2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a

Analysis

max time kernel
149s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe
Size 1.7MB
Sample260810-rm2zhawthv
SHA256 2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a
MD5 4e103369276ff0b62a8ec99bd95dfd69
SHA1 a8d5d0882d133721430c6e437b1222b40fe7aa4e
SHA512 adc35b641a83d7d320dd77e278b84a96454c94f60377ee7297e0bbb00ce97c1d4fbe733a3fb7206c2e5182855e6401810374cd846d6363f534bff2e86f24e7a0
SSDEEP 49152:2S9ZGKd9rfG8GcW2wdgVSSnfYQrGnHZpBt74jOkLy:9GMTcYGHZHdIO
TLSH
T15385D01DF38D12E8D227C234CBA26232E3B578550765BADB069AD6152FB39D02F7B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

collection discovery

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3684 set thread context of 2164	3684	2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe	89

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5256	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2700	chrome.exe
2700	chrome.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe
2164	jsc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	jsc.exe
Token: SeShutdownPrivilege	2700	chrome.exe
Token: SeCreatePagefilePrivilege	2700	chrome.exe
Token: SeDebugPrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	2700	chrome.exe
Token: SeCreatePagefilePrivilege	2700	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2700	chrome.exe
2700	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2164	3684	2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe	89
PID 3684 wrote to memory of 2164	3684	2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe	89
PID 3684 wrote to memory of 2164	3684	2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe	89
PID 2164 wrote to memory of 2700	2164	jsc.exe	91
PID 2700 wrote to memory of 4088	2700	chrome.exe	92
PID 2700 wrote to memory of 236	2700	chrome.exe	93
PID 2700 wrote to memory of 5256	2700	chrome.exe	94
PID 2700 wrote to memory of 3936	2700	chrome.exe	95
PID 2700 wrote to memory of 1568	2700	chrome.exe	96
PID 2700 wrote to memory of 2852	2700	chrome.exe	97
PID 2700 wrote to memory of 6104	2700	chrome.exe	98
PID 2700 wrote to memory of 1520	2700	chrome.exe	99
PID 2700 wrote to memory of 2604	2700	chrome.exe	100
PID 2700 wrote to memory of 2484	2700	chrome.exe	101
PID 2700 wrote to memory of 4340	2700	chrome.exe	102
PID 2164 wrote to memory of 3936	2164	jsc.exe	95
PID 2164 wrote to memory of 3936	2164	jsc.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe
"C:\Users\Admin\AppData\Local\Temp\2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc979cc728,0x7ffc979cc734,0x7ffc979cc740
      4⤵
      PID:4088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,318282476799421477,10814827564940165889,262144 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --force-high-res-timeticks=disabled --metrics-shmem-handle=1980,i,1725752220515070159,16078464819662174697,524288 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
      4⤵
      System Time Discovery
      PID:5256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,5612692722830112128,2261199632250824184,524288 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2836,i,1818342378430799588,13277659896822162004,2097152 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2840,i,7507253119225949751,11058245058116735453,2097152 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
      4⤵
      PID:2852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3132,i,6105230815152160881,4034804200781874304,2097152 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:6104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,2763045246832345971,468032717051537925,2097152 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:9
      4⤵
      PID:1520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3972,i,3127287162040838577,656011244294879482,2097152 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:9
      4⤵
      PID:2604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4324,i,2976207209528472220,17085336848135773122,2097152 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n" --force-high-res-timeticks=disabled --metrics-shmem-handle=4380,i,17542659302499352414,14271781727562748737,524288 --field-trial-handle=1924,i,16599062125799661739,7817608869228840418,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
      4⤵
      PID:4340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Crashpad\settings.dat
Size 40B
SHA256 28c91652c4e5cc5225a2f56669e6cf713b17769b520cc6f12869b0989e82c481
MD5 979aad49219a62339a56455b322665ff
SHA1 a3dc64e4ab1909d16457414692d2702c6c1d82f1
SHA512 9d7ede808a4bce8537be25d541b0f4ebe42da294f382dc1383e61d8b9ef103fd5ab72b1152aadfd0a49d25d9dd32c5f2ef4b43ec7a3e35798c57b7886b9674f6
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a4289f3bb0fa9a9f2836abdc3c8e3c4673fa0279055c84fd01fb568b172e9b6b
MD5 40d76d02bf345b1b3ba05d0595cf708c
SHA1 647da4a43c9b051559cb7055a8fcbdf5873a372e
SHA512 aed64a20e8991d7254a1301072f97b8706551a0312f5f5bd8bd78b5a87f57f2314092bf2938c1a20419beddcc5d09932b4039d507900840eee25c5288c1912fd
SSDEEP 6:/FoEXEL3Sq1MNCGEEHW2rSv/1wTj1h2e14kEX0G/skllm+i1hK:d7XY3SOkCWHW2Q9wTIkE0G/t/m++h
TLSH
T198132E3CAEC22D07C3C8247C270F2B7043B1C4A88A080B037EA0B832304833F804B900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0a6400adffc9b97172ee5ffe0901bae655a4eab876be6ae6526886e51c392d61
MD5 07ebc37931e929882aaf1ad14b92cba3
SHA1 1852de1bd126912c599ccad9e52b3fa82d3a779b
SHA512 cd25323633884070e3fd97fefec77052b30a6bc47c2a1289882cbcbb5a4f01f0cabea500b3f3650fead9f41527a8da9e36e8d16ea75cb3b187125b4bdd61ee69
SSDEEP 48:2fl4Yqts5P3zlblQFG+yM1Xg4XfUNlMmXJ2dVEPLVBKWwtl:QVgsJhblQFHyug4fAljeVOLHKWol
TLSH
T18B44D8F71C05DEC6EA15CBF85D01A23C8E3252162CAAFE7AF53444B20251AE732386B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e5b8b4bdd49d1d310229211691bf2d1d000426af2ac2a6e6f5b8f1582fa0aece
MD5 d65cd21ee8dab291f14667490ad71d3d
SHA1 39990b21088d4fe243bbfc04eab2d51225d0931c
SHA512 81b3fafbd79f0411222f5c490287807957a77cfc745338ce01d204f238880fc7c6adc8db7e8346453a798c8254716068e205ea9c17105b0efbcacfed136d6283
SSDEEP 768:5UfDPLSgcRUv++q4KUfDPLSgcRUv+Rq4FUfDPLSgcRUv+8q4EfDPLSgcRUv+Xq4j:KqbqPq+qs7zd/RIz
TLSH
T1B9165DE64F247982E685EFB0BBCDED1C3CB03295EC935892F51291794AE0FC45B8416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 4bdfea0b360307b7d4362fbb4a12062d819eca420fc13110a20001a658ee21d1
MD5 a5891c6feb96bd6c89d7472eb055725a
SHA1 548c5a1327c33e5f0d694f0ad3b08446f08bb2e6
SHA512 535ed8fb5b3af58123c5a9d938b40f505170eee72da68611d60b9b71501da4f665ef484618fec7840747c226aa7a34b3ceb93f57195066b45a6bf91eff8a9bf8
SSDEEP 768:GVSelbXRYpNogI7kCdi6E4iBqqrBxaafSIslgMFZTr36Is1Sx4J:3eLV77kog/MqrZfzgL33s1rJ
TLSH
T16503F1F5CC5EB39EB3568EA18B2614DAFADA88717C40D550B1C0990D8E06EF6022D7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 c5cfcfe10aa1686b7c43575ee31c8972ae2d0d05cb8d71f87892455e4a1eec9b
MD5 075110f361981db0c8637c9889ee8a18
SHA1 05e2bd96edb12c09b9bfae0a8ff1e19abd10bb27
SHA512 3af2fdc73bcf4078b3e0e945bd74c3ede09008a34033698ce297de51309351d34bbbe9740ef76eb6dfdf585496d6c51faa990d51a5fa9f2f60ef60a276eff8bf
SSDEEP 1536:4W7X6PCIvB5uKamkCf8G1WzU2eZcypBE4QfT5BRsxeGvjqtS:4W7qac+jGR5ZFfQjRFAjL
TLSH
T16363023B02F8D791488425E352ED13A657F783ABE4FF744DE26801D211683FC6672DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Cache\Cache_Data\index
Size 256KB
SHA256 7b4ab54e7812a5c0698b483a3c7bac04eafff23424b5cf0f23a8c522348080bd
MD5 1c47e047f7b4d8eefef28f5fd830bdcf
SHA1 f21da3a6b636a622974b4752e83ebeab0dd1b9c9
SHA512 147a492c2a433b4c34dc52519f3e39a593f6249a17a1e1b546fc9ad32676ea1440bc6713675fee1a8f6074fa063823e05f0b817ef4b33a6c1dcc548851d58b64
SSDEEP 3:LsLllFlklNllklkXlKxtBillLll/njNtlmNtl3Nl/lgl5llll/9lXl+ll//:LsRa3lPWBGdkNHUlllUlt
TLSH
T1674401AE9385AE1AC6C546FD85478B64B778C809DB8F8743270426203CC57D46E0F1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 1d840bbee6306b2087022805eddf8dfa3975b0751deb160a8fd5cb8a44e9e7ef
MD5 e571104af7fb3eaecba7b5d86c51a130
SHA1 aff23be59a177b636321ae6600ac14fa2ffecc71
SHA512 e625a05626d0a9495af7c039683f4881bb5d41502ba8ec0d002f3bdc095fcd4263acb5e564adabc04d2f16636241c37ca1a84dbf10a09461f0fa507550fe53f5
TLSH
T146E02B81C64D1F1DD32D96F7CDA603054B1A43C829BE3603A981C6C233129742258133
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 9c183876a0801be52d7b0ce6a05509a12a196304bc05328be64f2a7276642935
MD5 5c78ce04a02cee35c94c1d032418ac20
SHA1 824051174f12c94babd942a06c26d312e932de83
SHA512 d321b51afcf33392dccd2146d7678b717bc959ede47f97770c4789d42501185ceaab85ba77ab0d2b3894ed23b7d78f32d8684679cea9cef7a4448c6fabf6e69c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\DawnGraphiteCache\index
Size 256KB
SHA256 13baee40323544bddf391ad231bb30a467a847073ac0c19692a84255c28716a5
MD5 a89b150c6f3161bfa8b5c37520a23151
SHA1 e13a638152c47c1452b2d41772575b94fe5abd6d
SHA512 93d8448d529336b09634c4610331c90e377f49b1eb767094a31dc43b3f066aad5e2577ea68ff1535101d5c20db6c3920f3fe7c634d39e09f1aaaf24a7e4cc96e
SSDEEP 3:LstlNllklkXla+ltl:LsX3lPa+Xl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\DawnWebGPUCache\index
Size 256KB
SHA256 3e40a67a1b4473f91a2a592dd8f3f9d905a7bc86d6e0ef203a07a322ba7b9545
MD5 7094f88854bb17e6d08ae3866df2ca61
SHA1 2a536cf2fccfab78e777a0c40f2910a4e0ea003a
SHA512 927402e5d47dae94b0d8d666c4d6842783adb0c944ecc6435eab1e42e0fcfed9c4ac56b40383e64981e1d1fb00bbb11fca30b1302f4dfe08e829502dc00fa14d
SSDEEP 3:LstlNllklkXlKLql:LsX3lPKel
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\GPUCache\index
Size 256KB
SHA256 04e9a12c1071c49d697d0c2a7e88a184645f0c50281e4e0672f49c6eeebd8730
MD5 4240b73bfab9c8681ed5518279469627
SHA1 4c7f85661795209293134cf94f8509fa8c2591e7
SHA512 7816922d9e716dab4feff4fab2a07d6bfeb62d4c4f6f25163a7ae20e5e080180d562b1c12e00e42beb59364c30514165d66e2912a837b67410dd0fefbbf37690
SSDEEP 3:LstlNllklkXlwx/l:LsX3lPwx/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 7bc631075adec9e9896bfa227397551b06392bde24fc141721dbefcb1288ac7b
MD5 3599935d99e4c4e86954a25c28ad8751
SHA1 6ea8fb409a885b48a4098b1616ce73778f6e1839
SHA512 6617c2f72d5a6c4bc29c6cc0e4d9f7ad7464151866e244fde63ebf49a07e02f39e7df41d748b3e00969f6a1f70798fc0694ec2a80c3b4dd8eb7ca5f0cee4e9b7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 aef06940c64dc582fe42c20eaaddcf05d75d473d4e9f8a902c14bc7be7e721d8
MD5 c82a46738a9e63fa7c0fcbee669e5b96
SHA1 070f84b0d5487fa5571948e18f780269e5dcf772
SHA512 c4fea7bed653e6c6e9dbdc4d8522ca0d2c8cd0f0802e49e9cb0555d816b283d380541a888c1cfa320fff520a9dddd2fbdd42cd4646d7c11224c5fe1321f7f68e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\GrShaderCache\index
Size 256KB
SHA256 99a2735df0efbdcf5a751953aee88362689d282c82c958d5e9af905af9e58b03
MD5 3398e360c9c3a3b54c0c0ccf348066f8
SHA1 676bdc5e47c9d5f780a59edad4ce898827ab9953
SHA512 31d301945d74b412fc7f046974b8c9c95a68228cd9b016a741ef3c68692f2a776966042d3620d28a8309bc8be05e98b4f72c13bc72e838b90f8911411c84fb0b
SSDEEP 3:LstlNllklkXl4/SKll/l:LsX3lP4/SKll/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\GraphiteDawnCache\index
Size 256KB
SHA256 2c74950b6a25a0666229778c2063fcf3d183eac4613f3d31bcf8ad5e5d896cc7
MD5 0352b92b6962b72f78948b8d98201f04
SHA1 c0b45e399d1921b2d00a36663c78439d8bf55b2b
SHA512 da255427d8c3b29db340fd8ef0b14838db9ed8973794b9b22ff226bc21d6644a3ad176126aead50826e409ebd15625f6c93bf4f89ab70f63f38bf9f6cbbd8a32
SSDEEP 3:LstlNllklkXlx7l/l:LsX3lPpl/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\4egf22g5.o0n\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

memory/2164-16-0x0000000007630000-0x00000000076C2000-memory.dmp

Download

memory/2164-15-0x0000000007BF0000-0x00000000081AA000-memory.dmp

Download

memory/2164-156-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-217-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-155-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-216-0x0000000007570000-0x0000000007582000-memory.dmp

Download

memory/2164-113-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-19-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-18-0x0000000074532000-0x0000000074533000-memory.dmp

Download

memory/2164-17-0x00000000075A0000-0x00000000075F0000-memory.dmp

Download

memory/2164-3-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/2164-159-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-14-0x00000000073C0000-0x0000000007426000-memory.dmp

Download

memory/2164-13-0x00000000072A0000-0x00000000072D2000-memory.dmp

Download

memory/2164-12-0x0000000006E50000-0x0000000006F42000-memory.dmp

Download

memory/2164-11-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Download

memory/2164-10-0x0000000005860000-0x0000000005938000-memory.dmp

Download

memory/2164-9-0x0000000005530000-0x00000000055AA000-memory.dmp

Download

memory/2164-8-0x0000000074520000-0x0000000074CDC000-memory.dmp

Download

memory/2164-7-0x0000000000E00000-0x0000000000EC6000-memory.dmp

Download

memory/2164-6-0x0000000074532000-0x0000000074533000-memory.dmp

Download

memory/2164-5-0x0000000000E00000-0x0000000000EC6000-memory.dmp

Download

memory/2164-0-0x0000000000E00000-0x0000000000EC6000-memory.dmp

Download

memory/3936-154-0x00000217D5EA0000-0x00000217D5F92000-memory.dmp

Download