e4ebbb5d132fc61f7a4824de532ea9a75f33b0de88387a0d1e7e518e05e7bff5

Analysis

max time kernel
146s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_51e9f2345f62cca097653cadc352e977_icedid_stealc_vidar.exe
Size 752KB
Sample260714-ejch8af16z
SHA256 e4ebbb5d132fc61f7a4824de532ea9a75f33b0de88387a0d1e7e518e05e7bff5
MD5 51e9f2345f62cca097653cadc352e977
SHA1 f6b0ebaf36485376fcec77d1c2738f0be7ca75c2
SHA512 c3dd0678810faf03947552de7caeb563c879c984d3e884cd2d0898a536fd595d198b1b3f6dae013077ea49af83a3a62fe30bcde2adbfad97f76a0609646a0d8d
SSDEEP 12288:uRxkVuT90JQor2RiiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:uRyVu50JQqODijLGQ7t2OaBN0sW4T
TLSH
T1E6F40167B2E130E8E0369575C8615955E731B8F44371DF3F22A8437ACE23650AE2BF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3052	alg.exe
1088	elevation_service.exe
3492	elevation_service.exe
4452	maintenanceservice.exe
1140	OSE.EXE
5696	GameInputSvc.exe
2904	GameInputSvc.exe
2252	msdtc.exe
4544	PerceptionSimulationService.exe
5640	perfhost.exe
4496	ReFsDedupSvc.exe
2908	locator.exe
5732	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_51e9f2345f62cca097653cadc352e977_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_51e9f2345f62cca097653cadc352e977_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b2d6b1c823e529ce.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	GameInputSvc.exe
2904	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4940	2026-07-14_51e9f2345f62cca097653cadc352e977_icedid_stealc_vidar.exe
Token: SeDebugPrivilege	3052	alg.exe
Token: SeDebugPrivilege	3052	alg.exe
Token: SeTakeOwnershipPrivilege	1088	elevation_service.exe
Token: SeTcbPrivilege	5696	GameInputSvc.exe
Token: SeBackupPrivilege	4496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4496	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 2904	5696	GameInputSvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-14_51e9f2345f62cca097653cadc352e977_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_51e9f2345f62cca097653cadc352e977_icedid_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:1908

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3744

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b46597eb303b170e991c3b1c0256d81de409bbf540df9ce7f74a98402a17ee86
MD5 90d9d21e83a9091bcb7dc58fd4ff1515
SHA1 d1ad8d12ee8af51767fa313fe77195332299b4c1
SHA512 7bc7cd7c68bc15163ce1f3273ebd42d243e2fa576c2dff00616a0bd30fba185810fbf04a9e372a995843f5b8559c40d0ba8540bcbf368bda567e949685fda509
SSDEEP 49152:cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnMUGQ7tBabc:G3q6gjBhUVtUI
TLSH
T188D59D03F2D900E8E06AD178D7569132E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 0fb5fa49d0b66c7ba0dd2c0ea0794d6080991332fe09512f1506ee8b2eebc907
MD5 002e48e036132b2d77d6ec19f813c7dc
SHA1 6c5babc78000708ea3ad277da043b759b8906b38
SHA512 a3701da30a0f8c7d848c52f53b338d48633862d093bf844d90c94c6e3b036b7de693d0172db4343ba3ab62fed8b7951fcc45e7faeaed96531c9ec45580672a62
SSDEEP 12288:W1XLs4gIkxy2lRq2czAoiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:UXYn1tczA5ijLGQ7t2OaBN0sW4T
TLSH
T1D105F164B7D008FCEC5B8279C8729511EA3278D18360EB9B13B496794F236D86E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 5cc7fa4eea62bc9d4173b6ce653cf1c509f4cfe90ad98da102edb8df2d18445b
MD5 2c53e7190a772f0d042c3ee05163fc81
SHA1 483645effe2d2a166480209f69253df04581f33c
SHA512 8c8b66955b041cc89c6a65431f55640ee387d3b7b16dfe83e365ed2b4f4d7579dc6c0865d895d7a0e529116bcd60452081e5bebe0eb837063f955033502901e7
SSDEEP 12288:Ymw5HEjsChNYBFgl0W7m+CyiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SF:VwuROWGijLGQ7t2OaBN0sW4T
TLSH
T13005F19676E41CECE86782798563D531F7B2B8811631DB1F2370C76E5F23261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4fafd55fbfb9c38e49560bad11cbcad9b885936f22dd084805175ac79bed8773
MD5 2f7d1b41f956575e80d5437a8f6e3c05
SHA1 d0bf27943686974905c80c1b0c3e8c48a73c5823
SHA512 382aa7719ff566df5edc99f055342c482da466df092e5e1d877764f312e3dce4dbe3d4c0c3ac3bb7d780baa196c19ddef9cf72a3d73f00ae5240296287bc91a5
SSDEEP 49152:5B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5UGQ7tBabc:vu6JmTxd2d5UVtUI
TLSH
T140D59D13F1D901E8D05ED478974AA233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 01bcdb6f8a1520410cedf3aae4d88a59e689edc032285562040f10ba368c2fe3
MD5 b016a736fc72843cc8484e9f59946977
SHA1 6bdeb3f2e97aeb31f6490bb646c59a279278bf78
SHA512 da8435a3d677a5654a988192d4f73f9a36b1b3b28bb60e4b2f54aa94b2d60659aef8d6b4aa5ed6ca679476af69cadd2c1eae65470c398d57f34a1e1b250edabe
SSDEEP 12288:RY7PiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:+KijLGQ7t2OaBN0sW4T
TLSH
T147D423F2D490290CF81DE6F24532A6602928B6D4C772E9A37178637C8413DE5FEB2E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c385d89de16661d20fba5ae8bb0bbf0b899987985dce02dd68c46c99d556fa54
MD5 0da68ca3446418bc8bc32701e21e4cd6
SHA1 868738260e3d85644db09ea2753ff8f0dddf63ac
SHA512 d41864d8b45f40f5b4c50627250fb59f8a4509650401d549732dd62d6a4c00837dc851ffcf117a3dd9fec9473a8cac917444ee95e010aa5437dc53b21489ed09
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYjijLGQ7t2OaBN0sW4T:9gb4mBIBhGFKUGQ7tBabc
TLSH
T1B265AF1E22E802F5E0FAE2B8DDA64417D6B278164732D2DF1151423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 db192121b5b6965db05e5c821d9f55842118b4778fbd82fb6bd77d08a3f91ec4
MD5 23e98a9a9c9fe15a7801af2c3463ae57
SHA1 969a361ecbf9a966ead64b96e72f6be8f0c5c3d9
SHA512 7fd2bd077ed0dd3f5bd895a5982699a46fcc5bdc96e48bdda33a333ae23362b97686d026512df2ff77c74b4b8892f8ca9f484df994655f8a7e7545edeb2378e5
SSDEEP 12288:lxGZiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:HGsijLGQ7t2OaBN0sW4T
TLSH
T173E412B9A4E1344CD82AC6B2443165A1787075D0C375AAFF35F4A27CCA03DE4BB76D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 51942f9a6af1f96d09befbd6f6c057cac3cadfdf3122decd17a24165f2d1150f
MD5 e1a4a32b816022fd895e8278fc813270
SHA1 173446be4c0c1897f4f43117336737f092b46fb8
SHA512 4df220719c27a3e97ba77267809a79e7a0ac313f33eb122dd18d83b0ecfcf09b30b20daa8ecadf66033992717cb65622c22e3607f2c4f64d20928b0a71732da4
SSDEEP 12288:NfiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:N6ijLGQ7t2OaBN0sW4T
TLSH
T1D1D423F1E490250CE809D6F359327AA0292466D0C3B6BEE33578627C8543DE5FE73DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c82067487b412907f4836dc1e46297606583bb35bc9e7579290f0974992ad6ea
MD5 c465e780da41247b0c584b3ca22371e2
SHA1 6b020020d2b5bf8252e0b9197d4f3fe398c86c17
SHA512 2209c4267c4796e33fec8f8efc8960eb64da4b6d6cac81869c31a65c9d1fc3d5ecc404ae18a2e1acb075fc57d424dfdd5435ab7a2d5bb9090356806870583852
SSDEEP 24576:ViS8u8FpJqH1Jzria7/m3dijLGQ7t2OaBN0sW4T:8hZFPqVAa7/gUGQ7tBabc
TLSH
T19E35F161A6E001F4D47BD138895246A3F6B2B4610374EFDF06A88B650F23AE55B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 13fb7e6f52848a1e048c69ff820395b6c3315117df4e981f57f76897ea967b8d
MD5 e23d8cf31066c340a9604fc8abefad6c
SHA1 cb2315d0dbc5394fa6393a6f2a81fc50ef813215
SHA512 89226c82f822de3406595a442c54151ca0948b6b50ed2c541e537a4130bd498105a09ee2e8f4679d247c34732beb64daf861eb04083959eba603772094fe3645
SSDEEP 12288:DHvUrBFrEjwaQuiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:DPUr+NQ3ijLGQ7t2OaBN0sW4T
TLSH
T1D105F16F61E818D8E57AE17D89528719F771B4A20312E6DF02E0817E4E13DE8BD3AF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 d4e1e5e9f4809e3d7a78383a6d30953e56e0d39370e4ccbb3e0a9abd51b38b58
MD5 1ea31784dbff7a987bbefeea974a13b5
SHA1 ddc9126632ad007b5c36cd635057728f25f9da84
SHA512 c77950454d62f2c4edc6abd8493c8b4c217c929f159fff2d86a2693bcd12f0ba424c30c7aec704b899c553b11884527b5fa472f36c06d522ab450fd50e28392f
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4UGQ7tBabc:WG05lO43bbUVtUI
TLSH
T113D5C06A62EC11F9D0BBD17CD9C64A0BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d35f290ed06d0e5660123d6e251a854c79cf5fcb5fc814f967e8abf62ea0b6db
MD5 7bf111cca9a1ba6ba8c6364f11306827
SHA1 98ae29f23a7f65a40748313edefdf7d6684e6912
SHA512 d79c80dc3ef59458993c581b9f6aef8a40c3f518be1c7be2265dd8d3946547467b21815459a60353aa5d593aeea0dd3e43efc41a9cf50df28314abe43cd07d46
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fk/ijLGQ7t2OaBN0sW4T:6Nc/zEOVHFSUGQ7tBabc
TLSH
T182858C6622E901E4F1BBE1BE89779546FA71786553308ACF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 426d656d461934b02f613aaa6c6e3433c5c336ab6ff2f1c2db1fcef716f4d1a2
MD5 9e8c9e9afd5a8e353b1fe30027b83b20
SHA1 a9c806d3b0c06af85f186f0f7138f046c4a69b64
SHA512 cd4c2a6864b7b39a585604de9c539889d3d9397a855b1c06f892e6793563f6ba14e847e16a13e710ce5269dc75687e372de5e806bf122df1c6c4ff30e7420ded
SSDEEP 12288:RgHPJnJP6szeCs6Rl28dEiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK5k:sJnJPbzB4S9ijLGQ7t2OaBN0sW4T
TLSH
T1FC15D07DD1A810D8E4B7C2B4811A1B55FE3138BC2B2669D729B4D5343F13EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 1.9MB
SHA256 8d59de048a954e2eedc5a1e3c26596f367527edc7c42dac270ed09717bb3f387
MD5 a064fdb49afe1e5d3bb48789f4596ae7
SHA1 46f36a7a2e3885dca166d1c1384d4728f93cb9b9
SHA512 71c6398ef7daac341ef45603bf412a3b96addd8c2971ecbe3a13d92e4e7baf619d811593c7a1a567a30cb42b1b57c740578cec0b369fa6e1343bd40f5eafb4ad
SSDEEP 24576:0CLHGL0MoeVtFumTijCmlKQWDkIcijLGQ7t2OaBN0sWk:0CLHGeeV5ijCmlDWDklUGQ7tBabck
TLSH
T108955B05E7EB5188E8F3CAF5C92294169A327C549B34F7EF4A80C96A1E32FD4D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 619a0d6660f0774e06ecdb401dcb4d0fe01073e44c30d5c74f6f18d1f6f4f3fa
MD5 6aba8ed65f5c6e8bed0b4cec8a21e4c6
SHA1 d0cee5473a04c5a56b3c0242f3dcdbb6606573a7
SHA512 5f71282a7fbf59d1621a254f6b24b53858ee1291060fd6aaf16524df394acd55700be48e94afcb7d9bb9be0ee391cc64f67194f66e445cb6a748e47ce3711843
SSDEEP 12288:M1Hck6j5ZI7ziYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:k6DIiijLGQ7t2OaBN0sW4T
TLSH
T1F10502AD727610B9D02BD07A85930551E1B2B0F0C3626ADF26E8C57D8E93EDCBD39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 5934f776bbab5e078dec6900b1526fafbd2cfee5181624fc2ccbdad3a639a4aa
MD5 b3ee5d42aa4f07deceb3157276bf8780
SHA1 a1f68a059fb64036105d29833f9e25e173745170
SHA512 31cfb0e70a52dd3f6b321a12bcbb5cb6079daacdaf743201458288a4fe09290f7ce690e5e9cb724cf66845a84fa6f8707e4dd6496996d3ffcafc3cc182e8e6fe
SSDEEP 12288:/G6kyAiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:OtyRijLGQ7t2OaBN0sW4T
TLSH
T159F41251A290208CE46992B5897291A05E34BCE08772A7EF31B0E73D5E33BE4FD71F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 c10846dbcc6ce8391870c6d14765352e7b2793d459bdf2d9652ab1524f01c904
MD5 3061c13d1f380bc8e87f7b637c3f9c5e
SHA1 c224b3c5378d01f04224739c0ea59b0d1655793d
SHA512 d12dc8c3d2dd2c8890abf99eabeafdc68b6d867a6a9213afc4a351cb80c3fdf0769aa10abe63ecfce94255e171ad4eff14807c8a511fe2a9aac1b4e970a33915
SSDEEP 12288:c7diYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:EYijLGQ7t2OaBN0sW4T
TLSH
T12AD423F5E490350CE809E6F345316AA0242475E0C776AAFB35B8A67CCA03DE5FE72D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 42b2c0b81e3422e6c22ab502d1d8ae3cd2ce6a71ae15bc49ee7aa9ec7ffe87c1
MD5 7ebb4c609aa596c0fdb5a1afe86eda06
SHA1 7b8825dc796f88f7fbd50ebd4cba3a7c58f7534c
SHA512 78d4bb800ed3d7863caede5cacd6d3098885f1936b927f17d7143a08336327db74fcea688eb9a35ca0fed5d52c7097f952415e9419dfbf762d111ed982abc99d
SSDEEP 12288:QjgIuZyFDK3tT5Tr7aVLIH9lH3cHiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QG:QjgILoTfaidZZijLGQ7t2OaBN0sW4T
TLSH
T1E6559D1DA3EA05CAE2B2D275D8321493D633B4715372D6DF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-321-0x0000025055020000-0x0000025055086000-memory.dmp

Download

memory/364-320-0x0000025055020000-0x0000025055086000-memory.dmp

Download

memory/364-319-0x00007FF6414B0000-0x00007FF641753000-memory.dmp

Download

memory/1088-27-0x000001EA84C70000-0x000001EA84CD6000-memory.dmp

Download

memory/1088-26-0x000001EA84C70000-0x000001EA84CD6000-memory.dmp

Download

memory/1088-25-0x000001EA84AF0000-0x000001EA84C6D000-memory.dmp

Download

memory/1088-28-0x000001EA84C70000-0x000001EA84CD6000-memory.dmp

Download

memory/1140-57-0x0000019568800000-0x0000019568866000-memory.dmp

Download

memory/1140-56-0x0000019568800000-0x0000019568866000-memory.dmp

Download

memory/1140-55-0x0000019568560000-0x00000195686DD000-memory.dmp

Download

memory/1908-328-0x00007FF75A020000-0x00007FF75A1B5000-memory.dmp

Download

memory/1908-330-0x00000201B69A0000-0x00000201B6A06000-memory.dmp

Download

memory/1908-329-0x00000201B69A0000-0x00000201B6A06000-memory.dmp

Download

memory/2252-250-0x0000022657840000-0x00000226578A6000-memory.dmp

Download

memory/2252-249-0x00007FF6977C0000-0x00007FF6978DA000-memory.dmp

Download

memory/2252-336-0x00007FF6977C0000-0x00007FF6978DA000-memory.dmp

Download

memory/2252-251-0x0000022657840000-0x00000226578A6000-memory.dmp

Download

memory/2684-359-0x0000022439F90000-0x0000022439FF6000-memory.dmp

Download

memory/2684-358-0x0000022439F90000-0x0000022439FF6000-memory.dmp

Download

memory/2684-363-0x00007FF60E100000-0x00007FF60E5D1000-memory.dmp

Download

memory/2904-243-0x000001A896960000-0x000001A8969C6000-memory.dmp

Download

memory/2904-242-0x000001A896960000-0x000001A8969C6000-memory.dmp

Download

memory/2904-327-0x00007FF6E68D0000-0x00007FF6E6999000-memory.dmp

Download

memory/2904-241-0x00007FF6E68D0000-0x00007FF6E6999000-memory.dmp

Download

memory/2908-290-0x00007FF603C00000-0x00007FF603CAE000-memory.dmp

Download

memory/2908-291-0x0000021CE95D0000-0x0000021CE9636000-memory.dmp

Download

memory/2908-292-0x0000021CE95D0000-0x0000021CE9636000-memory.dmp

Download

memory/3052-13-0x000001F6D20B0000-0x000001F6D2116000-memory.dmp

Download

memory/3052-61-0x00007FF6C93E0000-0x00007FF6C9503000-memory.dmp

Download

memory/3052-11-0x00007FF6C93E0000-0x00007FF6C9503000-memory.dmp

Download

memory/3052-12-0x000001F6D20B0000-0x000001F6D2116000-memory.dmp

Download

memory/3052-14-0x000001F6D20B0000-0x000001F6D2116000-memory.dmp

Download

memory/3492-36-0x0000023FF66A0000-0x0000023FF6706000-memory.dmp

Download

memory/3492-34-0x0000023FF6400000-0x0000023FF657D000-memory.dmp

Download

memory/3492-35-0x0000023FF66A0000-0x0000023FF6706000-memory.dmp

Download

memory/3492-37-0x0000023FF66A0000-0x0000023FF6706000-memory.dmp

Download

memory/3744-337-0x00007FF79CC00000-0x00007FF79CF21000-memory.dmp

Download

memory/3744-346-0x00007FF79CC00000-0x00007FF79CF21000-memory.dmp

Download

memory/3744-339-0x0000019DE67A0000-0x0000019DE6806000-memory.dmp

Download

memory/3744-338-0x0000019DE67A0000-0x0000019DE6806000-memory.dmp

Download

memory/3744-344-0x0000019DE67A0000-0x0000019DE6806000-memory.dmp

Download

memory/4344-311-0x000002284DD80000-0x000002284DDE6000-memory.dmp

Download

memory/4344-310-0x000002284DD80000-0x000002284DDE6000-memory.dmp

Download

memory/4344-309-0x00007FF762EE0000-0x00007FF762F94000-memory.dmp

Download

memory/4452-45-0x0000022A6D890000-0x0000022A6D8F6000-memory.dmp

Download

memory/4452-44-0x0000022A6D890000-0x0000022A6D8F6000-memory.dmp

Download

memory/4452-50-0x0000022A6D890000-0x0000022A6D8F6000-memory.dmp

Download

memory/4452-52-0x00007FF6E3140000-0x00007FF6E32A8000-memory.dmp

Download

memory/4452-43-0x00007FF6E3140000-0x00007FF6E32A8000-memory.dmp

Download

memory/4496-282-0x000001C7D8AF0000-0x000001C7D8B56000-memory.dmp

Download

memory/4496-284-0x000001C7D8AF0000-0x000001C7D8B56000-memory.dmp

Download

memory/4496-283-0x00007FF6FAA70000-0x00007FF6FB1B4000-memory.dmp

Download

memory/4544-261-0x00007FF7716C0000-0x00007FF77180A000-memory.dmp

Download

memory/4544-264-0x000001F8747D0000-0x000001F874836000-memory.dmp

Download

memory/4544-263-0x000001F8747D0000-0x000001F874836000-memory.dmp

Download

memory/4544-348-0x00007FF7716C0000-0x00007FF77180A000-memory.dmp

Download

memory/4680-354-0x00007FF701AF0000-0x00007FF701D7B000-memory.dmp

Download

memory/4680-349-0x000001A64BDD0000-0x000001A64BE36000-memory.dmp

Download

memory/4680-350-0x000001A64BDD0000-0x000001A64BE36000-memory.dmp

Download

memory/4940-22-0x00007FF70A0C0000-0x00007FF70A1E0000-memory.dmp

Download

memory/4940-19-0x000001A8905C0000-0x000001A890626000-memory.dmp

Download

memory/4940-3-0x000001A8905C0000-0x000001A890626000-memory.dmp

Download

memory/4940-1-0x000001A8905C0000-0x000001A890626000-memory.dmp

Download

memory/4940-0-0x00007FF70A0C0000-0x00007FF70A1E0000-memory.dmp

Download

memory/5640-276-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/5640-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5640-271-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/5640-357-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5696-234-0x000001F146F50000-0x000001F146FB6000-memory.dmp

Download

memory/5696-233-0x000001F146F50000-0x000001F146FB6000-memory.dmp

Download

memory/5696-232-0x00007FF6E68D0000-0x00007FF6E6999000-memory.dmp

Download

memory/5696-318-0x00007FF6E68D0000-0x00007FF6E6999000-memory.dmp

Download

memory/5732-300-0x00007FF6D88A0000-0x00007FF6D8CB7000-memory.dmp

Download

memory/5732-299-0x000001B225AB0000-0x000001B225B16000-memory.dmp

Download

memory/5732-301-0x000001B225AB0000-0x000001B225B16000-memory.dmp

Download