e460d7e597730a15f1377d700bd98bbc4bfccf3816e7174e89c236ec079c39e2

Analysis

max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe
Size 3.4MB
Sample260720-dwfkzagv7s
SHA256 e460d7e597730a15f1377d700bd98bbc4bfccf3816e7174e89c236ec079c39e2
MD5 2fba0bb16b67e58ccb0d1d86478b57ba
SHA1 5ea9e0cd3e5a81d25ab2df117cab2ce50cb620e8
SHA512 c4458eabd9c95a26a2e6a3a1466df72cd8cde5f6baccac3d997eb470f7071979439c2321c6ccfd8fb77f67ec6810e8b398bb516185c7a028c569d4190eb6ab6a
SSDEEP 49152:0vj9HjNZZIpT1EQkGok4PetnsXqDWtrOtPLGH1GJ5DmWV9SCbJB5AQMRHI1bNFW1:0vjFBIpT0GX4WtvDW49GHEHmcNFkg
TLSH
T1F7F5CF12FA4149B9E9D31174E2EF577A4A396F20033588C787D03FA99C325D2BA3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3560	alg.exe
5000	elevation_service.exe
5892	elevation_service.exe
4460	maintenanceservice.exe
4708	OSE.EXE
4632	GameInputSvc.exe
5412	GameInputSvc.exe
5520	msdtc.exe
4880	PerceptionSimulationService.exe
1648	perfhost.exe
4552	ReFsDedupSvc.exe
5028	locator.exe
4156	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\20497a1d744edbe.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5412	GameInputSvc.exe
5412	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2880	2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe
Token: SeDebugPrivilege	3560	alg.exe
Token: SeDebugPrivilege	3560	alg.exe
Token: SeTakeOwnershipPrivilege	5000	elevation_service.exe
Token: SeTcbPrivilege	4632	GameInputSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5412	4632	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2fba0bb16b67e58ccb0d1d86478b57ba_amadey_coinminer_elex_glassworm_luca-stealer_njrat_qakbot_revil_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4460

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1648

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5004

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4148

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 165fc1499e0770f58a09e7bf7b7b1d93ec0ed54f7a17b3c93ab0e53c902bc6cf
MD5 390ac0fcc84b3562958ca06cf12cebec
SHA1 2317b5999b41f63902111753a4706b6251f2ec76
SHA512 6df84908e9289726094b0f5ea77f76aea4ecb06a7f158583f541f8a91df3db1eac2214232c0fb4f17709a8dbdafc071f34f314c730a6d82581c81c2a8a6a88d5
SSDEEP 49152:Sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnsHI1bNFWbELK+vk:03q6gjBGNFkg
TLSH
T10FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 ca6e30c953de701dfe0fa94be733c0bb86cd7d5d4cda7c0ee44d20a508256ef8
MD5 212c67e29df9c86dedbeacc6a6430f70
SHA1 523949a07bf907d9cdbe3ba0b3520b9cbbb162c3
SHA512 cf57442d9da8fd13589a87ec8d8b9a4fc9a06876d49b3f76f599327da6cb59ad15b37c8ea328f6b27c9f4248dd0a65f4329437948ad3a9e30b5f5a71df79fa0c
SSDEEP 24576:KXYO7jczA3SqGFI/dbNfLbFWsIafvLK+91y+u:ijcrHI1bNFWbELK+vk
TLSH
T115050229B79408FDFD67913DCCA28512E633B89247A4E78B03E446265F233D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 98ab94b073fce498313cc9cba0a9607a6c8733c2463170d85a4665d3218d8ef8
MD5 a666f5c55dcad687ce40a78e6e06dd80
SHA1 b16ed5a6249571c80d06266cc51784d05c31bec7
SHA512 cde6d0df42ff31ab157b4785eedc7bd65ad33e0aea92b523e8e84ccc1fbbfe42abfffb48a9e274b642b59e15c55f69c4f6d13fc477cac98086645f6e9a61870c
SSDEEP 24576:Owu+OWLSqGFI/dbNfLbFWsIafvLK+91y+u:OwlOdHI1bNFWbELK+vk
TLSH
T16305F04A76A80CF9F9A3513985578136E7B3B8122A65D71F0760C71B6F33361BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d4b7f37d227f1767148bb5f10d018eb802583d3bf7e3b748069c14561a0c11c
MD5 b43a85fee019ac5e66a67d879303add3
SHA1 ded4e525e879e8a14d1ff032524e113b778c7358
SHA512 0b4af7a098b28679933662befd4b2dc95f5087ba3f39aec15c87b88efde009e5338eb70426342a4c8c3963691202f91c8a029742c46df352e14d8b11deb6087e
SSDEEP 49152:nB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gleHI1bNFWbELK+vk:pu6JmTxd2dlNFkg
TLSH
T188D59D13F1DA01E8D05AD478974A9233FA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 18aa8e0bdbdbb927f70c938d34b356da895120df12c7e25bac5e2c946d174369
MD5 7fa49fc429ae27f808d1ee3ea2c0f250
SHA1 be78992236588a34c8d482701e94560d69ae1c52
SHA512 6630f90f2d7cf987b4ac6de2906f498968ed96a347cc2a1cbb10a73af7b2fc80f1f67b61b7b105134f8c0e6de1432cbd5b52f79133aa8625ccf4ce791740d8a8
SSDEEP 12288:BG7mK+XDmqGFkT/dpNzKOfYhObFWsvYrtafa4UTMKCb9Bu+Ty+uhMo/Eg:MaSqGFI/dbNfLbFWsIafvLK+91y+u
TLSH
T1A8D4232BDB0C15DEFA51347904169172A137B6B39B8AE1CB8A50031AAE337D5FC39B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1322d395c27d5caa4384b11728219851bf39b1ac892057ca287ecdbaca777084
MD5 ac03260a55fdcb406387b9246726c846
SHA1 724337f59e5a5404bb376f7767fa290936d5dba8
SHA512 f5fe084f728643eb16e114ba53756f78573b25c0babac94d7347b3f29231e09abc42a28a6196f2f15f1d2b6108c2ce32a1b7b4bfd816b3f43c038690cc3e383f
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYMSqGFI/dbNfLbFWsIafvLK+91y+u:hgb4mBIBhGFIHI1bNFWbELK+vk
TLSH
T1F165AE1E22EC02F5E1F5E2B89DA64417D6B378160732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 9da1b27e2d65cfb6b291b0f175e2e8679baf06bc988dd0bca5d09537daec78cd
MD5 99668ee2b229d9a4e1ab8ec54fddaa9c
SHA1 7f269f5fa344a1a29f2e638fa47a3a0d55ac9772
SHA512 292ba76fb1a3fc6552e4914da0b920c0317b25b5e8afd516ad02aabaf851053a000291a4023ecafb8fdd9a1bb9be6436fc43c0621ebf2ade0bfa6056ee9393de
SSDEEP 12288:miGA+XDmqGFkT/dpNzKOfYhObFWsvYrtafa4UTMKCb9Bu+Ty+uhMo/Eg:9G9SqGFI/dbNfLbFWsIafvLK+91y+u
TLSH
T153E4222EA96D30D8F932A13E44215063B47371B2975AA1DF49E0523AEF276E0F53DF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 23e262e7308bc19bf1f57bfc8e18ac561283716d1c01531218ea9ae87116bca6
MD5 2b9e3a9c99471bbf687ef9709d69aa7d
SHA1 b584a8cef63ff765760ee09410ed414fe2c231f5
SHA512 e8081c9bf95cd28ba8b1ff1a48b0588cec1541a942c691c77a603bffaed3d67c70a0e7189e95516c460ca1523e01c1262676bf57b2432357f22448f67798e84f
SSDEEP 12288:/C+XDmqGFkT/dpNzKOfYhObFWsvYrtafa4UTMKCb9Bu+Ty+uhMo/Eg:/LSqGFI/dbNfLbFWsIafvLK+91y+u
TLSH
T112D4235FEA0C11CEFA42343E04125462A17396B397CBE1CB89A41317EF676E5F439B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 761255411421e211ac5955535028b3aea83553030c630d0877a414b41a27fe66
MD5 3637728ab4487209e4426fb0d2cb2776
SHA1 f7efa5dd84ba468637c093a4bcae7c2abb28e963
SHA512 4c3feb7f5ba37c13e10205d4d9e724258904f2a072d709c6c2e1a58a3945a35f3d7a4281ca9ee40b781e4ea03c77f6a44e290838cb395fabe124768a9f158099
SSDEEP 24576:itP8V8F8JqH1Mzria7/mPSqGFI/dbNfLbFWsIafvLK+91y+u:qkGFUqVra7/tHI1bNFWbELK+vk
TLSH
T1C235F165B7E401F5E477D03889424663F6B2B4220364EBDF07A88B561F23BE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 06dace4ce9c911652a95d904614052eeaebf27a83525cd0f610bd2cadfbaa585
MD5 55fe303168b896682d4f6cc65c2b495b
SHA1 617f7eb042722c46bb3ce7792983d1fbb8c3b82d
SHA512 9b665aae0b04cc5a206e984a3ff67e22648bb19edbd44afe230b9f342fa06b7df57db6c2df980593fb6e66e1479ce8270f1e480f33a8a27bcb3e3114247a9d31
SSDEEP 24576:6PUr+NQoSqGFI/dbNfLbFWsIafvLK+91y+u:6JQHHI1bNFWbELK+vk
TLSH
T17905E12F66AC18E5F676A17D89428619F772B4621752D2CF02E0413E5F27EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3300bea257eabc62f49bf496ec5ff5edb4f6de9a34f2b7ee55d53c06faeae187
MD5 1dbb1a8dbcf9b9f84123207b2c0a79f5
SHA1 abc6b70179215729f025cd67024d2c7ea060196d
SHA512 60af863441f4b9322a60abe418279d0a6d80d31173b037c80697d5ec668d65442a9c27b9202199b29c7251f995fdb0ace5b4f3caf07058eedda4fc67a8568c40
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVHI1bNFWbELK+vk:eG05lO43brNFkg
TLSH
T15BD5CF6E62EC11F9D1BBD07CD9C6460BEBB23425032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b47a2ed525b372785c08bcd946075183ef6ff7063b5984722a37ed206ff066e9
MD5 c0cd386058c54e0973c2dad98fbceb69
SHA1 dca82515b64619c243203c79b18fa4985f40e149
SHA512 495134ce4bfe913dfb1d4cb4603384880b4e51219a7c69e9416e48f17c5dd53210fd8f1160889733a5d741bf99a849b19b9c3a404f38585ac8ed3b2f6dd83d24
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkjSqGFI/dbNfLbFWsIafvLK+91y+u:fNc/zEOVHF1HI1bNFWbELK+vk
TLSH
T1B4858B2623E901E4F5BBE1BE89779546FA717865133486CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 f5b5923c574429d2d6e419aa28203aa645bd69d7001cb7a765a5a95d9229a82a
MD5 a8d277a144d1e81511a9039a8f8e5f7a
SHA1 80e5002c26fa28737beb91fbfcfc149d372b994a
SHA512 5c2c67f2679e14a46789385bd9349787ab4a71d0ed0dfaa24ba3d68e9f560c8ffec88d9b6f18ae18bfe18d9c4d7c7a4c3c2a2d7259b96a05bea2d0ed5fa9a38f
SSDEEP 24576:MJnJPbzB4S/SqGFI/dbNfLbFWsIafvLK+91y+u:MJnJv6SaHI1bNFWbELK+vk
TLSH
T12515D03DD2A810E8E4B7D274811A165AFE32347D2F2669CB19B4D5353F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 c4a1653362f1df9270a8c90b7534480fa27821936a2387beffa083ff6786f4ff
MD5 67216616048b79167d24b636aa8e9d79
SHA1 34831cf630ff2b91823c6f11a53cc8546e3719d2
SHA512 f4ce6cd31413e1d78ce42b634249170aa1c2a32214669f2a82f5c0d45e3854801023cbb107a78b3d379c56b8e40945b19b2e02dae434bf587a8ed32539948494
SSDEEP 24576:YS6DIWqSqGFI/dbNfLbFWsIafvLK+91y+u:YS6DIIHI1bNFWbELK+vk
TLSH
T178F4015D637A10F9E167E03E85830112D2B3B0B2875695CF0A94867E9FA3ED8B93DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 3d7593232bd79bffb2914b01164160eab7e4dc0daac32a1e736b2fafa7b0df15
MD5 4621f397502d76ce3de18fee5f2e2dcb
SHA1 47bfe9e91b4f027a658ca55aaf5c2e2be94d5785
SHA512 b44f8d91046fed5cb6e52c90c928262238e52b23e490af886d0d4d7c623064334cc49b85d5ab3515e3421e4611fdf5466d3c0ea70e85e61843089e19bd1279c9
SSDEEP 12288:DG6kyC3+XDmqGFkT/dpNzKOfYhObFWsvYrtafa4UTMKCb9Bu+Ty+uhMo/Eg:StyCuSqGFI/dbNfLbFWsIafvLK+91y+u
TLSH
T1FBF41209A75C20D9FAA62138496281A19A33BC329B56D3CF45E0933F6F377E4F835B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 1f7bc929001c83b7136efa5be48fe499d021da3f6a7302db000531921f8da585
MD5 65c79100bde57fd40b72aa290eb02078
SHA1 40b6f1e85383217dfb0bcf5141fed2867040ad62
SHA512 0f17b226885b153a7d29619475ed3bb79303e713808ca0c872ccceeaae1f18f0559771a1b74b8a523ff49d3a89cfc4db74eaa5f30585d17479826f51939c9d5f
SSDEEP 12288:77Wl+XDmqGFkT/dpNzKOfYhObFWsvYrtafa4UTMKCb9Bu+Ty+uhMo/Eg:XWoSqGFI/dbNfLbFWsIafvLK+91y+u
TLSH
T143D4236EAA1C21DEFA41743A041551629173B2B35B8BE1CF49E0033AEF276E5F539F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 9c84dbfb959b03a0ab7bf04cdb510f391d6e45a8364fdc43b1e2617714fca1da
MD5 50b986ee39acf8d7ea314a0dbf775231
SHA1 37ccb764a9240f7833b0c97b93b14996cd9995e6
SHA512 b595824579b203238f74a8d687cb5a02b5f58db3782456fee4b4ce911dd7ab4c82840a5d4e87ae0e055aabd7c0694dcce2d8465e51f84b376a41cb74645e7af6
SSDEEP 24576:pNgrLoTfaidZBSqGFI/dbNfLbFWsIafvLK+91y+u:bggTrZoHI1bNFWbELK+vk
TLSH
T179559D1DA7EA05CAE2B2D239D8725493D633B4315772D6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-358-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1648-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1648-274-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/1648-279-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/1852-341-0x00007FF6F6880000-0x00007FF6F6BA0000-memory.dmp

Download

memory/1852-340-0x000001C45D590000-0x000001C45D5F6000-memory.dmp

Download

memory/1852-342-0x000001C45D590000-0x000001C45D5F6000-memory.dmp

Download

memory/1852-346-0x000001C45D590000-0x000001C45D5F6000-memory.dmp

Download

memory/1852-348-0x00007FF6F6880000-0x00007FF6F6BA0000-memory.dmp

Download

memory/2720-353-0x0000019A52D50000-0x0000019A52DB6000-memory.dmp

Download

memory/2720-354-0x0000019A52D50000-0x0000019A52DB6000-memory.dmp

Download

memory/2720-352-0x00007FF687B60000-0x00007FF687DEA000-memory.dmp

Download

memory/2880-1-0x0000000003050000-0x00000000030B9000-memory.dmp

Download

memory/2880-6-0x0000000003050000-0x00000000030B9000-memory.dmp

Download

memory/2880-0-0x0000000002D80000-0x0000000002EDC000-memory.dmp

Download

memory/3560-16-0x000001F6BE210000-0x000001F6BE276000-memory.dmp

Download

memory/3560-17-0x000001F6BE210000-0x000001F6BE276000-memory.dmp

Download

memory/3560-18-0x000001F6BE210000-0x000001F6BE276000-memory.dmp

Download

memory/3560-15-0x00007FF60A040000-0x00007FF60A162000-memory.dmp

Download

memory/3560-65-0x00007FF60A040000-0x00007FF60A162000-memory.dmp

Download

memory/4148-331-0x00007FF7EF0D0000-0x00007FF7EF264000-memory.dmp

Download

memory/4148-333-0x0000029377A70000-0x0000029377AD6000-memory.dmp

Download

memory/4148-332-0x0000029377A70000-0x0000029377AD6000-memory.dmp

Download

memory/4156-302-0x0000026426E40000-0x0000026426EA6000-memory.dmp

Download

memory/4156-303-0x0000026426E40000-0x0000026426EA6000-memory.dmp

Download

memory/4156-307-0x00007FF65F250000-0x00007FF65F666000-memory.dmp

Download

memory/4460-55-0x00007FF7A2080000-0x00007FF7A21E7000-memory.dmp

Download

memory/4460-48-0x00000224EBAC0000-0x00000224EBB26000-memory.dmp

Download

memory/4460-46-0x00007FF7A2080000-0x00007FF7A21E7000-memory.dmp

Download

memory/4460-47-0x00000224EBAC0000-0x00000224EBB26000-memory.dmp

Download

memory/4460-53-0x00000224EBAC0000-0x00000224EBB26000-memory.dmp

Download

memory/4552-285-0x00007FF7A42B0000-0x00007FF7A49F3000-memory.dmp

Download

memory/4552-286-0x000002A190130000-0x000002A190196000-memory.dmp

Download

memory/4552-287-0x000002A190130000-0x000002A190196000-memory.dmp

Download

memory/4616-311-0x00007FF77F860000-0x00007FF77F913000-memory.dmp

Download

memory/4616-313-0x0000019702470000-0x00000197024D6000-memory.dmp

Download

memory/4616-312-0x0000019702470000-0x00000197024D6000-memory.dmp

Download

memory/4632-236-0x0000017ABBED0000-0x0000017ABBF36000-memory.dmp

Download

memory/4632-237-0x0000017ABBED0000-0x0000017ABBF36000-memory.dmp

Download

memory/4632-320-0x00007FF70EE00000-0x00007FF70EEC8000-memory.dmp

Download

memory/4632-235-0x00007FF70EE00000-0x00007FF70EEC8000-memory.dmp

Download

memory/4708-58-0x000002031E5D0000-0x000002031E691000-memory.dmp

Download

memory/4708-60-0x000002031E770000-0x000002031E7D6000-memory.dmp

Download

memory/4708-59-0x000002031E770000-0x000002031E7D6000-memory.dmp

Download

memory/4880-351-0x00007FF76DF50000-0x00007FF76E099000-memory.dmp

Download

memory/4880-267-0x00000203369F0000-0x0000020336A56000-memory.dmp

Download

memory/4880-266-0x00000203369F0000-0x0000020336A56000-memory.dmp

Download

memory/4880-261-0x00007FF76DF50000-0x00007FF76E099000-memory.dmp

Download

memory/5000-31-0x000001FF6D2C0000-0x000001FF6D326000-memory.dmp

Download

memory/5000-29-0x000001FF6D1A0000-0x000001FF6D261000-memory.dmp

Download

memory/5000-32-0x000001FF6D2C0000-0x000001FF6D326000-memory.dmp

Download

memory/5000-30-0x000001FF6D2C0000-0x000001FF6D326000-memory.dmp

Download

memory/5004-323-0x00000254C1F90000-0x00000254C1FF6000-memory.dmp

Download

memory/5004-322-0x00007FF6D1760000-0x00007FF6D1A02000-memory.dmp

Download

memory/5004-324-0x00000254C1F90000-0x00000254C1FF6000-memory.dmp

Download

memory/5028-293-0x00007FF63E710000-0x00007FF63E7BD000-memory.dmp

Download

memory/5028-295-0x00000189C9C90000-0x00000189C9CF6000-memory.dmp

Download

memory/5028-294-0x00000189C9C90000-0x00000189C9CF6000-memory.dmp

Download

memory/5412-245-0x0000025CF7EE0000-0x0000025CF7F46000-memory.dmp

Download

memory/5412-244-0x00007FF70EE00000-0x00007FF70EEC8000-memory.dmp

Download

memory/5412-330-0x00007FF70EE00000-0x00007FF70EEC8000-memory.dmp

Download

memory/5412-246-0x0000025CF7EE0000-0x0000025CF7F46000-memory.dmp

Download

memory/5520-339-0x00007FF7F5D50000-0x00007FF7F5E69000-memory.dmp

Download

memory/5520-252-0x00007FF7F5D50000-0x00007FF7F5E69000-memory.dmp

Download

memory/5520-253-0x000002144A4A0000-0x000002144A506000-memory.dmp

Download

memory/5520-254-0x000002144A4A0000-0x000002144A506000-memory.dmp

Download

memory/5892-40-0x00000277C4580000-0x00000277C45E6000-memory.dmp

Download

memory/5892-38-0x00000277C4390000-0x00000277C4451000-memory.dmp

Download

memory/5892-39-0x00000277C4580000-0x00000277C45E6000-memory.dmp

Download