5e02f117082e4cd737dc32d0451b0f9614663a8d705563d7209cbfc0a1236c7d

Analysis

max time kernel
146s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260718-getm2shv9q
SHA256 5e02f117082e4cd737dc32d0451b0f9614663a8d705563d7209cbfc0a1236c7d
MD5 fce080c7cd8ce44d079e4442365d5eae
SHA1 65c41d1b9ee52c0bf111758036a0dab318a2dc5b
SHA512 5e0b7e59125ce032d49c375a7133a14f36524620a646fc1f8c51361ba7ce360b5fdff8f2c0dd6ad001526349686566d9e597cbc306ce0cd873375b6b8198ba29
SSDEEP 12288:HhwSfxL/2Dc3bDLLmt0LDQewsAj1uj6PoGX11bqtq2nKncB/85O8mICpgllz+4Xo:BmewsAj1lt3qs2MpfvlY1D/fjxX
TLSH
T1E915E030FF75E036C27F0DB62B36D716246CB9204B9219C3E3E8999D59642D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4640	alg.exe
4392	elevation_service.exe
2576	elevation_service.exe
4736	maintenanceservice.exe
1376	OSE.EXE
5608	GameInputSvc.exe
1576	GameInputSvc.exe
5116	msdtc.exe
1168	PerceptionSimulationService.exe
4780	perfhost.exe
2712	ReFsDedupSvc.exe
1424	locator.exe
3988	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\173b4ae08f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	GameInputSvc.exe
1576	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4600	2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	4640	alg.exe
Token: SeDebugPrivilege	4640	alg.exe
Token: SeTakeOwnershipPrivilege	4392	elevation_service.exe
Token: SeTcbPrivilege	5608	GameInputSvc.exe
Token: SeBackupPrivilege	2712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2712	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 1576	5608	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_fce080c7cd8ce44d079e4442365d5eae_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1576

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1168

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:3988

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5728

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4748

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:1632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4812

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c7f0c62578cc04c8a4734af84ac4662bc7a5cd58eec2c156787d45009c24e106
MD5 376ea72f2b89d90fc125d0e1fa08bdaf
SHA1 0566cc9274339da170552fe8733d6e0b4c72d08e
SHA512 12cc591cd523c5cf917958b1116c81aae3ae97805408cfaeeb0074405047f03adf837fb0f3d80e67daa4e9eb6b948f7de28c5aba21d16d4b5b920a81fb5df888
SSDEEP 49152:zIR632BuPkFKRrdE6oh7stBhuXjfS4LWxn7BqBMFveDTZ:H3q6gjBoBqBMFveDTZ
TLSH
T138D59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 ece99303eb1ee760e4bdc490a2c9649dce348c099dd0d8e3a5b7f2828ccb17dd
MD5 5f07819ef04c1f64c2b7e2b811cfc99c
SHA1 0e99d2982732a634e4aab274b759636eb1f944a2
SHA512 96387dac92ab6b25adc75f3c821c95a830d99c497663bff37c98412e2ec4580d89cb4f2ba546a30df1489f46bdedac051623a36238645949af8210599be38b97
SSDEEP 12288:p1XLs1MC2x1ExVz2czABuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnZ:nXY6VVczABlt3qs2MpfvlY1D/fjxX
TLSH
T143050128779109F9EC6B827DCCB28611E673B85047A0E75B03E495691F237C85E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 01dcbcd42fb3bac1bf2d873e1be3ee702e638db11148948d543803aab882b995
MD5 3d04ea8240a62409d360763a90e1e53b
SHA1 517f6afce35c0900b5168fd02261ae7c472066e1
SHA512 fcfd6d678084fc502faf1ef3b5f3372768437230d391ab8fe9c03e6be35837d899bf1b4a67f5dc52d73e44fe19b063d377418c43f76eb949ad8ef1ec7ea24173
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C0uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/d:Owu+OW/lt3qs2MpfvlY1D/fjxX
TLSH
T1F505F14577A51CF9E96A8239C957C236F7F2B8112A22C72F07A0C25B5F27351AD2DB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bd056668c4f73d919f27110ab5ded0bb1176e66278dce54ed7f7ecd442e67276
MD5 ae3c91cae6ce0b8f392d94a179f43a64
SHA1 a7b1ac6c252308b9e1164259e695e55dfa27cb14
SHA512 789cf51a564d97eac5bd7a84419df7545114c7fb08705e3f1cbc0fe2f52dbbc013b1af572f74b9b4de28f6f7c19c22c77d47fdf5a0677adbc12345749bc5cd52
SSDEEP 49152:es+taZ3usBWOBr4tEGp0bqx0z+n217aau1glcBqBMFveDTZ:Nu6JmTxd2dcBqBMFveDTZ
TLSH
T1C3D59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 c9293df345c5248772b9beaf34dc901623f2b4cb2744ada84a7f2a89bb18d222
MD5 3635ae0ef167ef0733baceba74a28864
SHA1 78f32034c94254494f9f45b120ee27880760a86a
SHA512 23db15051c3eca3e2e4032e346f05e2e5c11d33209efa39a6bad68bbaf9e1a6d4b38e52180090dbb0d098500a660fa8ed88b1a3c266f918361ca9511f7346869
SSDEEP 12288:B37auj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:Falt3qs2MpfvlY1D/fjxX
TLSH
T125D42341AB071696F53C46FABD7E63307191B530AB83C032EF5BB1A96C54EC4A4E4D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f08f87ed6db4d3886a246bb4c5d8ecebf532775b9b9edff2acd2b5937dc6ad64
MD5 99a0b60fcbe6c2a39f4095ddb15be266
SHA1 5dcdb7a8c98227e1b70e696511191228e0cc4069
SHA512 952fa3b9f27af5fd4603f76a3256708eb0801f988b0153f5217162855c3a73061e48402b464b2d4a648160c85f32930dd4f29605790dfb2cd992601cf4543e2f
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYyslt3qs2MpfvlY1D/fjxX:4gb4mBIBhGFyBqBMFveDTZ
TLSH
T1C465AF1E22E802F5E0F9D2B8DDAA4417D6B278160732D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 08ce23abc1bf88d0d9253d2f06c684225b654337af646765a86999cc51dfcae6
MD5 de3e2aca43f4dc25281d9c272a88b5a7
SHA1 6e4b3626fd35377163aa6739ebdb2f1713ade4c2
SHA512 c51a68d4382ef516db0f85df1d0eeed17d860d2677934e1a5fdb338b3e969139f658b910d40644e1946cc3a319e84d5b3a145659fcbc4656bd29d988e98ff4af
SSDEEP 12288:7uGLuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:yGLlt3qs2MpfvlY1D/fjxX
TLSH
T116E42258766731D8C53D82BAA87A6722B0F07060A74291FF8FE6F0799F44AD07178C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 9fcd7b1ddf36f5d8a1ff79417c3b1daa12def96f86efb4a5aa3876dc741e5758
MD5 20f95f82a7b7ab2f808b36dd5ef5191b
SHA1 902799047bfab0f48bd5e9f52126a5626a78f3f9
SHA512 114408f2a76b72db4660a620aab26560028012d9c436181dfa366b16cd056839399419c679f78f5767f67a85a56377670f632d857f2397bf8d972de9fc0bc8e1
SSDEEP 12288:gvRuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:gvRlt3qs2MpfvlY1D/fjxX
TLSH
T110D423406B031696D63C46FBBD7E672170D0B520A78381F3DFABF0A95D89AC560B4C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fcd6c8b0a6fdc63cce09bbd8841fd7ec984947f646c0f9c3cba5ef57bec12f30
MD5 3a07375be413d6bbad292a21fdb47bd6
SHA1 1b261b84419e05cee691df311d9a02dfacdfcd9d
SHA512 f619239bb3020ca16a15a58a2a253ff4e17f7bba42f486a7cfaedd5cd39e473c9e96c6e08452de82985a7735c68e19f4e668443c009680039f4dd2c7981614d3
SSDEEP 24576:Kmm8W8n4JqH1Mzria7/m/lt3qs2MpfvlY1D/fjxX:5lBnwqVra7/eBqBMFveDTZ
TLSH
T10C35F16577E102F0D47BD13889964763F6B1B4210361EBEF0BA88A551F23AD50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 a9397920e435c5ef80178f1814888fd9d4479e61a71c66c6a984ec42d3f81c23
MD5 8370962c9f2cca06c1f8de6f440aac12
SHA1 d277b024ae22f854028e2501e52fd974c205f5ea
SHA512 40d92c9a7767d1f7e806078052f1e63acff08d34e9e4daac308291b5d1d4315b943c5f304ead8ae9db63031d2f12f7acf35e0edb68ddd75dbc1b9f514ce91ca5
SSDEEP 12288:jHvUrBFrEjwaQquj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:jPUr+NQqlt3qs2MpfvlY1D/fjxX
TLSH
T13105F11E26A918E5E67AA17D89864719F371B4621302D2DF02E1817E4F67ED8BC3DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ea8a43833d02a5355a584ad76d800da74c914e6581baf4c3f3fee0d89b8c0706
MD5 9956aa464e0aed4d11c15bedf594d507
SHA1 e703f9995264942a4f2c68b07a8bddde5e7d54d5
SHA512 3f3384ab406401ee6747400225bbb6fe832ad89a057cc2c2d2a6c06ed359f0bd621623c9bd1b79f18fc1714cec18cfeff3e3d4d92eba400b994fc09614505d9b
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmBqBMFveDTZ:jG05lO43bzBqBMFveDTZ
TLSH
T1ABD5C06E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 183aec35af959a64322740a42f09abee96fc904c1b39953e0989e566c5992147
MD5 44fe6c7194fd02ec24945dfd87f41ecf
SHA1 a781a6407efe49b170c32ac404e42a2514380453
SHA512 9e3e20eff4416a7bcb5257873908db2fb1e9965d4ff29324f347e581b421b9e6c2adb7a94f793d897c162931a45be09f9e406ba235ec0f9b1777c4b83c2102d2
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkRlt3qs2MpfvlY1D/fjxX:yNc/zEOVHFkBqBMFveDTZ
TLSH
T185857B1623E901E4F5BBE1BE89779646FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 22a17e71b398996fd754af1b2b720c0e87d2f609082d8ad72cfbacf491eb1ad3
MD5 bb9d6db790590fd98460b0bce0605119
SHA1 1c5f8f4d4b7be61e302b589a45d16adf8ea8bc5f
SHA512 cc7881ae7d366830e1fd98ae81925c4460c7c85bb801abd59a49e10800e65a613c3bf4ba46b4b79b55b7fa5fa2871825496b697e7ee4e9e5ec7b29a85d0d173c
SSDEEP 12288:QnHPJnJP6szeCs6Rl28dJ3uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/f1:SJnJPbzB4SJ3lt3qs2MpfvlY1D/fjxX
TLSH
T1D215E03DD2A810E8E4B7C2B4815A175AFE71387C2F1269D759B4D4343F12EE0A979F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 c2098946354ff7032ffa3f050959f4505c12c1a827ec8f46cd0dd82adb03adb7
MD5 cffc52383bf71bb1278298d58469876a
SHA1 19955b586e9896d87cd964bb6902801e42e03fb2
SHA512 6f458dfbdee8d786cec3e7a73eb766834b536b1e4b66f729e107df7c597de2604e1654f12abdabc537873dfb3e279f814e4ba8b22fd067986830525901bf2ee5
SSDEEP 12288:npHck6j5ZI7Kuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:/6DIWlt3qs2MpfvlY1D/fjxX
TLSH
T13BF4014C236B11F5D17BC07E96930212E1B2B070975259EF4BE9D1BE4EA3EC8B538E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 ec0b5ec573f8ebcfa924f20eaae106620890907fb2d2bcabe44f275da44e9986
MD5 9a963b3091fb3b8cca348ca967e1449b
SHA1 4fdeefda9f1105d14a77daab3b53924475014b14
SHA512 9512ed5c8bd1ef80e6e2e96621784ef8ed52a43208691ff123e77070c2b7002e7764d97d10b6edbdc686c80fb329faed4dab5021def0eb92f11b1bee9a3bb1a3
SSDEEP 12288:FG6kyguj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:8tyglt3qs2MpfvlY1D/fjxX
TLSH
T134F41300675521D5E67D02B9AE774360A670BC205B5282EF9AD2F23E6F35BD07470F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 80aea8c8e549a0632e849426830346663a700f8024ad9b3499a4f18cae15e5ee
MD5 e9347c196c065e56024cc459be125c5c
SHA1 4dd4b7a36ef24d275885669319c2c10e9270c8c5
SHA512 7d9faa418aeffb1e642a76a58fae60ab132d5b81b67ace3ddeccca4c4a5f370f7523fe32ed66fa3c99e8aab0380fecb17e57c2225ae5f2a242466b89bbdf88c7
SSDEEP 12288:5l5uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:z5lt3qs2MpfvlY1D/fjxX
TLSH
T1BFD423446B172295D93C46FA797E2711B0A0B1306B8381F7DFEBF1B99E49AC160B4C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8209bd24cf137cbb18b4109a7b72ced13b3a69e877e046feae0b2a584e1feadb
MD5 49c03c44aaedec633ce1276ab0408160
SHA1 523ad48325f5e3986927b2281611484f975a6877
SHA512 eaabd7c200a2898fab91263db6711a7505f885c25a616faa9f928eb872faeb87e72ed429b5d745cd64854b6937deae6d62f1d6204a8aff97fd5b1ed48dae91fa
SSDEEP 24576:MZgpWoTfaidZKhlt3qs2MpfvlY1D/fjxX:Ug1TrZIBqBMFveDTZ
TLSH
T1B9558D1D67EA05CAE2B2D279D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-265-0x000001DC95AE0000-0x000001DC95B46000-memory.dmp

Download

memory/1168-352-0x00007FF7183C0000-0x00007FF718509000-memory.dmp

Download

memory/1168-262-0x00007FF7183C0000-0x00007FF718509000-memory.dmp

Download

memory/1168-264-0x000001DC95AE0000-0x000001DC95B46000-memory.dmp

Download

memory/1192-354-0x00000261DB960000-0x00000261DB9C6000-memory.dmp

Download

memory/1192-353-0x00007FF64A430000-0x00007FF64A6BA000-memory.dmp

Download

memory/1192-355-0x00000261DB960000-0x00000261DB9C6000-memory.dmp

Download

memory/1376-60-0x0000028142FA0000-0x0000028143006000-memory.dmp

Download

memory/1376-59-0x0000028142DA0000-0x0000028142EC4000-memory.dmp

Download

memory/1376-61-0x0000028142FA0000-0x0000028143006000-memory.dmp

Download

memory/1424-294-0x00007FF6999A0000-0x00007FF699A4D000-memory.dmp

Download

memory/1424-295-0x00000149CA230000-0x00000149CA296000-memory.dmp

Download

memory/1424-296-0x00000149CA230000-0x00000149CA296000-memory.dmp

Download

memory/1576-247-0x000001FB4C7A0000-0x000001FB4C806000-memory.dmp

Download

memory/1576-331-0x00007FF6825D0000-0x00007FF682698000-memory.dmp

Download

memory/1576-245-0x00007FF6825D0000-0x00007FF682698000-memory.dmp

Download

memory/1576-246-0x000001FB4C7A0000-0x000001FB4C806000-memory.dmp

Download

memory/1632-333-0x000002056B110000-0x000002056B176000-memory.dmp

Download

memory/1632-332-0x00007FF60B160000-0x00007FF60B2F4000-memory.dmp

Download

memory/1632-334-0x000002056B110000-0x000002056B176000-memory.dmp

Download

memory/2576-38-0x000001B906A30000-0x000001B906B54000-memory.dmp

Download

memory/2576-39-0x000001B906C80000-0x000001B906CE6000-memory.dmp

Download

memory/2576-41-0x000001B906C80000-0x000001B906CE6000-memory.dmp

Download

memory/2712-288-0x00000208985F0000-0x0000020898656000-memory.dmp

Download

memory/2712-286-0x00007FF744A30000-0x00007FF745173000-memory.dmp

Download

memory/2712-287-0x00000208985F0000-0x0000020898656000-memory.dmp

Download

memory/3988-308-0x00007FF661D80000-0x00007FF662196000-memory.dmp

Download

memory/3988-304-0x0000028809420000-0x0000028809486000-memory.dmp

Download

memory/3988-303-0x0000028809420000-0x0000028809486000-memory.dmp

Download

memory/4392-31-0x000001AB8E3A0000-0x000001AB8E406000-memory.dmp

Download

memory/4392-30-0x000001AB8E3A0000-0x000001AB8E406000-memory.dmp

Download

memory/4392-32-0x000001AB8E3A0000-0x000001AB8E406000-memory.dmp

Download

memory/4392-29-0x000001AB8E270000-0x000001AB8E394000-memory.dmp

Download

memory/4600-6-0x00000000024A0000-0x0000000002509000-memory.dmp

Download

memory/4600-7-0x00000000024A0000-0x0000000002509000-memory.dmp

Download

memory/4600-0-0x0000000000270000-0x0000000000416000-memory.dmp

Download

memory/4600-1-0x00000000024A0000-0x0000000002509000-memory.dmp

Download

memory/4600-26-0x0000000000270000-0x0000000000416000-memory.dmp

Download

memory/4640-15-0x00007FF6F3320000-0x00007FF6F3442000-memory.dmp

Download

memory/4640-16-0x00000267E93A0000-0x00000267E9406000-memory.dmp

Download

memory/4640-17-0x00000267E93A0000-0x00000267E9406000-memory.dmp

Download

memory/4640-18-0x00000267E93A0000-0x00000267E9406000-memory.dmp

Download

memory/4640-65-0x00007FF6F3320000-0x00007FF6F3442000-memory.dmp

Download

memory/4736-49-0x000001F6ED3F0000-0x000001F6ED456000-memory.dmp

Download

memory/4736-47-0x00007FF774050000-0x00007FF7741B7000-memory.dmp

Download

memory/4736-48-0x000001F6ED3F0000-0x000001F6ED456000-memory.dmp

Download

memory/4736-54-0x000001F6ED3F0000-0x000001F6ED456000-memory.dmp

Download

memory/4736-56-0x00007FF774050000-0x00007FF7741B7000-memory.dmp

Download

memory/4748-323-0x00007FF658A60000-0x00007FF658D02000-memory.dmp

Download

memory/4748-324-0x0000017E001E0000-0x0000017E00246000-memory.dmp

Download

memory/4748-325-0x0000017E001E0000-0x0000017E00246000-memory.dmp

Download

memory/4780-280-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/4780-275-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/4780-274-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4812-341-0x0000023E3C1B0000-0x0000023E3C216000-memory.dmp

Download

memory/4812-349-0x00007FF636B90000-0x00007FF636EB0000-memory.dmp

Download

memory/4812-347-0x0000023E3C1B0000-0x0000023E3C216000-memory.dmp

Download

memory/4812-343-0x0000023E3C1B0000-0x0000023E3C216000-memory.dmp

Download

memory/4812-342-0x00007FF636B90000-0x00007FF636EB0000-memory.dmp

Download

memory/5116-340-0x00007FF690DD0000-0x00007FF690EE9000-memory.dmp

Download

memory/5116-255-0x0000017A5EC20000-0x0000017A5EC86000-memory.dmp

Download

memory/5116-253-0x00007FF690DD0000-0x00007FF690EE9000-memory.dmp

Download

memory/5116-254-0x0000017A5EC20000-0x0000017A5EC86000-memory.dmp

Download

memory/5608-238-0x000002175A7B0000-0x000002175A816000-memory.dmp

Download

memory/5608-237-0x000002175A7B0000-0x000002175A816000-memory.dmp

Download

memory/5608-236-0x00007FF6825D0000-0x00007FF682698000-memory.dmp

Download

memory/5608-322-0x00007FF6825D0000-0x00007FF682698000-memory.dmp

Download

memory/5728-315-0x000001D3539C0000-0x000001D353A26000-memory.dmp

Download

memory/5728-314-0x000001D3539C0000-0x000001D353A26000-memory.dmp

Download

memory/5728-313-0x00007FF710CE0000-0x00007FF710D93000-memory.dmp

Download