0779067958658b82587350e0f3bc8ec57944338b6ad4f78cdd48e32f81773739

Analysis

max time kernel
146s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_19baa403f69b52a0152d5b81be82f7a7_icedid_stealc_vidar.exe
Size 752KB
Sample260717-kc87haa16w
SHA256 0779067958658b82587350e0f3bc8ec57944338b6ad4f78cdd48e32f81773739
MD5 19baa403f69b52a0152d5b81be82f7a7
SHA1 93f28fc9240b0fe38aba57264d04ad5f59299efd
SHA512 2cfb2ea01b62d48761bb3489be2a30fefe4ad16e52e2b56d14a719c8f5fde7af18fed557d70686e6e8461db35fd38dba1f818f637a7294b196b1686d195fbd5f
SSDEEP 12288:uRCGrhT9tJpor2Bluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:uRbrh5tJpq5ofITNUohc3C5pPc66a0t
TLSH
T170F40117B29A24F5E0739439C8215945EB76B87517B28F7F429803BADF732844E2BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4212	alg.exe
3412	elevation_service.exe
5284	elevation_service.exe
3276	maintenanceservice.exe
3328	OSE.EXE
2892	GameInputSvc.exe
944	GameInputSvc.exe
1844	msdtc.exe
4092	PerceptionSimulationService.exe
3232	perfhost.exe
2736	ReFsDedupSvc.exe
4236	locator.exe
2524	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_19baa403f69b52a0152d5b81be82f7a7_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_19baa403f69b52a0152d5b81be82f7a7_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63cfb08483806d8d.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	GameInputSvc.exe
944	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-07-17_19baa403f69b52a0152d5b81be82f7a7_icedid_stealc_vidar.exe
Token: SeDebugPrivilege	4212	alg.exe
Token: SeDebugPrivilege	4212	alg.exe
Token: SeTakeOwnershipPrivilege	3412	elevation_service.exe
Token: SeTcbPrivilege	2892	GameInputSvc.exe
Token: SeBackupPrivilege	2736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2736	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 944	2892	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-17_19baa403f69b52a0152d5b81be82f7a7_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_19baa403f69b52a0152d5b81be82f7a7_icedid_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5284

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:944

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1844

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1508

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5460

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f908a06bd95caac6a14a9891ba14e38e01c7ed9eda497263c19b3893fe6340ea
MD5 4c85c43470903562a65d98a269f8490d
SHA1 23870b396d62d84427b9814663beb37f4fecc929
SHA512 42051bcad39cb761b6e219f31149800fa0ba8584cdf56f895dd45d5cb4bcde8c3c0a71f3443ffd81d3528843a676369b7fe5d99beee97394e5cf3c99d394964b
SSDEEP 49152:vOX632BuPkFKRrdE6oh7stBhuXjfS4LWxnxoDWcF:j3q6gjBcqb
TLSH
T125D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 effd386b995d9a8eaf7cc5cb68120b7ff39db6157011c19b6a48bb9e47cbaa92
MD5 c17cec0e82d0b7c6cadf221d54bb6c0f
SHA1 89416fd5429a050ecb7f2e337a755f018ab73125
SHA512 f8dd25e43c7656b4afcfce511990e6252ea5eac23dbfca9d9a4c1e69e6373aae3233ed16b0b071ad38087ad0c215e4773212b167495ca717b7554e4d3b463ac6
SSDEEP 12288:r1XLsFxWkxelI/fwczAsluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eX1:RXYnDcczAPofITNUohc3C5pPc66a0t
TLSH
T1A5050228A3D508F9EC67913DCC728501EB73789547A1EB8B03E49A695F233C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 72d13a46385b07db5673129b790d8fe83d2207c2d978cdfba57659cd0452e37a
MD5 b21070e6cec6e28485b40c1d76ee9e84
SHA1 44d8659d3a3cdafd416851a821cf7130fcc0053a
SHA512 d09ae67e66bfb77a5b70f26207f24bbe08ef08ff7441b15123dc2781bd7da9090aa2ffd343af1f7503887208c15201e948dbb0df8de506da939be5a02516a156
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CPluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPrl:uwuuOWNofITNUohc3C5pPc66a0t
TLSH
T10A05F14672A90CF9E96791398557D132FBF2B8113A22CB1F47A0C75B5F333516E2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7749f3b6d955e53688b65129630abcac4d5e75a40c5d03a6b94f9956ab3b07c9
MD5 d3e32c70296a32553efe665f7d62f2ed
SHA1 ea41219832ad4e57680855334c3555929ed4750b
SHA512 ad955cb0c69bf8a885a32901e9f805b8aeac7ea6aad7ba1c598ff106926a9bfc7b720a6529568aed0601da3083bc7f1b8c957403061eea054a5ed7d8df39496c
SSDEEP 49152:ua+taZ3usBWOBr4tEGp0bqx0z+n217aau1glNoDWcF:7u6JmTxd2dNqb
TLSH
T1CCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 d6262075e71603d1dee3dea288a07dca8f4f19094d7a37ba7e62dfe2f2564f90
MD5 7f24837974832f70a4faada4761ea756
SHA1 04f32e6ff32eda8074fdaf4baaa00c7b37e5063e
SHA512 7a1d0464dddd5e61665dd5411916c0615fd5f95d88ca9600bb70a36f782ff7c95ffa6cdd3f251dd2a4036685ceaf74fd960f9d6413c1fecd7e3b14a8b75fe396
SSDEEP 12288:RE7ksluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:WiofITNUohc3C5pPc66a0t
TLSH
T1D6D423B1C20E5E52E87AB872183D6150BE7D46B5BF434EC3E58823ED96B03C84B3255B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2bc6e70b3168e45508a01ce9ae19ea1ef0841c3d30763ed53057b7409ffc92e3
MD5 7e63f5ff501a0504854669a3fbac766f
SHA1 87b66e3eeaecdbfb162e45febda6d2c2549c1fc5
SHA512 3f66f8402aa7ab3fda5231e36bad9e0650a820fd14323fd6a7c14654038b1342f7daf77f5bf74cc07f7f948d454e51e09129ac51612633683601f03cff7c0441
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYnofITNUohc3C5pPc66a0t:mgb4mBIBhGFuoDWcF
TLSH
T17465AE1E22EC02F5E0F9E2B88DAA4417D6B278161732D2DF1151427D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 492b34ab227295ac2311862b128b33050ff66175d397398d88a882c5a41682c3
MD5 1d11f1c91847903b63040364af3aa68c
SHA1 305dba6b4cb326be743f27f547d382662908b2e4
SHA512 0a7ec7cdf22029ea95eee8ead4eb94cf70a2fe0c8ceb9bd47e026816e3e128f9fbd6d800ff39ee9087d0db9ffdfa8979c8df1b65d3dc703f13aeb8386edaeec1
SSDEEP 12288:8gG+luow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:hG1ofITNUohc3C5pPc66a0t
TLSH
T123E42379E1AB35D5C83AE53A48396082BDB535B07B131EEF89C426BDCBA03D42331C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 357bc81bb945066aefd29bfcc2ed2869051f85c0de783f1529bbe689df926176
MD5 45a754199f52778288a2fde8172db0ea
SHA1 5cbd55f2f3fdf2403babf630e38eabf5bc57d8ca
SHA512 444f4d0b2ce5ce04ad5b0fbb99310421ec863408fc7e602fa9cbfb54f6a1528e0845e49aa668219a6a713d9b758fe1ffc981100187dc85e7960d017a567b0d39
SSDEEP 12288:ZCluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:ZpofITNUohc3C5pPc66a0t
TLSH
T1DBD423A1D10F5992D866B87758397181BE7946B5BB830FC3D5C837EE97E03C813324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3ec5d8e0fbd9f760210d4cccca79b28f60c605d72dffc572660678912d03ff73
MD5 fb356c50074e5c116983f0e4bc89c958
SHA1 af8107fe5e3d213a0cacd639292afeafb8485384
SHA512 651df4ad73c925bb68267cd19e14312ecd1f69287db6aa991e6bf82922f3faac73731b67093e3f18f153200bd3e285570b6f721c3d6e1cd238e972b1fe3717c8
SSDEEP 24576:O1X8u8FpJqH1t6ria7/msTofITNUohc3C5pPc66a0t:OMZFPqVxa7/XoDWcF
TLSH
T1ED350165A6E101F1D47BE138894646A3FAB2B4251361EFDF07A88B951F237D40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 d2c2fe7225f2dce743bc13ff10622c7c867f9a9b36e927262653091e1f85bfbc
MD5 867d8376da8ca946d1be38a973ae77d2
SHA1 142be5c3cbd5f37d08497406c6f8fb6266c762a7
SHA512 30bfc6502220de6800263781ff0b35a1442850f08484c75ac8683569e503647dfd2b3e8c90be9b90d915a8f8edd2e829d020c3b520546cb022e8f3c978822adb
SSDEEP 12288:FHvUrBFrEjwaQJluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:FPUr+NQCofITNUohc3C5pPc66a0t
TLSH
T10805F12F62AD1CE5E67AF13D89468709F771B462171296CF02D0417E4F63AD8BD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 44ed9d237f01a823b1534c389fa31920f78bb5f847385e1afcfcb2d7a0fbe8ee
MD5 87f21aa31394889ca92387e1219a8c59
SHA1 48458c2ab3dc4f727c77f67493429580e3d4ff0a
SHA512 0352f4678571f9ba70e67c004526a32d3c3332741d295d93073a99d7b7a1200868f00da4518905c5a1fbef2b5482568b00557827b8aca66486ca8063fbce80f6
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjooDWcF:tG05lO43bLqb
TLSH
T144D5CF6A62EC11F9D1BBD17CD9C6460BEBB23825033556CF02A486A91F23FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 59a64fe0b05091771ffd37be7fc2501f9f5a39b131645611f1b5d5b8eae5c83e
MD5 b9479828d075893afb57f6ad510b4a6d
SHA1 ec3828455d8d37f28af612feeb53f4231d837399
SHA512 05715d81678a3ce0973663e6fcb034ab5ecab31eb0affe5084263117f61db36ffd76051ba182b26c3ec1fcdc6b5d0a0ec1dffba16a3e9b3e8a881f7492c3297a
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkrnofITNUohc3C5pPc66a0t:NNc/zEOVHFenoDWcF
TLSH
T187858B2663E901E4E5BBE1BE89779546FA71786513308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 5288e3bb642c37d7c941a76bfa11b837ad3fa4e81221b4e766e714a233e7f05a
MD5 1ce47cba89ff98dc990a7e6a8c64349b
SHA1 e864a241cc6e72da331aabd749d21886dc0b192d
SHA512 c4b9dfe8ce9cc8c0b8949f316951c1a423b4cb895b447a56f1a3d711ab7f099348be7fbe6d6d2fa4e8a3efe17dd450a87100e72c6a71dc9d634397332f734859
SSDEEP 12288:/dHPJnJP6szeCs6Rl28dXSluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2G:xJnJPbzB4SpofITNUohc3C5pPc66a0t
TLSH
T1A215D03DD2A810E8E4B7C2B4811A165AFF31387D2B2269C759B4D5353F52FD0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 16d60989caffcd37b1d894a469ece5ba92242b5404331611d9b7e971abd17d72
MD5 2061531486e175e361efb52577a44f72
SHA1 17ce7844e11f291d0dbc71cc547293eef1edc5a1
SHA512 79095220060432f2a40a008a0ed792af7bfca5ca20b057276a38c3f52f1fb4ff8cf3d0d85cc7d143fb44c9fb1bbdfc6420e32691778c4f57537032c485c3ca8c
SSDEEP 12288:E1Hck6j5ZI7+luow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:M6DIBofITNUohc3C5pPc66a0t
TLSH
T13D05015D637A10F5D06BE03E85530102E6B2B1B197531ADF4AD485BE8FA3ECCBA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 131344357459d4d21f132c2ebfc56bd81f8f7d91d8b94b22252285d18e0ba895
MD5 326622a416f9555e624c0784aa0be86e
SHA1 0c3c75039a6b2f5bc5fd1a4c5af6cdc4600f3ba0
SHA512 d2f6406145335b088e4cf744226eaa90cf6b61d9c560c62ac68d3ad4f3c589dddbcb6f4cb711c1d126217ed73e1a8d75ae5752de0e19c9cd7d2cddb61e8987ea
SSDEEP 12288:9G6kyQluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:EtyDofITNUohc3C5pPc66a0t
TLSH
T1B3F42200D39864D5E9BA653989378190AF39BC30AB234BCF95C0B77E6F713C46A31B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 c61f96d4475386f4a9cf429d9e8b93a40726ea8b46d8656b69b8e08e3ce7583f
MD5 cb0827b1c7802b5122bf1579f3f182ba
SHA1 815b79ae9110117a4d234294369aa19a266abc45
SHA512 b7964fb8bab791cdd5a6d70df85debe2447846c46f6bf72e386d9afa7d9717fdedff04caa29cb9bae9aacc3a4634f044ea97778b0b915b471888f5a6270dd37e
SSDEEP 12288:XcmOluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:sSofITNUohc3C5pPc66a0t
TLSH
T1A3D423B5D20F69A2DC56B87A043D2281AA7956B57B530EDBD8C427FDCBB03C81332C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 31d6c427e865dfbcb7499f2bdefa95a2116c871a7dba4cf2bb377dbd8f46a664
MD5 1b972f3fe037a9235737b8a72a5ffedf
SHA1 6e07f6d4e60a6a855334744b1cbc63eb8da1426a
SHA512 0c1de807bf7eafb93d9c623ad54fb1e49465692884b849a1f75eec27a43093d9d617c7f54488850172e9f596ce606486cc421465df1108197f5e03e0417e4338
SSDEEP 24576:KPgd+noTfaidZucofITNUohc3C5pPc66a0t:MgYoTrZXoDWcF
TLSH
T1ED559D1DA7EA05CAE2B2D675D8721493D633B4315772C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-242-0x000002122CDC0000-0x000002122CE26000-memory.dmp

Download

memory/944-241-0x00007FF7906D0000-0x00007FF790799000-memory.dmp

Download

memory/944-243-0x000002122CDC0000-0x000002122CE26000-memory.dmp

Download

memory/944-327-0x00007FF7906D0000-0x00007FF790799000-memory.dmp

Download

memory/1508-319-0x00007FF61DA20000-0x00007FF61DCC3000-memory.dmp

Download

memory/1508-321-0x00000213B24A0000-0x00000213B2506000-memory.dmp

Download

memory/1508-320-0x00000213B24A0000-0x00000213B2506000-memory.dmp

Download

memory/1844-251-0x0000029E24640000-0x0000029E246A6000-memory.dmp

Download

memory/1844-250-0x0000029E24640000-0x0000029E246A6000-memory.dmp

Download

memory/1844-249-0x00007FF70D0D0000-0x00007FF70D1EA000-memory.dmp

Download

memory/1844-336-0x00007FF70D0D0000-0x00007FF70D1EA000-memory.dmp

Download

memory/2084-351-0x0000020F201A0000-0x0000020F20206000-memory.dmp

Download

memory/2084-349-0x00007FF639BD0000-0x00007FF639E5B000-memory.dmp

Download

memory/2084-350-0x0000020F201A0000-0x0000020F20206000-memory.dmp

Download

memory/2524-300-0x00007FF7394B0000-0x00007FF7398C7000-memory.dmp

Download

memory/2524-299-0x00000251A4DA0000-0x00000251A4E06000-memory.dmp

Download

memory/2524-301-0x00000251A4DA0000-0x00000251A4E06000-memory.dmp

Download

memory/2736-282-0x000001B5837D0000-0x000001B583836000-memory.dmp

Download

memory/2736-284-0x00007FF7C5DC0000-0x00007FF7C6504000-memory.dmp

Download

memory/2736-283-0x000001B5837D0000-0x000001B583836000-memory.dmp

Download

memory/2892-233-0x00000266EC320000-0x00000266EC386000-memory.dmp

Download

memory/2892-232-0x00007FF7906D0000-0x00007FF790799000-memory.dmp

Download

memory/2892-318-0x00007FF7906D0000-0x00007FF790799000-memory.dmp

Download

memory/2892-234-0x00000266EC320000-0x00000266EC386000-memory.dmp

Download

memory/3232-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3232-355-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3232-276-0x0000000000A00000-0x0000000000A69000-memory.dmp

Download

memory/3232-271-0x0000000000A00000-0x0000000000A69000-memory.dmp

Download

memory/3276-43-0x00007FF711AD0000-0x00007FF711C38000-memory.dmp

Download

memory/3276-44-0x000001ED0BD50000-0x000001ED0BDB6000-memory.dmp

Download

memory/3276-45-0x000001ED0BD50000-0x000001ED0BDB6000-memory.dmp

Download

memory/3276-50-0x000001ED0BD50000-0x000001ED0BDB6000-memory.dmp

Download

memory/3276-52-0x00007FF711AD0000-0x00007FF711C38000-memory.dmp

Download

memory/3328-57-0x0000020568E00000-0x0000020568E66000-memory.dmp

Download

memory/3328-55-0x0000020568B20000-0x0000020568C96000-memory.dmp

Download

memory/3328-56-0x0000020568E00000-0x0000020568E66000-memory.dmp

Download

memory/3412-27-0x000001CD08200000-0x000001CD08266000-memory.dmp

Download

memory/3412-25-0x000001CD07FB0000-0x000001CD08126000-memory.dmp

Download

memory/3412-26-0x000001CD08200000-0x000001CD08266000-memory.dmp

Download

memory/3412-28-0x000001CD08200000-0x000001CD08266000-memory.dmp

Download

memory/3524-343-0x0000016768490000-0x00000167684F6000-memory.dmp

Download

memory/3524-345-0x00007FF765A00000-0x00007FF765D21000-memory.dmp

Download

memory/3524-338-0x0000016768490000-0x00000167684F6000-memory.dmp

Download

memory/3524-339-0x0000016768490000-0x00000167684F6000-memory.dmp

Download

memory/3524-337-0x00007FF765A00000-0x00007FF765D21000-memory.dmp

Download

memory/3948-22-0x00007FF606460000-0x00007FF606580000-memory.dmp

Download

memory/3948-19-0x000002F5EEB00000-0x000002F5EEB66000-memory.dmp

Download

memory/3948-0-0x00007FF606460000-0x00007FF606580000-memory.dmp

Download

memory/3948-2-0x000002F5EEB00000-0x000002F5EEB66000-memory.dmp

Download

memory/3948-3-0x000002F5EEB00000-0x000002F5EEB66000-memory.dmp

Download

memory/3948-1-0x000002F5EEB00000-0x000002F5EEB66000-memory.dmp

Download

memory/4092-261-0x00007FF7549C0000-0x00007FF754B0A000-memory.dmp

Download

memory/4092-263-0x0000022C28C70000-0x0000022C28CD6000-memory.dmp

Download

memory/4092-348-0x00007FF7549C0000-0x00007FF754B0A000-memory.dmp

Download

memory/4092-264-0x0000022C28C70000-0x0000022C28CD6000-memory.dmp

Download

memory/4212-13-0x000001E8BB520000-0x000001E8BB586000-memory.dmp

Download

memory/4212-12-0x000001E8BB520000-0x000001E8BB586000-memory.dmp

Download

memory/4212-11-0x00007FF6E9EA0000-0x00007FF6E9FC3000-memory.dmp

Download

memory/4212-61-0x00007FF6E9EA0000-0x00007FF6E9FC3000-memory.dmp

Download

memory/4212-14-0x000001E8BB520000-0x000001E8BB586000-memory.dmp

Download

memory/4236-290-0x00007FF6B6FE0000-0x00007FF6B708E000-memory.dmp

Download

memory/4236-291-0x000001FD2D0C0000-0x000001FD2D126000-memory.dmp

Download

memory/4236-292-0x000001FD2D0C0000-0x000001FD2D126000-memory.dmp

Download

memory/4472-311-0x0000029BA5850000-0x0000029BA58B6000-memory.dmp

Download

memory/4472-309-0x00007FF635440000-0x00007FF6354F4000-memory.dmp

Download

memory/4472-310-0x0000029BA5850000-0x0000029BA58B6000-memory.dmp

Download

memory/5284-34-0x00000196BB230000-0x00000196BB3A6000-memory.dmp

Download

memory/5284-36-0x00000196BB4D0000-0x00000196BB536000-memory.dmp

Download

memory/5284-35-0x00000196BB4D0000-0x00000196BB536000-memory.dmp

Download

memory/5284-37-0x00000196BB4D0000-0x00000196BB536000-memory.dmp

Download

memory/5460-328-0x00007FF6AC480000-0x00007FF6AC615000-memory.dmp

Download

memory/5460-329-0x00000234E32F0000-0x00000234E3356000-memory.dmp

Download

memory/5460-330-0x00000234E32F0000-0x00000234E3356000-memory.dmp

Download