9025d2705a1ca25d0cd25490fb9a000c3495e12abfbf770d2313d729674cff26

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Godabeg1.exe
Size 808KB
Sample260816-agsp7sal2x
SHA256 9025d2705a1ca25d0cd25490fb9a000c3495e12abfbf770d2313d729674cff26
MD5 cd7827aef25647ba17733b67290dba93
SHA1 7010cf2cd0d08c6c4f2788aa5b5254cbaf14d513
SHA512 571dd941a489025a39b8d470a79b1cc4002cc7bbee3a012a638b387dcc7129efc4c14a475513a3a45a6ed7143a410ff832fe5b9dd21222dacf60dbaa2e8721bf
SSDEEP 12288:7svA/ta+jaN53u3jv3xEcSO1pTtjOji2ShkU3Had:7aK/aeDwO1pTtoVU3H
TLSH
T10405AF2B76A18F21C3455372C1C3490187EA96876AB7FB0B329513E61D463FEDE4B287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Godabeg1.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Godabeg1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Godabeg1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1292	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2548	chrome.exe
2548	chrome.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2836	Godabeg1.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2836	Godabeg1.exe
2836	Godabeg1.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	Godabeg1.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeDebugPrivilege	2548	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2548	2836	Godabeg1.exe	90
PID 2548 wrote to memory of 1040	2548	chrome.exe	91
PID 2548 wrote to memory of 6004	2548	chrome.exe	92
PID 2548 wrote to memory of 1292	2548	chrome.exe	93
PID 2548 wrote to memory of 4532	2548	chrome.exe	94
PID 2548 wrote to memory of 5436	2548	chrome.exe	95
PID 2548 wrote to memory of 464	2548	chrome.exe	96
PID 2548 wrote to memory of 4816	2548	chrome.exe	97
PID 2548 wrote to memory of 4156	2548	chrome.exe	98
PID 2548 wrote to memory of 2628	2548	chrome.exe	99
PID 2548 wrote to memory of 4672	2548	chrome.exe	100
PID 2548 wrote to memory of 2992	2548	chrome.exe	101
PID 2836 wrote to memory of 2548	2836	Godabeg1.exe	90
PID 2836 wrote to memory of 2548	2836	Godabeg1.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Godabeg1.exe

C:\Users\Admin\AppData\Local\Temp\Godabeg1.exe
"C:\Users\Admin\AppData\Local\Temp\Godabeg1.exe"
1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd1e09c728,0x7ffd1e09c734,0x7ffd1e09c740
    3⤵
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,8656398664277209018,17756692244499616820,262144 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:6004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,13319322167528498976,15216596657881252219,524288 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,16326552969873846580,11931266795780678702,524288 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:13
    3⤵
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,15398033010783431836,10887576813797879492,2097152 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2964,i,1849346358494087923,11405471594366086779,2097152 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
    3⤵
    PID:464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3184,i,6250652566100655283,12349130395491105058,2097152 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3212,i,10332691384832197768,15802856150560759999,2097152 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:9
    3⤵
    PID:4156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3984,i,6647731077258753362,2069864365722360182,2097152 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:9
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4264,i,16481827814396578390,17643738402091198244,2097152 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs" --force-high-res-timeticks=disabled --metrics-shmem-handle=4348,i,15520266023997178114,12326398195071944556,524288 --field-trial-handle=1888,i,8047740749613609527,12597964925685598038,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:2992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Crashpad\settings.dat
Size 40B
SHA256 5825067df4f64a789869ea5f090d50717b37d8354897d591c00a92e965c5b394
MD5 98b8c7bc832ae907c209653f5581f40c
SHA1 da8921cdfb2b385711dce3fa08572200e72a08ea
SHA512 67f16503ef0f7f9e9a9b6512f36366dcd1573fdc768e163500698e56a0dbd2a90c0f2fc96c17d9656b9364c91d0773685c1921442db99f80b800416529f3a54e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 904917727a7ad816cf2f8e27825f508d1594b1c82739bd0e1f9e9c8d6a75a555
MD5 d269c39606c8368f177f3b1595b6fdbd
SHA1 374d1aa519a7f4f52c466f7c59eb98a19346c7ce
SHA512 fd1fa559803adfd02ceb4dba4e6eb846219cad92cd50932568d49b00abf4060c31b1b307dfbd10b4035690a9c4eb84b1c117bfcbbcbf7f72723b393847916105
SSDEEP 6:/FoEXEv5gHOikNmN5gHOAtgtXrIO/q98F4kEX+aeHZUkll3Eg5/:d7X0guHNo5guLtXMIqe2kE+ae5l/b
TLSH
T17E135E3E89C20D22C2A020BC285B077493BCCA00D6264A5B22213CDA7A14202085AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6c7c6f3944f99bbf84f9584ccb41ab130431c8b6a509afa277f922115ecc54f2
MD5 b3b1c46162c5adc2730477b230e3b130
SHA1 9bdb95df854bcd50a841a565e2c95b52b71bad58
SHA512 e380c8877dd3d251e666345581a7de38df65bbc52881408fb913b6260c4bc4d724f924235988ec766e01930f8d56f2a30bb9a88d026f5484a787bd09edcd6541
SSDEEP 48:aflfYWIsHP3zlblQq+FiM1XgOUXUUMtMmXJ2dVEPLVBKWwtl:MwWIsvhblQ5iugOUUNtjeVOLHKWol
TLSH
T18D44A8F71C09DEC6DA14CBF82C41523C8E3292162C9AFD79F52944E20650AE771286B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 5289da6779bbc4e018e0eb1045335610575f1095de9f86eb6f17c6ea1cbb3ba4
MD5 ec5b24d31d9e2d6d5caf0ea7cc50835c
SHA1 344d19c1f29fa9af7f87cf9ea6284882c92b951a
SHA512 f2eb091c0e860b5caed5c379fd5761ea441e41f88c0c921fec2ec90d8be0732a5b7843dec64a5b146618fb3ba2d961d00c7ffded459c49334dec2388e6a89806
SSDEEP 768:gUfDPLSgcRUv+pq4EUfDPLSgcRUv+gq4lvDUfDPLSgcRUv+Dq4JfDPLSgcRUv+bb:iqoqQqhqh7zd/RAa
TLSH
T10E165DA24F24B982E685EFB0BBCCED1C3CB43395EC925882F52252794AE1FC4578517D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 3e82a3d7b2a034433a1906b32b94b73bb2352aad5ffcdd8cfa876b94d5ca06b9
MD5 cc2457cf53de69346c7928a31d48496d
SHA1 6f5bf7f7023aa2291967e1d2474c163d100346d0
SHA512 65736add87738770296ed9db41dd0d368f4c8a6480b287a6a258fd4d4b5cd586a2f69572e1f8804b380ea53ff493f4d31fb3286acb8a725698d0b6f15417484a
SSDEEP 768:qqXxQPZgtfBPGtj3jD6FghhtFk9mzcguZuCvYVhzGDh8BgOD0puLpGlzd:bYZA0/mFg1FFzpuZub728BgdCid
TLSH
T1B403F2917D1A515BC0D98E55CEB4C068252BCACD9FBDE3558BF9127B0209AA89740C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 3e3feae8ee4c6b2a9e3d614847664f7ba9fd1517b446fedce19caee08f409f3f
MD5 482bd2f4782f1ce7c01780a76cf53e23
SHA1 e8416e4acc981bc1ccd4905ea9401686f83608c6
SHA512 538997f10e965bd3a76f663120b5480f2f9a7b5314ff035b53d58845442a9f832137ee49067bcf05a0e43a8c454c0ac303b863055f850f72d6f0a16a4b4bc9d3
SSDEEP 1536:/VuOR3aNs67H5NUCJY/wHZn8m6+yfyMl7Zl6iFF3cld6EQjFShwG2rN:/F5abNUK1oKI7Zl6ibs6EQRShCrN
TLSH
T1A563125FA7AFC5CF5E983CB1597CF92B20C5014BF2B0B33CC04A70584A69797A8C6256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Cache\Cache_Data\index
Size 256KB
SHA256 518192f0083a80d277245e57fcb47365efaedfc41bbe16491c7bf8d40036a4c4
MD5 97fb533feef09909ba81b5b8bc917630
SHA1 d089c717163bffd406afbed577ac9d087a71fbe6
SHA512 3e7eea51d5b1cfc0868f53b4791bccd0b173ff3e43e0a7439a0c6152b669b04e506bc28210586e095818adf5abf04c34b66cc6eae48a6464e7f89dacf0fbbe49
SSDEEP 3:LsLllFlklNllklkXleUL/llollLll/n8ll//5NtlmNtl3Nl/lgl5llll/9lXl:LsRa3lPX/4CltBkNHUlll
TLSH
T1A644016E93856E26D2C802FD88478B6563B9C81ADA8F8B87171426606CC6B902E0F274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 6892ae2040b93f5f4c33a148bc005180f866d04ce287b81ecf7362913534dd27
MD5 41971d938dcaaf9cd7aaf6900b37ee5b
SHA1 691b78971e4fc74fe76e5cf7434c514d78d982a9
SHA512 6e20af8541edeeae50c48119f4ef066d60418e25c9cd968410f4d6cdeb2c580afe2d2ae0c7094d9742c21f6872389a6c1d73587440d573baae69d667d55fac87
TLSH
T1C6E02B91828D0F0DD32D96F7CDA603448E0A52C42ABE3A03A980C6C233128641288223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0e6fcd18bc6b7899ace50fecfebbfb66285f6cec17ed1587799c4ac84ac74730
MD5 3d15e75cf8e502c9fb77d5ebaf2ba05e
SHA1 eacc301f6b185e5055f5af7d303bfb9e30dca4ae
SHA512 f8f33d2493363a09873935622701a4c602972a40ceecc58f67fcab05f555bfbf033add963933bb414dd5525c6e57cd6a83709eec78cb18b17255d71845658e16
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 6ae23e6094678f6de629aeb25f4e4989886ea20c910b91f60502f3bf8ec3e20e
MD5 783194c7591bd66fcd5885dfe51aeef2
SHA1 f1847c15d6c8d8841de5a0f58e8d235d990c2572
SHA512 fed6f3df9cef701cd6f8c3bdd1e8cefb92ffc09fcd1d498dc44a6555da6ea24883eeb7885342ddde65bb141b606b3bfa37da92e5cfbbc1d1591ee2ab1121b683
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\DawnGraphiteCache\index
Size 256KB
SHA256 65f340808eea00d5ac82326cd531d95de112e887f346c442182526b44e158d15
MD5 04bf56c7500ddc146cce72f710afdc95
SHA1 675086faca6b3cfbb1a0890a02206995a13a05fb
SHA512 7df9c56912be344b743ba15d96ad8051e8dab06376f2f12149f93b6efb5bef563f04971a2ea96685a91beda1b35fa2b6749672f65aae3d0712d4e4f7521fb869
SSDEEP 3:LstlNllklkXlBe:LsX3lPBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\DawnWebGPUCache\index
Size 256KB
SHA256 925ec37c7c54672f9d1aeaaf0625d4a9bfbfd9a293348c20de2dd37211d59a9a
MD5 bc7ea479f4c0d0478a662ac7dd7163eb
SHA1 a59e32a3075e4a4947a58b387598f3dd8f2be606
SHA512 16a24e5287f49ff8420beb3d40983e97ebee9fff7a5bebaef5a2b2dd4a0ad57652decd5b25891aef7ecacf16f7300641174f2043a27f8e2334e08973bc9e5897
SSDEEP 3:LstlNllklkXlre:LsX3lPre
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\GPUCache\index
Size 256KB
SHA256 0922bf0202bf30e54896647e9e81e50f821e394a9adf40416f783a41ab2ef59a
MD5 f5dae20ac4a5929c4166d74c2ea490ec
SHA1 0fbac0b00b4c519fd89a8983bed4949378feeef4
SHA512 68af742540776491ef051de615ae4c4ec709e259813e991e0c7e568c6a9b3b5d0781b7664e0e880acb2f131e46282178690b89523911254d6835dae027430da8
SSDEEP 3:LstlNllklkXlox:LsX3lPox
MD5 SHA1 SHA512 SSDEEP

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 e83c383023a2548cc18482f531957f3a7eb485c247095f45d97584ef63cf27a1
MD5 1bcbac5973b74af70734e8478b7dab91
SHA1 7e8b22133a7cd287f020b6c555dd7ce95b471ab4
SHA512 1d2272d7602f61f4e7994d932ec466066dafa1cc99c8285fe455d785133c941c9fa42554716462ae09bb6912d3c81fcdebc572a6d129f91ff467479df4eadc67
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 9acc4e030b481fc8f61fe879e44fde9d8aee7955c8902c94d9b8c78e4f6c1376
MD5 cc8b39e7e1c12862b9c14144d7ab706e
SHA1 b46df1e4922d813e5881c16269c247797f46970f
SHA512 0830fa3d6fe6d833ff717e0f440fafd73e64cb4180e4805ba11d426521dddf78cf6d1bf07b3982c64291de024202cae2398070a0f98d617719a09bbf6c46e902
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\GrShaderCache\index
Size 256KB
SHA256 b249e68f53b79a94cf40dfcf74a9929365088f3c2ca92473677e4740244a6e83
MD5 b1f5c4535df200e3682816cd1561b0c4
SHA1 db327d9093e86ba611bd78cf8c5127fd0d38911f
SHA512 c632e8b22d72a93779bc88be9d91d740a5ed739311bde768a9be67f65c40d0e85917d41ed51a92a1777359932adab15d6046bb8ebb10aa92c52503f90c75adad
SSDEEP 3:LstlNllklkXliDat:LsX3lPiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\GraphiteDawnCache\index
Size 256KB
SHA256 afe129d844dab23c303acad92c31ce2463630e8428f61eff5675e057773603e9
MD5 c50486bfa41bad4dca6b7334508eff9e
SHA1 d920aaea86a0543c4bea63c79e594e44bb80ca8a
SHA512 3344eacb2bbb769fa5a8b2e88e6eb61d7f2d5bd4f2d142ddfa3d0d8b5989bc07135e90923174f35289697d07e378ef27896907c703554716d62403c0ffa6e2fb
SSDEEP 3:LstlNllklkXlKX:LsX3lPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tnawj5tn.zfs\Local State
Size 1KB
SHA256 ec0384e19f45f94a6e218f873d3ffacddf4ecd757edd171b0d1492cc3e4a7495
MD5 64184d55fad7c84981470eb3fca9f44a
SHA1 3de30c114223e4ca8665cab426f5f7ed1d8e4f0c
SHA512 bbe5ab497ae0456f2a17971545ae7ead492c7f7dc5b954e6a8717261460e96a3b9c008dad4d2883336faf121e931beaffbaf8b2740bc0be5abb30177689314e7
TLSH
T15D11A87028B8677368854A1DD853BAB70FB6A3278086C80D6EDD1A04017676D3626C36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2548-136-0x000001EA0CE20000-0x000001EA0CF12000-memory.dmp

Download

memory/2836-12-0x0000000074BB2000-0x0000000074BB3000-memory.dmp

Download

memory/2836-139-0x0000000074BA0000-0x000000007535C000-memory.dmp

Download

memory/2836-135-0x0000000074BA0000-0x000000007535C000-memory.dmp

Download

memory/2836-23-0x0000000074BA0000-0x000000007535C000-memory.dmp

Download

memory/2836-13-0x0000000074BA0000-0x000000007535C000-memory.dmp

Download

memory/2836-0-0x0000000074BB2000-0x0000000074BB3000-memory.dmp

Download

memory/2836-11-0x0000000007150000-0x00000000071A0000-memory.dmp

Download

memory/2836-10-0x00000000071F0000-0x0000000007282000-memory.dmp

Download

memory/2836-9-0x0000000007710000-0x0000000007CCA000-memory.dmp

Download

memory/2836-8-0x0000000006F40000-0x0000000006FA6000-memory.dmp

Download

memory/2836-7-0x0000000006E80000-0x0000000006EB2000-memory.dmp

Download

memory/2836-6-0x0000000006A00000-0x0000000006AF2000-memory.dmp

Download

memory/2836-5-0x00000000055D0000-0x000000000561C000-memory.dmp

Download

memory/2836-201-0x00000000070D0000-0x00000000070E2000-memory.dmp

Download

memory/2836-4-0x00000000054D0000-0x00000000055A8000-memory.dmp

Download

memory/2836-3-0x0000000005160000-0x00000000051DA000-memory.dmp

Download

memory/2836-2-0x0000000074BA0000-0x000000007535C000-memory.dmp

Download

memory/2836-1-0x0000000000440000-0x0000000000510000-memory.dmp

Download

memory/2836-202-0x0000000074BA0000-0x000000007535C000-memory.dmp

Download