D76CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 797a66035ebf115e19a5c852a83575a3420ad1174c539bdb1d6a15141e38be5d
MD5 09b2266a27756bedb97ee23174baf8ee
SHA1 d10af69229e909eb16528e586aa902eef36c8c57
SHA512 d537085d84fe3a777bf416296b5a4eb52280d380597629a157a7e11eba6f6a7e3cca2f20a2b02b338d21b66514cc8e1c80efc300f46d7afb30defc2d7de663b1
SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLILcmfa7XOD0z+ErU3W3H1WTStAAW:460v7KxkXqKf/pUZNCgVLH2HfgsyX7pm
TLSH
T16F72F867AC4C9A770F94C68DD827BA4FADB5014B64D9886443FB581903C5ACB150A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8604e74ef3f73b0e1fcbff58b4ae49f4c4efa3c0a4e2205366795496c8c1f1d5
MD5 bfc59cfb9a1c9b8cbc8bf682d7d5c231
SHA1 957580c8b19bfd6f86786a45baf8ca393a83a816
SHA512 4d69ee46584b2736dc25ff3158dafe13caea65e0f368c88fab1f0e6565fe8a0ac8069ad70b810685b3e793c09e67cbd68e2e1ec94c4de8ba4646e166e380fe2d
TLSH
T180B0126080029943C80302F611C2048C3214DF1097052305E3E06AF198261D08134190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599f63.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599f63.TMP
Size 96B
SHA256 b97e26595994b289522a7d3dc0a438f56f9ea9db512340492ebf11cb5281c1c0
MD5 4fea868866c5ddf1b7ac3a9bdd4710bf
SHA1 f1eb9ba87b45ae068ade9e79deced58509d9339f
SHA512 94a805940c87607dbd2ab99a0170ae6b79a53f6dfb839f8f5857bb9c971246871ff1b83473d302c3e63d638d5b296e7e2e8c93d8840ac9741f7fb48cde97c7e0
TLSH
T1C2B0223CC002A322C00303F03880C0E8B020EF20CA03020283E00F22CC3022008B0020
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 7cf8a6ecae5179af7804d8d94d04f344396daa3b3c78f0fc9781f1b32ebdfa7c
MD5 50a909f8a8d34fa33ac14116565b1f45
SHA1 fbb58a8d8d9ec8816e9ed83be5925a57504ec784
SHA512 504ea3495003e67f68f522611ed2a0198147c6561667f31fcc658065951391b7fd2f411f548ab7adb6baa82e7b8e6c16cfeda2327294be4b449daa369c42dcbc
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OepX6fXyCRlqqVumrYwkAb9Md6:jeuvBnhJsueMEGvIW1DcP2O22Vumcnxg
TLSH
T1CDD3964B3A743102DDE58A721CE050BB5E3CB16D8F55A5D428B620688EF6963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 229bd7ed533dcd2fc5271db25c7849fcbd819914ed2846d85141518fdf96a215
MD5 214586a339263099e82c36ea5ae81de2
SHA1 b17254643c62e90267cb1e1db4bc034c81649202
SHA512 cca6c04f7cdc39ba80fe51bcb2029845304f56b33e3082823fa5e9f36f213a5d5c7027a92f48fb3bdef1cea1a9f4b73b23862ce4d668aa04144db8177a38b90b
SSDEEP 3072:or8meOVKHWRzQQK4xPtv3iebGXGy4WZm0q++J3qUQm08KMWF0bFTcVHr6z/:or8CVKqnZo2ynZJq++JjcMW2VcVLO
TLSH
T11914229AAD2BAD38D5CFD399D01F8CA544E194DF8514B29D21C39F2E04FF244222FE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 ec8da1c95a33618da87568ba0599b4356ded0038c1e15cbaf546e51431358d50
MD5 3d47f52e5b9b97cadb7d403f37d2fd8d
SHA1 1b2ea2da361b15673d1af7cd93aa35c06bf9f588
SHA512 5e7aa34f52f47a03290939798bca208707ba1d79fea5b683118eaefc0ff7066b47a59273455cf0bdeb30a622c2d1f57b5a9d34e92dd40cb6898d54ccc708176c
SSDEEP 1536:aP/lKP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:D++J3qUQm08KMWF0bFTcVHr6z2
TLSH
T12A9302B9991F7979536BC2A690179CAC4DD3DCCE111421BC30C76F1E18BA392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 d78adae195dcc5e023de6a79d821e9f0458907bcf12e5076c76db81f831ebc84
MD5 4bfe9c88d283e73d99b0c87abf11c576
SHA1 cd9c2165359fca4cb7e1133593c7fa7256443c96
SHA512 9d92568867a120394904eff2fc60b96f82197f9c63d5e995ed8976fce2b056311442ed5232bb7dd871f53e575e26b25f40e78a6f0fef96ae719a79377b27de49
SSDEEP 3072:fr8meOVKHWRzQQK4xPtv3iebGXGy4WZm0q++J3qUQm08KMWF0bFTcVHr6z/:fr8CVKqnZo2ynZJq++JjcMW2VcVLO
TLSH
T12514229AAD2BAD38D5CFD399D11F8CA544E194DF8514B29D21C39F2E04FF240222FE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vhp3kbbm.55g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhp3kbbm.55g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-202-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-90-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-23-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-195-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-58-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-216-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-178-0x0000000025800000-0x0000000025E02000-memory.dmp

Download

memory/536-177-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-22-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/536-16-0x0000000000F20000-0x0000000001B77000-memory.dmp

Download

memory/644-153-0x0000000000700000-0x0000000001357000-memory.dmp

Download

memory/644-151-0x0000000000700000-0x0000000001357000-memory.dmp

Download

memory/1452-125-0x0000000000E80000-0x0000000001AD7000-memory.dmp

Download

memory/1452-106-0x0000000000E80000-0x0000000001AD7000-memory.dmp

Download

memory/2484-19-0x0000000000890000-0x00000000014E7000-memory.dmp

Download

memory/2484-21-0x0000000000890000-0x00000000014E7000-memory.dmp

Download

memory/3128-170-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Download

memory/3128-169-0x0000000007E60000-0x0000000007EF6000-memory.dmp

Download

memory/3128-111-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Download

memory/3128-112-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Download

memory/3128-130-0x0000000006C60000-0x0000000006CA6000-memory.dmp

Download

memory/3128-110-0x0000000005520000-0x0000000005542000-memory.dmp

Download

memory/3128-109-0x0000000005460000-0x00000000054E2000-memory.dmp

Download

memory/3128-156-0x0000000070390000-0x00000000706E7000-memory.dmp

Download

memory/3128-163-0x0000000007AF0000-0x0000000007B0E000-memory.dmp

Download

memory/3128-164-0x0000000007B10000-0x0000000007BB4000-memory.dmp

Download

memory/3128-155-0x0000000070230000-0x000000007027C000-memory.dmp

Download

memory/3128-154-0x0000000007AB0000-0x0000000007AE4000-memory.dmp

Download

memory/3128-165-0x0000000008280000-0x00000000088FA000-memory.dmp

Download

memory/3128-166-0x0000000007C50000-0x0000000007C6A000-memory.dmp

Download

memory/3128-167-0x0000000007CA0000-0x0000000007CAA000-memory.dmp

Download

memory/3128-168-0x0000000007D00000-0x0000000007D4A000-memory.dmp

Download

memory/3128-172-0x0000000007D60000-0x0000000007D75000-memory.dmp

Download

memory/3128-119-0x0000000005FE0000-0x0000000006337000-memory.dmp

Download

memory/3128-123-0x0000000006750000-0x000000000679C000-memory.dmp

Download

memory/3128-171-0x0000000007D50000-0x0000000007D5E000-memory.dmp

Download

memory/3128-176-0x0000000008EB0000-0x0000000009456000-memory.dmp

Download

memory/3128-174-0x0000000007DA0000-0x0000000007DA8000-memory.dmp

Download

memory/3128-175-0x0000000007DF0000-0x0000000007E12000-memory.dmp

Download

memory/3128-173-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

Download

memory/3128-108-0x00000000055A0000-0x0000000005BCA000-memory.dmp

Download

memory/3128-107-0x0000000004E90000-0x0000000004EC6000-memory.dmp

Download

memory/3128-179-0x0000000002AD0000-0x0000000002AE3000-memory.dmp

Download

memory/3128-180-0x0000000005400000-0x0000000005415000-memory.dmp

Download

memory/3128-181-0x0000000006390000-0x00000000063F4000-memory.dmp

Download

memory/3128-122-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/3128-120-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/3128-121-0x00000000065C0000-0x00000000066C2000-memory.dmp

Download

memory/3128-201-0x0000000005280000-0x00000000052C0000-memory.dmp

Download

memory/4996-0-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4996-2-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4996-3-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4996-4-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4996-6-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download

memory/4996-14-0x0000000000E40000-0x0000000001A97000-memory.dmp

Download