d028bdbbe25721254fcaaad4524a93331de604973cab5a1968915c122639d4da

Analysis

max time kernel
147s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_19633c21fcb1bf4bc425ac927da79685_icedid_vidar.exe
Size 689KB
Sample260705-caal6agv2y
SHA256 d028bdbbe25721254fcaaad4524a93331de604973cab5a1968915c122639d4da
MD5 19633c21fcb1bf4bc425ac927da79685
SHA1 f7ac2e25605c22e454d466441d1c08b6d8dbeb7f
SHA512 0828c3b57f677646629bbd0af77e1a37f06a05e0d8952151426524ebb4eefa172c8b4b61f9f137986aefc365fd257450449fd28ec16cb17f04dfad1580997aa9
SSDEEP 12288:+C/2fAZ4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYbs:DOICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1E5E41247A2A5B4FCF55BE03C84714D49EB32B8751A70CB5F67240A9A0F277C09E2AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
764	alg.exe
2976	elevation_service.exe
2328	elevation_service.exe
2776	maintenanceservice.exe
2364	OSE.EXE
1012	GameInputSvc.exe
5460	GameInputSvc.exe
2220	msdtc.exe
5812	PerceptionSimulationService.exe
3108	perfhost.exe
3112	ReFsDedupSvc.exe
6012	locator.exe
1304	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16c6842880095f6d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-05_19633c21fcb1bf4bc425ac927da79685_icedid_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-05_19633c21fcb1bf4bc425ac927da79685_icedid_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5460	GameInputSvc.exe
5460	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	440	2026-07-05_19633c21fcb1bf4bc425ac927da79685_icedid_vidar.exe
Token: SeDebugPrivilege	764	alg.exe
Token: SeDebugPrivilege	764	alg.exe
Token: SeTakeOwnershipPrivilege	2976	elevation_service.exe
Token: SeTcbPrivilege	1012	GameInputSvc.exe
Token: SeBackupPrivilege	3112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3112	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 5460	1012	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-05_19633c21fcb1bf4bc425ac927da79685_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_19633c21fcb1bf4bc425ac927da79685_icedid_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5460

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3108

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:1304

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:2244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1856

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1156

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9e64900016ea56f5a5950ee9ec7e65c42361dfc4e487c4d323d32ad0cb2a0d1
MD5 ddce53e801639a9004bbba14fd172719
SHA1 3ca7f43dd396b10b72bdc6d74e8c71dc0f4e9454
SHA512 c8f61902477754589f612e4343dc5dbfb2186722276679a447176aafb3656e138510399fbcb30ef12b2a7fd0e1fa740495944283d66cb8389ed5e92c6f0a97bf
SSDEEP 49152:cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBATGBrMGWr7nTC8HPS:G3q6gjBHKtMbTC8HP
TLSH
T1CAD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 7f86040eb58011522caf94b6e7dfe72039362a89a965e88063f22695d412d4f5
MD5 3f0e465646598f3b5e0eb07a2cc4bde3
SHA1 b65024986ef6c11932dbc6b2e862366c2d490173
SHA512 9b5c612cbf25cb240013dc859ba57fa5ce7e4d50d9c0fdc77b59e9440510cbfb7d6f2d86eda09e8113f866ecf29f1dcdec92d3258dbe95e96cc7afcac117352a
SSDEEP 24576:IXYZg0czAehICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:G0crATGBrMGWr7nTC8HPS
TLSH
T192050219A7D048FDED5BD17CC8B18811EB33B85547A0E79B03A49A691F233C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 908c9c85af3c056d763261b201779dfbcfb3a27eb7e451370412597517b0bfab
MD5 6b0d3fa12953b0d2d05a5567e5ca1a44
SHA1 16e231d320a21d5dee35b70e57516278226eb746
SHA512 3399ced38d792295426e7f8b6ee96f2c10f25746ad1849f5a7c3dc58909bdfd420211dbbc003229664c811fa7646f790c9dc395e78532022a86fbeed39c5a289
SSDEEP 24576:uwuuOWdICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:uwVOyATGBrMGWr7nTC8HPS
TLSH
T1DE05F14676A44CF9E967913C85A7C536FBB2B8022A21C71F1320CB5B5F37391AE2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d8dc182715ccfc8edfaefbc74aa21e37387cd68772ee7b507e65872c4a927329
MD5 36cd4bf10385125a4517b7c3a6db186c
SHA1 91c6415203bc228c6a1cd8eb36a07dc86a2cc1cf
SHA512 476fce0c4c13d56ce13d130a63cacb19698f69495afd9b906f3436acf53cff24a4a0e6223bae7b89c25d245391762711d2c13dc93597361478059a6263b624f4
SSDEEP 49152:XB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gluATGBrMGWr7nTC8HPS:5u6JmTxd2drKtMbTC8HP
TLSH
T14FD59D13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9077562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 7301b8e46afef249e7309aec1ca4d95159b3a2ab76631091cf081cf496f62758
MD5 50aab7305d18f907a8387b8db58b0b3a
SHA1 de0a97b14ff3ebc42e3a04e033fd61ee026a6b4b
SHA512 75fcab9a77756405d713e855b29b0b0599ad30a4f5b61977550dad18c67e2ef880582e01c1e9452f3df3f72b8c7c082c430f6d2d3e9b93c969e78bda777e4554
SSDEEP 12288:RH7hP4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:RhgICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T14ED42303C655CC69FD1EF07C60758C50AE39BAA52BA0C39BF7041FDD19367C4AB692A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c03fed87ca29ba9e97b94a7ae23dd339ea8e77914fc13a9880a6aba540a0b551
MD5 d938f487e044095aa83dd102a760d9c6
SHA1 2f7d1a69dca4fd184663181d142e587beabc0fc9
SHA512 d3e34ff79258e10393e28164c2f00069a766e574b1c392f08b9b81c68646907464dab1b5a7ae987612089a069ec562a00bfd9a7522b4a957d62ce53b3596b17a
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYGICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:/gb4mBIBhGFZATGBrMGWr7nTC8HPS
TLSH
T1B465AF1E22EC01F5E0FAE2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 118e1e5ee0414a593039c802fadb10033cbbe740a4cf58aac08bb0d8b0c113b0
MD5 a6d4369a8871699f58c5c7e75b5d0f5e
SHA1 f121edf8250d55df9e4f6ba491ab4f6f0e207491
SHA512 d084d08bf84b52a4810a0d84acb7e98d6b47e75d330d24bdc839ccc6ce0f9272927aeba4a8bafb77005b0e0ade62ad55dcd04fd26d65fdf71e0b6d03c561595b
SSDEEP 12288:giGf4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:PGQICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T1D2E4221EA1B5E8ACE83EE07C64719892BD3075A02760D3EF56106EBD4F266D0733DDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 2833279c3f096b990c8f099d189e77e7b1b0f6be38f966d3b002c5b69aafaf97
MD5 30eda130eac09c51abca7947fb3d5b21
SHA1 f77d86a631503a9e4651eed65836e56b3db2b599
SHA512 0331b0edbac2822fcb5bcbec8d95d3b4f30aa83847f95837ed7269c534a5ca5997dcfff19a521e003e2cec598624b3a7c4a3d35b14d7906a8f1ab5de57c25e77
SSDEEP 12288:094ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:0qICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T16ED42306C565CCADF90EE47C60729C819E34BA9527A0C3DBB7042E9D092A7C4A7796F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 673ec3bd73cb777879c121aecc5b7aa0d5f6571734c5a5fbbcdbabe9bc78277d
MD5 6f3295248357f02b681c682de345cf5a
SHA1 483372df4788d31cbe319d20439dce688c01e888
SHA512 52dff845468fd1f242e580519edb7cdce86a91eac85a919165959bf04525a575fd8c85682ac21a919124fb23eb8e5416896f2d93fa502d97c65efffe164e5f0d
SSDEEP 24576:N6B8C8/pJqH1LBr/a7/mAICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:0ml/PqVha7/3ATGBrMGWr7nTC8HPS
TLSH
T18F350165A7E101F4D47BE03889924A63FA72B4251360EBDF07A88F551F23BD44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c78fb4d2ac87976b6697f3a48b2b7d600d0cc907889ebe3cd1491ca6897168d4
MD5 aec81cb28bccf4b892627955fae80ce9
SHA1 cd2abebf4c72da8d93d64c47f489bed4e6023e62
SHA512 677984171749df49361f9a91935700f15eb5a1e2742ef12a07be6dbc17a9d86384481c0c4b6bf596ffdf2dd2d02ff80db2b108141f1a6a9a88feb7f49e004da9
SSDEEP 24576:hPUr+NQ2ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:hJQ2ATGBrMGWr7nTC8HPS
TLSH
T14905E11F62A81CE9F67AE17C85928609FB71B4621751D2CF0290817E4F27ED8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 92668a795072544792c18a585486440e74d9b644d36171e715022a37f8bfc390
MD5 ac407b521e117f35a35ccbc6da5447e2
SHA1 6ed3a4fd8f8ad8dc9508af06f3d1d5249e774a39
SHA512 7d08d52692128861470f42c2bd216733650d42343b4a942e20060921dcde1bcf9f79549de8c2597d82aae007a2675365d977de67b6e18dc2b0d444106975bcfe
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+ATGBrMGWr7nTC8Hq:PG05lO43bIKtMbTC8HP
TLSH
T128D5CF6A62EC11F9D1BBD07CD9C64A0BEBB23415033556CF02A486A91F27FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 09769c4b239759e49e185547b8af3cdc6e39a480f203e7bec5924d8b41da18d7
MD5 402ececf17b43f450e0a155b8ebb3678
SHA1 738bb8e7edd6c51022057e64e5cc5e3537190373
SHA512 f73a840239e4b7046568fc01d2f1eef5997dd2f55da681b243f352b4697509fb099890406e0a00f63f61393308a9f5b743b0a48116e2238831f2700d0472e5ce
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fk3ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:SNc/zEOVHFEATGBrMGWr7nTC8HPS
TLSH
T16C857B1622E901E4F5BBE1BE89779946FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 d787ded2eb0b611299b35a046929b216031bb8f96b0281656175959bfdbff630
MD5 d8701904fcfb38cfab356a7c52d0e00f
SHA1 3511c00a4c4f39619ce825d725a96180a827d8fe
SHA512 be37649c59f2c258315982c867103e1d775d3a177335ef2806ec5a4356efc57f3ab2722dd2632dc5a6fa6fcec559a23d9b62dbb93284cac7174ea71031c1de71
SSDEEP 24576:lJnJPbzB4SGICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:lJnJv6SGATGBrMGWr7nTC8HPS
TLSH
T19D15E02DD2A810E8E4B7C1B4816A1A5AFF31387D2F2169C76974D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 29ec03523c03eddbfc01a23bc1d04c8f49d01ee4cb38cba071ddee273664050d
MD5 c9d182466624b7e8f038f724110df600
SHA1 58601b6ece5ddf4344e5b5009b03d2c58e41ab94
SHA512 e8b0111c506c5c72d45cf3467d24bd4da369f0aa53ae15b2b15522c6f6a460a6a129ccaa1d6e96ff80e510eb752cd3140bb7a696dfd5103d85c098a2bb97f144
SSDEEP 24576:86DI7ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:86DI7ATGBrMGWr7nTC8HPS
TLSH
T1F705020D637A50F9E06BE03D81A30442D672B0B1976296DF5794C9BD4FA3EC8B93CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 5a473f179459c6a718f0c59eda14faf90ee0e5838f7ee14b08e3f5c0b4c61e63
MD5 9581eba610d4bc4d2e90ff43e157ab2a
SHA1 e148a9f6a4f1dca6599d4d3a289bb921b5ff3c98
SHA512 4ddad77df256564ace7972ae444d4e5004c4ca1ea15f35069e3100f7f3ee0767b75b08caaa445464e54eb88b90e9aa4ecf02a539381f0051cf626b5e7eafdd4d
SSDEEP 12288:0G6kym4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb38:lty5ICgpB5GBrMVyJWrwgh5AQorrYWbF
TLSH
T156F412059394E4E8F96E907C997285909F35BC202B61C3DF6650AF7E1F367C0BA34B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 8dfad01ade37285a358f16a0d3cd8d121d16fbe13363d69ee4e8c05bcac928b3
MD5 3a2997466c1d00692d7ba025b3303ade
SHA1 18e76ea39651446b1776306644c858aac640618d
SHA512 ea73369664cd614a3f59a986f30ccfa3d5d9117fcd56547c357d5d04c30c1b6cd9d7b98f4ea41f2b2237d52b1d5ce6408816b930df8f62e363493240d3b30875
SSDEEP 12288:3qd4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:aKICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1B8D4230AC265D8ADFD0EF47C20714C819E34B6A527A1D3EFB7041EBD4A3A7C067799A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 c5d285aed346bd7d1cd19ff60f7b9bb206945b4c0bb27fa2c8ac810c2b9bdfaa
MD5 0731d15961dda4f0283cdea9d38ca86a
SHA1 2834c9e84fdc6306c559c7a199b32872f094ed67
SHA512 a5f3fc354f02804c1197804c3ed44dfcb0202a2259f136eac789d5a52d9ecd8a55bc45d619fc3cd54f1b66b9eafd060e7c3fa597bd333a880940ba0955909c3a
SSDEEP 24576:N/gEKoTfaidZ4ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:1g0TrZ4ATGBrMGWr7nTC8HPS
TLSH
T156559D1DA3EA05DAE2B2D179D8725493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-1-0x000001B47B840000-0x000001B47B8A6000-memory.dmp

Download

memory/440-3-0x000001B47B840000-0x000001B47B8A6000-memory.dmp

Download

memory/440-0-0x00007FF6059E0000-0x00007FF605ACA000-memory.dmp

Download

memory/440-19-0x000001B47B840000-0x000001B47B8A6000-memory.dmp

Download

memory/440-22-0x00007FF6059E0000-0x00007FF605ACA000-memory.dmp

Download

memory/556-329-0x0000014727CD0000-0x0000014727D36000-memory.dmp

Download

memory/556-327-0x00007FF6CE470000-0x00007FF6CE605000-memory.dmp

Download

memory/556-328-0x0000014727CD0000-0x0000014727D36000-memory.dmp

Download

memory/764-61-0x00007FF7DA170000-0x00007FF7DA293000-memory.dmp

Download

memory/764-11-0x00007FF7DA170000-0x00007FF7DA293000-memory.dmp

Download

memory/764-12-0x0000021803A10000-0x0000021803A76000-memory.dmp

Download

memory/764-14-0x0000021803A10000-0x0000021803A76000-memory.dmp

Download

memory/764-15-0x0000021803A10000-0x0000021803A76000-memory.dmp

Download

memory/1012-232-0x00007FF68EE30000-0x00007FF68EEF9000-memory.dmp

Download

memory/1012-233-0x000001846A1A0000-0x000001846A206000-memory.dmp

Download

memory/1012-234-0x000001846A1A0000-0x000001846A206000-memory.dmp

Download

memory/1012-326-0x00007FF68EE30000-0x00007FF68EEF9000-memory.dmp

Download

memory/1156-344-0x00007FF722B40000-0x00007FF722E61000-memory.dmp

Download

memory/1156-336-0x00007FF722B40000-0x00007FF722E61000-memory.dmp

Download

memory/1156-338-0x0000016A8FAD0000-0x0000016A8FB36000-memory.dmp

Download

memory/1156-337-0x0000016A8FAD0000-0x0000016A8FB36000-memory.dmp

Download

memory/1156-342-0x0000016A8FAD0000-0x0000016A8FB36000-memory.dmp

Download

memory/1304-299-0x00007FF67FE20000-0x00007FF680237000-memory.dmp

Download

memory/1304-301-0x000002CA34690000-0x000002CA346F6000-memory.dmp

Download

memory/1304-300-0x000002CA34690000-0x000002CA346F6000-memory.dmp

Download

memory/1856-320-0x0000028B3C530000-0x0000028B3C596000-memory.dmp

Download

memory/1856-319-0x0000028B3C530000-0x0000028B3C596000-memory.dmp

Download

memory/1856-317-0x00007FF7B93A0000-0x00007FF7B9643000-memory.dmp

Download

memory/2220-251-0x0000025EF4B00000-0x0000025EF4B66000-memory.dmp

Download

memory/2220-250-0x0000025EF4B00000-0x0000025EF4B66000-memory.dmp

Download

memory/2220-249-0x00007FF608D80000-0x00007FF608E9A000-memory.dmp

Download

memory/2220-347-0x00007FF608D80000-0x00007FF608E9A000-memory.dmp

Download

memory/2244-309-0x00007FF7F0640000-0x00007FF7F06F4000-memory.dmp

Download

memory/2244-311-0x00000229AC890000-0x00000229AC8F6000-memory.dmp

Download

memory/2244-310-0x00000229AC890000-0x00000229AC8F6000-memory.dmp

Download

memory/2328-34-0x000001A41D790000-0x000001A41D85F000-memory.dmp

Download

memory/2328-37-0x000001A41D980000-0x000001A41D9E6000-memory.dmp

Download

memory/2328-36-0x000001A41D980000-0x000001A41D9E6000-memory.dmp

Download

memory/2328-35-0x000001A41D980000-0x000001A41D9E6000-memory.dmp

Download

memory/2364-55-0x0000028DD3E50000-0x0000028DD3F1F000-memory.dmp

Download

memory/2364-56-0x0000028DD4040000-0x0000028DD40A6000-memory.dmp

Download

memory/2364-58-0x0000028DD4040000-0x0000028DD40A6000-memory.dmp

Download

memory/2648-349-0x0000020F0E710000-0x0000020F0E776000-memory.dmp

Download

memory/2648-348-0x00007FF6E3E20000-0x00007FF6E40AB000-memory.dmp

Download

memory/2648-351-0x0000020F0E710000-0x0000020F0E776000-memory.dmp

Download

memory/2776-51-0x0000013D7D550000-0x0000013D7D5B6000-memory.dmp

Download

memory/2776-43-0x00007FF785440000-0x00007FF7855A8000-memory.dmp

Download

memory/2776-45-0x0000013D7D550000-0x0000013D7D5B6000-memory.dmp

Download

memory/2776-44-0x0000013D7D550000-0x0000013D7D5B6000-memory.dmp

Download

memory/2776-52-0x00007FF785440000-0x00007FF7855A8000-memory.dmp

Download

memory/2976-27-0x0000018210760000-0x00000182107C6000-memory.dmp

Download

memory/2976-28-0x0000018210760000-0x00000182107C6000-memory.dmp

Download

memory/2976-25-0x0000018210580000-0x000001821064F000-memory.dmp

Download

memory/2976-26-0x0000018210760000-0x00000182107C6000-memory.dmp

Download

memory/3108-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3108-276-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/3108-271-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/3112-284-0x00000275F2E10000-0x00000275F2E76000-memory.dmp

Download

memory/3112-283-0x00000275F2E10000-0x00000275F2E76000-memory.dmp

Download

memory/3112-282-0x00007FF71F450000-0x00007FF71FB94000-memory.dmp

Download

memory/5460-335-0x00007FF68EE30000-0x00007FF68EEF9000-memory.dmp

Download

memory/5460-241-0x00007FF68EE30000-0x00007FF68EEF9000-memory.dmp

Download

memory/5460-242-0x000002C105C00000-0x000002C105C66000-memory.dmp

Download

memory/5460-243-0x000002C105C00000-0x000002C105C66000-memory.dmp

Download

memory/5812-258-0x00007FF75B160000-0x00007FF75B2AA000-memory.dmp

Download

memory/5812-260-0x0000024FEA460000-0x0000024FEA4C6000-memory.dmp

Download

memory/5812-261-0x0000024FEA460000-0x0000024FEA4C6000-memory.dmp

Download

memory/6012-291-0x0000024ADDA10000-0x0000024ADDA76000-memory.dmp

Download

memory/6012-292-0x0000024ADDA10000-0x0000024ADDA76000-memory.dmp

Download

memory/6012-290-0x00007FF6653D0000-0x00007FF66547E000-memory.dmp

Download