323913fc39b31c7fe04a279de5f3e091a9f5706dbc994660880b35d30754fb66

Analysis

max time kernel
146s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 663KB
Sample260720-dlkryadv2r
SHA256 323913fc39b31c7fe04a279de5f3e091a9f5706dbc994660880b35d30754fb66
MD5 5f0c8cb343e032a9360d3dc61f5343e7
SHA1 9b41866dccd561848ee61e16cf4962ebee7bd2af
SHA512 47362baa199d00c698d0862aec4b355168974e842a8bc26bd4e0bf1ebc3d65e08aeeac08e209dae01670c7a2bff570094c2134bce596a880e810f012f2217c8a
SSDEEP 12288:SYmIjEXBUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:uXBU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T19CE42390F7B1D872D4DA49340889C3A5A93DBC301EE4CC6BFBC657968E607D0E51B72A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
4928	alg.exe
4328	elevation_service.exe
4296	elevation_service.exe
3976	maintenanceservice.exe
2884	OSE.EXE
2344	GameInputSvc.exe
2632	GameInputSvc.exe
4604	msdtc.exe
4244	PerceptionSimulationService.exe
2188	perfhost.exe
5632	ReFsDedupSvc.exe
2128	locator.exe
2856	SensorDataService.exe
264	snmptrap.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3346200fe62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2632	GameInputSvc.exe
2632	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1208	2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	4928	alg.exe
Token: SeDebugPrivilege	4928	alg.exe
Token: SeTakeOwnershipPrivilege	4328	elevation_service.exe
Token: SeTcbPrivilege	2344	GameInputSvc.exe
Token: SeBackupPrivilege	5632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5632	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2632	2344	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0c8cb343e032a9360d3dc61f5343e7_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3976

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1496

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:1168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3444

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4644

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8873bb6fb95f9aec9adbcf8cdf1e77b72333c8101411aa38880b7e5c6d2cc65f
MD5 af1ee06ac4a247c8afd4b4ee015b7490
SHA1 0b282f0f1887f9d4863036ed91ccf7959f4f0d26
SHA512 fe380a605969353c7819f8a701079e57ddd8cea26b1f4695753a2e112f10d442d0a8d0f67872072c2db9af771bbcc040dbe6972f18cb15d3f9ca9c04f60e28bf
SSDEEP 49152:6b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnbUY3/y3YIzB3:s3q6gjBpY3gYIF
TLSH
T193D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 607974fe6b6f4710f923b7a60b07879c69b009649239606a811d5494299d0240
MD5 f59c4775d3b95e31160b3a2c4334deb4
SHA1 d21b966f06c526e5fd3c120a6c3d17293583769b
SHA512 5d6c1700d6a9ef44c675b8bfbd6f8ce40eb4bc327a58c91e68ccdbce4e3127c49e0216292574ce961ad0efd9a667c830f2ee5b2bdbb587c96c6b68cfb765b6c4
SSDEEP 24576:mXYZwtczAmU+qXAh9/ylVYj8nUGZukB3D/L:ktczUY3/y3YIzB3
TLSH
T163050224B7E408F9EDAB813DCCA28515EA33B85047A0EB9F03E496655F233D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 0f66667a28e4f88bc98605322992b2265012ba783a2a9f6eba9ba3b37c28c7b5
MD5 2fbe20b7a9b885cbe5c5f77ce0c99800
SHA1 bd516854ac82ee9b943f1f09250434a8dd8a92c9
SHA512 fbf250e143100223de09248e0540c60f7cbe96bf2c54bc0f8e18eb9932c45df85a5398b012cf19b450d8c260d78616b007e9570f9eccea3ef3d9ba72743774c0
SSDEEP 24576:Owu+OWWU+qXAh9/ylVYj8nUGZukB3D/L:OwlOtUY3/y3YIzB3
TLSH
T19B05F18577A40CF9E9A781398587C136F7B2BC012A65CB2F57A0C75B5F233616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dc891680b8d1aa4aadb828a1140ff62e1c036aa1bbcbc914b3257761080a0f9d
MD5 02cea3c40422dd1f75cdb40a052f2ac9
SHA1 79edd5908b25418ab5cbe9f441caca06daf9383c
SHA512 0bc03c247493b88d600a886aad423177653b66d3e73b283e6cc7df21c2b080f7c646f4a381b8e19b8335a3768d4613f7fa5da228c841050d685d03d8bc31175f
SSDEEP 49152:QB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gluUY3/y3YIzB3:Ku6JmTxd2dfY3gYIF
TLSH
T14FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 2aabfe57d36dc5c87a842a942625205fb4a5c0f763287b53d3e404679dffc10f
MD5 c6c9bb460622962dca6bb5fabc7b1182
SHA1 f6dd701466e431bae0549b88435763dd086f8629
SHA512 8fad24add5cc1de91a6a4005396a7be755c796d81005b2f871b48a0e940b5e0515c96ec3c5f68a5e5e6bd49cfdfc084a2e5a8e09449d71b4bcedc893b70b0588
SSDEEP 12288:B07KUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:mKU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1A7D42391E7B95C8AE5EE853508C6921D751DA9101F84CCFFFDC363C49860BC12D2AB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 299751ac939a1ff3320ea474e2e3528b4730d4a9be0f95d5328c1460cf167518
MD5 b690295aaf33d05ac9f6b36c602e4185
SHA1 f0b8f7de8faeb7513cef8982f858a5f7cf57b97f
SHA512 93c02762c0d702a6e6a6bac6a91ed2138ad482c58729bd1ed813ae073dee7a7c80189abb4cd80d71997cfb4bf671a52cac7728dddc218ca4972c9e03ebbbf889
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYQU+qXAh9/ylVYj8nUGZukB3D/L:egb4mBIBhGF/UY3/y3YIzB3
TLSH
T19865AE1E32EC02F5E0FAD2B88DAA4417D6B278160731D6DF1251426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 5bea78b97db998bc14daed7dab354c6cb69ee4c0e96cc35eccd1e197ad5cda95
MD5 8bea23355480c22061f0718c9785ea04
SHA1 2e47acffa169feff29fc43c3bb6ba925c944b4a8
SHA512 331d94496e45ea2966ad9f2ee8eebc2f38b4d3665c891969ace0d57ed0738237050bfc911cd401d9d7fcac08be7fb8c4756360c7ecc97a88c2afbe73ee84bce7
SSDEEP 12288:2fGeUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:AGeU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T162E422A5B6F538C8C5BEC63908D2525AB83074501F549DFF8DD2D3B58E507E0363AE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 a32f9d37af24419c82f742b1e22b55ad07f309a9cb3e36ffd47cef26f8f9c599
MD5 48fd0094a3e78a50f591b931d3f61069
SHA1 7d0c4c0f8256cad0e5590fc7172a00ba66aa4a74
SHA512 f535091d14c1fb8fa49fe91617d125149cc7a6050a61e6a359e6c9d3608b3650ff94e993408fd52b09b9e91127d70aa40ef814f11bc491933e084b0c4f17ca89
SSDEEP 12288:vmnUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:voU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T10BD423C0F6B95CCAE6DE893508C3934D781899101F95DDFFEDC3A3C189907D1293AAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 16d7585a9f443b186c5939ed100fa6af550dee3172d0a3fb66d70901e1b8a16a
MD5 da325edd8e2d50393ff95589cfea39b0
SHA1 010d06acc432de0d42c2398ee853a1fecd7a66f7
SHA512 98f6d5c0a0c6844a1685eaddbf1cb7d9cb0c01d37a55061bcaf07000ae781fc911059dfbae2909ba50af51ce371aa7f6757cd0e9a2ecec042739746660dbc8d4
SSDEEP 24576:itV8u8FpJqH1Bzria7/m9U+qXAh9/ylVYj8nUGZukB3D/L:qqZFPqVIa7/mUY3/y3YIzB3
TLSH
T15A35F165B7E101F5D4BBD13889864667F671B4250364EFEF0AA88B511F23BE10B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 3aa85b8faf1e861b8094ecbe7ec23cac006d5b9dda38aea4c15d843bda238d2a
MD5 350cba1c5be096091aff7d9de60cabd5
SHA1 52352f77704a88dd9fd3fd9a56e7f7a4bad7270e
SHA512 a8070862237745b4be3b977439e5a325660a7f860913075a1a524c4899c4a989d4a9ab0b26deceb4852fb5f034de994b9ae0735f17215cc2e82806db536a568b
SSDEEP 24576:yPUr+NQEU+qXAh9/ylVYj8nUGZukB3D/L:yJQEUY3/y3YIzB3
TLSH
T16D05E15E62AC1CE5E67AE17D8982830DF731B4611711D6DF02D1827E4E63AE87C3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e0515bc65ff6900f4736f72c4a8160ec1c7881b49f2d7f90c38ce76912858b01
MD5 4939ad32d6d43d640d0819ed077f17ba
SHA1 5646baf1184b7a2925b1a5eb8f2b7d713849ffb0
SHA512 91bab19399bd40bad6bbe3d387ea30266b5e779c868b73e1b44a490b9ecd9fdc403708746a75776fadd4c6d3282a66eb75dfa56622fd849694100702b0cedbd8
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeUY3/y3YIzB3:bG05lO43bYY3gYIF
TLSH
T1AAD5CF6A62EC11F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F23FF4697E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 32664d7a42f664cf9ec4fcc399b1d0648ea078da54c28d84293c10db93fcfc0a
MD5 490df34309ee6878dfcbc570ffb9dd00
SHA1 6db0177e071fb5138bb42b6e3b68a77e38f3468c
SHA512 3f02f4447114b6188c8a1d6943591faec7f2878a13c3158fad92c360d43fc03a2d49b0176d973b68dc0b1987af9d805e7a71d2cfb6a822b04edc1b6845c1bb7d
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkIU+qXAh9/ylVYj8nUGZukB3D/L:xNc/zEOVHFvUY3/y3YIzB3
TLSH
T19C858C5623E901E4F1BBE1BE89779646FA71786517308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 b3ca403bca59b8b43def34191feaf3d9e7c1886faf4197e4c97d391a23f2b80c
MD5 bacd1b81fefe5b907e1c32d5e65e1cc1
SHA1 a4ec166b942b2465167de625c652fce654c09f1f
SHA512 930e33fa8d86d2e1db8decd67d23c12a7ddebf0284c188c2ba11677ec19fc0a690fefc6c2260ed62a2219678f0e521c851d6b742ce0839e8ebee8d28cad62a51
SSDEEP 24576:sJnJPbzB4SdU+qXAh9/ylVYj8nUGZukB3D/L:sJnJv6SdUY3/y3YIzB3
TLSH
T15515E07DD2A810E8E4B7C2B4815A175AFE31386C2F2169DB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7df68ddcb8160748492a2007df86e92e618133d23efe71ee69873a63001445f9
MD5 7001420f1807b5574da79d8a2782cab8
SHA1 bb3c2049b3a431739fdf5d9d830cd1b63573cab8
SHA512 9bfd3df5317f00104ecdbb46bf5cd21cfaeb855422b8ac1eef12a2335774caf9d979fadc183fac362895393a2d216cbaada68efb17d220060b54cfb650630e2b
SSDEEP 24576:UCLHGL0MoeVtFumTijCmlKQWDknCU+qXAh9/ylVYj8nUGZukB3D/L:UCLHGeeV5ijCmlDWDkCUY3/y3YIzB3
TLSH
T19EA56B05E7EB5184E8F3CAF5C92294169A327C549B34F7EF4E80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 6ade0acee6d76835d956fa62944dada5b588acb8ecb0ef94d805d0d0b25257c7
MD5 162dbfd341660d0c8967861208a738e5
SHA1 fdbd3981196a222f0a179a00bde570644ceca9d5
SHA512 79cbfc988b920b0bd1ae38708fc3e5f4ed2250a3575b295f28835e5f0e064f06031ee4243d629a01e51f75b0d3514779ceff1e2a195d20c97556378802db99ec
SSDEEP 12288:x1Hck6j5ZI7G4UFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:p6DIBU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1D2F4015C73BA10F9D1ABC03E85830206E172B4708B5259EF4AD5C6B98EA3FD8793DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 01897b908c57cb4983cbeca6ab60046f39b6846fb3545ca947f86a905e202c4f
MD5 ec9715706519bfad55afaf04f662498f
SHA1 4c8526c18feb69ec8d2e584d52f281a863581b33
SHA512 aeb47ad59d45e66fc305212849a58a8bd92c0decaf448ab891428600def546011cc2b18fc664492b5b42d39deaa3ec1e0cd1a5ab7f13e6251e3ca0629919a2bb
SSDEEP 12288:UG6kyTUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:FtyTU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1F8F41240A3B864C9E6FE453848A38298AE34BC101F509AFFA9D2E76E5E317D07C35F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 8e0785842e3cef3e65da58e6f74b278fb8cd5224e71a806ed2a7a2e06f9bb15a
MD5 0cd6b13885565a57c5bc622f689e4d4f
SHA1 136a2adb2da1fbcf4902530420757fe04dadf714
SHA512 11e3096075232a220083cb858c1b8b9689b9390f68f576bf9932c5fecf579ebb2d78a5f20adedd245c0f5110bcbb473d26488d53cf37948e4c2dff9b4e5255fa
SSDEEP 12288:+oWUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:1WU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T15DD423D0F7B928CAD5DE893904C2534E7428B9201F959DFFEDC393A0CA507D1293AE69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8808478810b28ae4fbc6a083ce50b141e0c00afd6cdf6a03a7e1d858b44f8c5c
MD5 8ecafe9ec6c0eba535bfdb3a2a39650a
SHA1 f81764faed2e0d215d2915ed92062139774e89bc
SHA512 3495839061441a516dcb8cd4b465ed6be56e19feccdab2e1c350ba79191ad0152eb66eeb9e807be9fe901960659e8c64296256798bbc84e468d940f1d124a0aa
SSDEEP 24576:SggILoTfaidZqU+qXAh9/ylVYj8nUGZukB3D/L:PgHTrZqUY3/y3YIzB3
TLSH
T1FF558D1DB7FA05CAE2B2D635D8625493D633B4311772C6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cfbba35f137e5f8a65446a24091586997030419fc2f7a12bc88fe305b160638a
MD5 c49517d50c270592dc0bc8dcc798348e
SHA1 f817a7ab2e29a557445407f07c9c5fd3da3ae8c0
SHA512 4c3bf1bfab5a11babf63ad943c17fb44eb922eeba7a4b1e5959fc6193545bfc6e08c72219e21e9dbc341d4a6ad1918fa039a85b4a5e07f34ec493bad8f17c18c
SSDEEP 49152:XDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS38UY3/y3YIzB3:s3Upow8sBmY3gYIF
TLSH
T146A58C3DA2E800A8C9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-311-0x00007FF7B1140000-0x00007FF7B11F3000-memory.dmp

Download

memory/264-313-0x000001DE7ECA0000-0x000001DE7ED06000-memory.dmp

Download

memory/264-312-0x000001DE7ECA0000-0x000001DE7ED06000-memory.dmp

Download

memory/1168-332-0x000002641D7C0000-0x000002641D826000-memory.dmp

Download

memory/1168-331-0x00007FF61DFB0000-0x00007FF61E144000-memory.dmp

Download

memory/1168-333-0x000002641D7C0000-0x000002641D826000-memory.dmp

Download

memory/1208-6-0x0000000003410000-0x0000000003479000-memory.dmp

Download

memory/1208-0-0x00000000019F0000-0x0000000001B14000-memory.dmp

Download

memory/1208-1-0x0000000003410000-0x0000000003479000-memory.dmp

Download

memory/1208-7-0x0000000003410000-0x0000000003479000-memory.dmp

Download

memory/1496-324-0x00000130FB4A0000-0x00000130FB506000-memory.dmp

Download

memory/1496-323-0x00000130FB4A0000-0x00000130FB506000-memory.dmp

Download

memory/1496-322-0x00007FF628B10000-0x00007FF628DB2000-memory.dmp

Download

memory/2128-293-0x00007FF68E770000-0x00007FF68E81D000-memory.dmp

Download

memory/2128-294-0x00000224CEF90000-0x00000224CEFF6000-memory.dmp

Download

memory/2128-295-0x00000224CEF90000-0x00000224CEFF6000-memory.dmp

Download

memory/2188-274-0x0000000000880000-0x00000000008E9000-memory.dmp

Download

memory/2188-360-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2188-279-0x0000000000880000-0x00000000008E9000-memory.dmp

Download

memory/2188-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2344-237-0x00000290506B0000-0x0000029050716000-memory.dmp

Download

memory/2344-235-0x00007FF774390000-0x00007FF774458000-memory.dmp

Download

memory/2344-321-0x00007FF774390000-0x00007FF774458000-memory.dmp

Download

memory/2344-236-0x00000290506B0000-0x0000029050716000-memory.dmp

Download

memory/2632-246-0x0000018111BE0000-0x0000018111C46000-memory.dmp

Download

memory/2632-245-0x0000018111BE0000-0x0000018111C46000-memory.dmp

Download

memory/2632-244-0x00007FF774390000-0x00007FF774458000-memory.dmp

Download

memory/2632-330-0x00007FF774390000-0x00007FF774458000-memory.dmp

Download

memory/2856-302-0x00007FF6BB440000-0x00007FF6BB856000-memory.dmp

Download

memory/2856-304-0x000002360C2D0000-0x000002360C336000-memory.dmp

Download

memory/2856-303-0x000002360C2D0000-0x000002360C336000-memory.dmp

Download

memory/2884-60-0x000001D241D60000-0x000001D241DC6000-memory.dmp

Download

memory/2884-58-0x000001D241C40000-0x000001D241D01000-memory.dmp

Download

memory/2884-59-0x000001D241D60000-0x000001D241DC6000-memory.dmp

Download

memory/3008-353-0x00000147C7EE0000-0x00000147C7F46000-memory.dmp

Download

memory/3008-354-0x00000147C7EE0000-0x00000147C7F46000-memory.dmp

Download

memory/3008-352-0x00007FF6CE8F0000-0x00007FF6CEB7A000-memory.dmp

Download

memory/3444-340-0x00007FF615A80000-0x00007FF615DA0000-memory.dmp

Download

memory/3444-342-0x0000025B32BB0000-0x0000025B32C16000-memory.dmp

Download

memory/3444-341-0x0000025B32BB0000-0x0000025B32C16000-memory.dmp

Download

memory/3444-346-0x0000025B32BB0000-0x0000025B32C16000-memory.dmp

Download

memory/3444-348-0x00007FF615A80000-0x00007FF615DA0000-memory.dmp

Download

memory/3976-47-0x0000028436060000-0x00000284360C6000-memory.dmp

Download

memory/3976-53-0x0000028436060000-0x00000284360C6000-memory.dmp

Download

memory/3976-48-0x0000028436060000-0x00000284360C6000-memory.dmp

Download

memory/3976-46-0x00007FF657420000-0x00007FF657587000-memory.dmp

Download

memory/3976-55-0x00007FF657420000-0x00007FF657587000-memory.dmp

Download

memory/4244-264-0x00007FF7573A0000-0x00007FF7574E9000-memory.dmp

Download

memory/4244-266-0x000001F5EA5A0000-0x000001F5EA606000-memory.dmp

Download

memory/4244-267-0x000001F5EA5A0000-0x000001F5EA606000-memory.dmp

Download

memory/4244-351-0x00007FF7573A0000-0x00007FF7574E9000-memory.dmp

Download

memory/4296-37-0x000001C117220000-0x000001C1172E1000-memory.dmp

Download

memory/4296-38-0x000001C117410000-0x000001C117476000-memory.dmp

Download

memory/4296-40-0x000001C117410000-0x000001C117476000-memory.dmp

Download

memory/4296-39-0x000001C117410000-0x000001C117476000-memory.dmp

Download

memory/4328-31-0x00000173C5A00000-0x00000173C5A66000-memory.dmp

Download

memory/4328-28-0x00000173C5A80000-0x00000173C5B41000-memory.dmp

Download

memory/4328-29-0x00000173C5A00000-0x00000173C5A66000-memory.dmp

Download

memory/4328-30-0x00000173C5A00000-0x00000173C5A66000-memory.dmp

Download

memory/4604-253-0x000001A658EE0000-0x000001A658F46000-memory.dmp

Download

memory/4604-252-0x00007FF702400000-0x00007FF702519000-memory.dmp

Download

memory/4604-339-0x00007FF702400000-0x00007FF702519000-memory.dmp

Download

memory/4604-254-0x000001A658EE0000-0x000001A658F46000-memory.dmp

Download

memory/4644-363-0x000002D94B0D0000-0x000002D94B136000-memory.dmp

Download

memory/4644-362-0x00007FF70D840000-0x00007FF70DD10000-memory.dmp

Download

memory/4644-361-0x000002D94B0D0000-0x000002D94B136000-memory.dmp

Download

memory/4928-15-0x00007FF7A2E80000-0x00007FF7A2FA2000-memory.dmp

Download

memory/4928-16-0x00000232964D0000-0x0000023296536000-memory.dmp

Download

memory/4928-64-0x00007FF7A2E80000-0x00007FF7A2FA2000-memory.dmp

Download

memory/4928-18-0x00000232964D0000-0x0000023296536000-memory.dmp

Download

memory/4928-17-0x00000232964D0000-0x0000023296536000-memory.dmp

Download

memory/5632-287-0x0000020AB0FA0000-0x0000020AB1006000-memory.dmp

Download

memory/5632-286-0x0000020AB0FA0000-0x0000020AB1006000-memory.dmp

Download

memory/5632-285-0x00007FF7E18F0000-0x00007FF7E2033000-memory.dmp

Download

memory/5920-369-0x00007FF707E50000-0x00007FF708356000-memory.dmp

Download

memory/5920-370-0x000001A37B980000-0x000001A37B9E6000-memory.dmp

Download

memory/5920-371-0x000001A37B980000-0x000001A37B9E6000-memory.dmp

Download