f02eb18371ab2fb2ed03f21e197576ec2e594adc80b2a816e23d182d833f4d09

Analysis

max time kernel
145s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_593aef3dba7af21ec2d0cbcd20d0c351_icedid_stealc_vidar.exe
Size 751KB
Sample260731-dlhycaak2y
SHA256 f02eb18371ab2fb2ed03f21e197576ec2e594adc80b2a816e23d182d833f4d09
MD5 593aef3dba7af21ec2d0cbcd20d0c351
SHA1 ab38961f6db92a486029f35734f8f338f968903f
SHA512 56f0ee9cc43233fab09891f5827b9e5eb40df8f09c7296721731d60b4ebbd0fc5098cc1f119d6931cc0055b0bf23483ec719633146f9bd2a843bb985aabf0558
SSDEEP 12288:cR8UdET96Jhor2oBJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:cR7dE56JhqsQdvnXKHINGo4X6XXJHUbt
TLSH
T139F4010B73E621F9E1B64978C8619915F372787947B08F3F02A44277DF226619E2BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3320	alg.exe
1760	elevation_service.exe
6120	elevation_service.exe
2980	maintenanceservice.exe
1272	OSE.EXE
4256	GameInputSvc.exe
4604	GameInputSvc.exe
5336	msdtc.exe
2008	PerceptionSimulationService.exe
684	perfhost.exe
4300	ReFsDedupSvc.exe
4268	locator.exe
4456	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34b076d7e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_593aef3dba7af21ec2d0cbcd20d0c351_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_593aef3dba7af21ec2d0cbcd20d0c351_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	GameInputSvc.exe
4604	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3472	2026-07-31_593aef3dba7af21ec2d0cbcd20d0c351_icedid_stealc_vidar.exe
Token: SeDebugPrivilege	3320	alg.exe
Token: SeDebugPrivilege	3320	alg.exe
Token: SeTakeOwnershipPrivilege	1760	elevation_service.exe
Token: SeTcbPrivilege	4256	GameInputSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4604	4256	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-31_593aef3dba7af21ec2d0cbcd20d0c351_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_593aef3dba7af21ec2d0cbcd20d0c351_icedid_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6120

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:684

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5452

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4896

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77a0c3a5b75bf2c94462177e799e259e0b8c53e7263eed9e82fc0f6aff470ac0
MD5 dcec2a06e10654e4971c20adde61e7da
SHA1 261c9ab45f448e553a5b0cf351602645a7daad38
SHA512 5e14e64954524cee87d9477a25b88726ca4116819355dd8f30273a386700087314455623d746ce7a6ffa5fe6152290c54b7564727890bac972ac9c98fd1e00cc
SSDEEP 49152:/b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnzdPdIog6X5okHQt:93q6gjBMPdM6XGt
TLSH
T1A2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 0e174133e6365d6468439b848fc2326f7f8ea2202ec6b5cc069e93d9b2570c82
MD5 c6b95f94bc077c119fb52d311071e1ab
SHA1 97673d52087fca36c376ee805dfd80beea29b301
SHA512 d777d1f7f408c6e5bff3043faabb584a5cc485a4a64fdb254e70c08333e3aeeb279b4aacdd8cae5f91b3b1bb70348aa505fca7844205bfa27c2e94a9d95c21cf
SSDEEP 24576:bXYuStczAjQdvnXKHINGo4X6XXJHUbkHQhv:4tcldPdIog6X5okHQt
TLSH
T1AF05012973E109F9ECAB827DC8B28515E673784547B0E79F03A499260F237985E3EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 a53d72906b06deafc56b4ad91a18863be9db5bbce69c13cb8fdf516bac867f5e
MD5 5bfe1bef317669b88b45ffd24e3d30b5
SHA1 f55dc28ae12f2a146835237784f0a6af04918675
SHA512 34b6f58923c7adf41b1852653412f9b67708790ad68efcec0d77f60b15b7bb5544d65c739fc62e5523fbee4bb1ef0f2dc92460277e597c99067aff3a0f4055ed
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+ClBJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkw0:UwusOWlQdvnXKHINGo4X6XXJHUbkHQh
TLSH
T18E05F10A33A51CF9E5A746398597D536F7B2B8052A31CB1F1760C65B5F33321AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c5c294f682d3edfd8c0308b552603a52b510022058a2a31d4a16cd088ba65d42
MD5 4e86823523387585e6302d0baeeddf5d
SHA1 5e44c6c411dd62decf48fce2d32525a991d589a7
SHA512 672a2f2611fe63e72bcdc2fb5e931f9d5051263ec45c289300a60c1f7a9b83b47cb584d7d10c09868d9a7e24c4e60a7983b97b9ecd23710092973816b43155f3
SSDEEP 49152:IB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZdPdIog6X5okHQt:Cu6JmTxd2d7PdM6XGt
TLSH
T1B2D59D13F1DA01E8D05ED478974A9232FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 5cd2f9b5997bd753743823d86779a4a7e52c79b21ebb71222e559f0da63f71f9
MD5 dd5a863244a743be58ce28c632386c1f
SHA1 aceaac8044096aaf3337034571c44f2efc5283c1
SHA512 8efb1c6ff9fd7084a4c3a1ea125f9ed14f609b28c912587a97ff2483247ce3d1e485f2a486d896897d29e02797d1e653f6ac056f4db783d1f41f956ef1c8cb4e
SSDEEP 12288:jq7SBJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:CTQdvnXKHINGo4X6XXJHUbkHQhv
TLSH
T18BD4230753A72BBAE0BD0EB515BBA838B156300DDEB0C66F3415151B4B30A268F2BF43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 caf6d8b1f413afc5b1a10b85910ce382627bb969998186cbe5481fb7aaf137bd
MD5 2a20a3e3f1dd5a72e4dd461711f60e1b
SHA1 38cad1034c56310025ff78cc370463a1f83d7938
SHA512 e40353790c6fbc4a88c9cfc8c71587133cffec9a9b981db9bc7a7d97ab215d2ea10b74af1b8ae4a90a59fbe3749f62fef46e298e9f5ca592e8e9ced87ace943d
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYqQdvnXKHINGo4X6XXJHUbkHQhv:Qgb4mBIBhGFmdPdIog6X5okHQt
TLSH
T1FC65AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F37EE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 71292506aadf4ef2781e035aba9fbfc26070b04872c008aa7702010686f08f85
MD5 adec987082c2e770ffea2028c802d575
SHA1 76198c20b0a5bea1158ac50202e9b33159df4dea
SHA512 a58d67ca31434c29d94de085e0d986f857b4385c071c4971979033b5648b34e02eee9cdffac8d25bf2d118242ce23714eec98e35346ecdcbf64d8aad958ddd78
SSDEEP 12288:PBGIBJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:ZGNQdvnXKHINGo4X6XXJHUbkHQhv
TLSH
T1ABE4231E22F332F9C17D8AB95576A835B0B230589B7446FF04A195368F60AF16B3EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 3c1e3e2cd69141ca309e3814013f623dbb49b445f7edf97d23ac44cbf11e0dfb
MD5 e1b9db63e92540a1732f330cadb37c04
SHA1 b4659462f6aef3943e01e58ef91bb39fd164d0b7
SHA512 b836078d7781d62f61e01bf6423400b851a944af3f3666ab82798d46a5e97cab8b9d7447cb74490acad67a04632ecc8a590bbb2af816305a1a7382a8b1b8a86f
SSDEEP 12288:gpBJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:gGQdvnXKHINGo4X6XXJHUbkHQhv
TLSH
T143D4230A13A317BAD1D90DB655B7AC38B152300DEBB18AEF246514174760AF79F3BF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 dc6297dd2eade8850a3c783c6161093f9d644f5d14072944c99d8c8b73595e34
MD5 13451ecbd4c690961e7d01c6a439fd96
SHA1 befff7f42fa37ad3e55265cdf9257d01b8d79f76
SHA512 b6e499f5448fd790c313361314e4470c3dd4b8036c71f0f4391971ae78a06eef37d7ee937f07a795ae10bb20dc81c0baf7193ca37e4428304e55a3c0e338c262
SSDEEP 24576:DJE8a8IuJqH1Mzria7/mQQdvnXKHINGo4X6XXJHUbkHQhv:dD9IKqVra7/MdPdIog6X5okHQt
TLSH
T17935F12573E102F1D4BBD13889964663F6B2B4150374EBDF06A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 482ee0ab84b2d6bac00e1e6b49a8e7d68b7614f9e6a842a5261e6ec0a52a30c3
MD5 517653063ece0e718e8208658425accd
SHA1 a8da60454fa37ed3087a72e96479ffe33f00f01d
SHA512 21d108ca5f764363f5fe23e829013f8580f1d51284f398222683e0a8eda1dff6b12e9e0ad3d74b07692b8065e153cc2ef1a3cce9d7d2c0de15f5b3d85d123de0
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcdPdIog6X5okHQt:XG05lO43bTPdM6XGt
TLSH
T115D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23415033556CF02A486A91F23FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 793b05d2a74415ad5948930e66eb3ada8b59db5ab197dcccf2f070ffb0285492
MD5 2d8b306f8aa3ec434e65f20a87a86767
SHA1 93da18d0bd331abc3d7bc490cd104d7a2f63ae8f
SHA512 c1d89aa5936ad4df5d0c3189e2d142da3dc6228fd59a33e878f74c5c0d909552e2b0ff85148cdaeb0445a33859225b989ac5b1e6edb60adf829169201f24011b
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkQQdvnXKHINGo4X6XXJHUbkHQhv:WNc/zEOVHF0dPdIog6X5okHQt
TLSH
T127858C1623E901E4F1BBE1BE89779546FA71786953308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 f5e025baa895f45e705698e66058dc021632f37749a51f070f4f451979925e70
MD5 6d2eca2773bba1e00b4bd67f8a602b9d
SHA1 365f6f488faaeaa760ec1460413435087b9a3799
SHA512 4ce6b0673151465a1b42556618e63566789dadab2bf41bfefc51c465004f6c9e38d87075489930ce48fe25d9cf73fde0c2252289b29bab04f6ae8addbac17845
SSDEEP 24576:EJnJPbzB4S6QdvnXKHINGo4X6XXJHUbkHQhv:EJnJv6ShdPdIog6X5okHQt
TLSH
T1C215D03DD2A810E8D4B7C2B4815A1A69FF71346D2F2169CB19B4D5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 640KB
SHA256 78160aff4dc0602003a78b5febed2602ecd7522e12f47b09a219cbedd9978f1c
MD5 400d13d5853631e79da816b78be81ddf
SHA1 dde768852ee776ca0543f881cc3279a2f79be112
SHA512 e6bd8e195a85bea484a113315bee39661b5e7d4e9e47924fa073ff5dd839aa4ba403f6913bf530b75d3e07f7a36ff42870a19769fc28bd48aa75494b12e07c8a
SSDEEP 12288:HIC0wHGLYRvlWaEU6ohtqzvfm104wKBQwZo5oYdakd:oCLHGL0MoeVtFd
TLSH
T162D4E619E3A29195CDB6C1F4C60AA527EB31BC18533877EF9FC0CE7A5E21AE1913D601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 89e3692fd584981725ec212c591c6c4f039e3447d3dd88f1e398726002e3edd0
MD5 54b64acac5542c3a5e8b9e839208a687
SHA1 6b6c162ed8db58d1c32020a9bffa0b27242f1304
SHA512 fa9a3deb1e5890b6526be8c8405ef51b78817d454b5f73fc021aa083c1001d49c7a06ff87a6c61af85b5d090753a36518e141b68a0c7b8c2effab55622b5e969
SSDEEP 12288:51Hck6j5ZI71BJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:h6DIOQdvnXKHINGo4X6XXJHUbkHQhv
TLSH
T114F4010D237711FAD0ABD03E86930511E2B27065C7625ADF06A4C57A8FA3ED8BA3DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 5d0418bea5e2034c6c0304336e992c98de313a4167969adee8dc144111b5647d
MD5 8aaadd16632456e9efbb88633b3c27a5
SHA1 15a89eeaf63e371cbeff33454408ba79e09de210
SHA512 68221fa49c2101bf5e225136e085559442f7a1ce667f8c59039d82f85f29be088feddd1e703ecc896d814761102df470c693eaec9644ba9c14d02fbfec5b9872
SSDEEP 12288:uG6kybBJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:ntyEQdvnXKHINGo4X6XXJHUbkHQhv
TLSH
T1BBF41205639521F9E5B90A789A738174EA317C149F3187EF10A1A63F1F30BE5AE36F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 fccbad63a188d7660b4c37246bc888e5d920ee177edfb1d5a3b11945f323ba1b
MD5 964194fc044d9a5af0c13456d8888ec6
SHA1 24eecefd7ea481b83cb00c16f3e8b7889688d64d
SHA512 373b0ca465896f94dfabeef0e4da78d4f19e23c939f6fcefc1efc5e68c5e99233a4bf5096fd16876f09fb986c8f7e4e2778bb443b89507979a310b0823a87c31
SSDEEP 12288:GF+BJEQdvhFXXQ1HIi9oNAZo4X6YFVDqX2qHUtIKkkwQvpv:kvQdvnXKHINGo4X6XXJHUbkHQhv
TLSH
T127D4230E136333BAD0994EB551776938F162301DAF7186FF24A558378B606E29B3BF42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 e4c18ee8f539bc55cd16c2434ed5f3d1bb4a88b618e491c1a0b299fb1184c477
MD5 37db5680c0eea0b171e19f00c4c2d098
SHA1 c529399eb97ff2e38fb60fbe6b76ae59826c2676
SHA512 bb176a59ff79e52349a18f1f110173e0ada93e775ef2b8ff2c8b84e870085ea26e1527781bd4a82fde3b406f0e0656d3308b26d2d4b335c210698cdab3aac39b
SSDEEP 24576:UJghaoTfaidZ3QdvnXKHINGo4X6XXJHUbkHQhv:kgNTrZAdPdIog6X5okHQt
TLSH
T158559D1D63EA06DAE2B2D679D8731493D633B4315772C6CF2448C03A4DAAED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 ca344505978033671062f51ee56e4ea914d5fd433c82c8f25be1e4f6bc8a8d84
MD5 a53f68036565d35e6d1a92ca3a110c3d
SHA1 86cf527e397efb86bf1085cafe2af0f3d69e6d8a
SHA512 a06035025b1a34e03dee3fd10585af15f7f6d57898cb0bf59eb414236fe37fd7174b681192acf3e95b3c3cc0889a394cd6dc7e65b766cf45de696d3ea24e78e0
SSDEEP 24576:QPUr+NQ5QdvnXKHINGo4X6XXJHUbkHQhv:QJQedPdIog6X5okHQt
TLSH
T15005F11F22E918F5E67AA17D89928619F37274561711D2CF02E0817E4F63EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-311-0x000002D22B050000-0x000002D22B0B6000-memory.dmp

Download

memory/364-310-0x00007FF7391C0000-0x00007FF739273000-memory.dmp

Download

memory/364-312-0x000002D22B050000-0x000002D22B0B6000-memory.dmp

Download

memory/684-276-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/684-271-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/684-338-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/684-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1068-356-0x00007FF7896B0000-0x00007FF78993A000-memory.dmp

Download

memory/1068-352-0x00000179C47B0000-0x00000179C4816000-memory.dmp

Download

memory/1068-351-0x00000179C47B0000-0x00000179C4816000-memory.dmp

Download

memory/1272-57-0x000001E855E10000-0x000001E855E76000-memory.dmp

Download

memory/1272-56-0x000001E855E10000-0x000001E855E76000-memory.dmp

Download

memory/1272-55-0x000001E855BD0000-0x000001E855CDD000-memory.dmp

Download

memory/1760-27-0x000002A33EA60000-0x000002A33EAC6000-memory.dmp

Download

memory/1760-25-0x000002A33EB00000-0x000002A33EC0D000-memory.dmp

Download

memory/1760-28-0x000002A33EA60000-0x000002A33EAC6000-memory.dmp

Download

memory/1760-26-0x000002A33EA60000-0x000002A33EAC6000-memory.dmp

Download

memory/2008-335-0x00007FF67A690000-0x00007FF67A7D9000-memory.dmp

Download

memory/2008-261-0x00007FF67A690000-0x00007FF67A7D9000-memory.dmp

Download

memory/2008-263-0x0000022639810000-0x0000022639876000-memory.dmp

Download

memory/2008-264-0x0000022639810000-0x0000022639876000-memory.dmp

Download

memory/2912-345-0x000001730BF40000-0x000001730BFA6000-memory.dmp

Download

memory/2912-340-0x000001730BF40000-0x000001730BFA6000-memory.dmp

Download

memory/2912-339-0x00007FF63ED50000-0x00007FF63F070000-memory.dmp

Download

memory/2912-341-0x000001730BF40000-0x000001730BFA6000-memory.dmp

Download

memory/2912-347-0x00007FF63ED50000-0x00007FF63F070000-memory.dmp

Download

memory/2980-44-0x000001CE45B00000-0x000001CE45B66000-memory.dmp

Download

memory/2980-43-0x00007FF61C430000-0x00007FF61C598000-memory.dmp

Download

memory/2980-50-0x000001CE45B00000-0x000001CE45B66000-memory.dmp

Download

memory/2980-52-0x00007FF61C430000-0x00007FF61C598000-memory.dmp

Download

memory/2980-45-0x000001CE45B00000-0x000001CE45B66000-memory.dmp

Download

memory/3320-14-0x000001F979040000-0x000001F9790A6000-memory.dmp

Download

memory/3320-13-0x000001F979040000-0x000001F9790A6000-memory.dmp

Download

memory/3320-61-0x00007FF6BE2C0000-0x00007FF6BE3E2000-memory.dmp

Download

memory/3320-11-0x00007FF6BE2C0000-0x00007FF6BE3E2000-memory.dmp

Download

memory/3320-12-0x000001F979040000-0x000001F9790A6000-memory.dmp

Download

memory/3472-3-0x00000291241B0000-0x0000029124216000-memory.dmp

Download

memory/3472-1-0x00000291241B0000-0x0000029124216000-memory.dmp

Download

memory/3472-0-0x00007FF7D6990000-0x00007FF7D6AB0000-memory.dmp

Download

memory/3472-2-0x00000291241B0000-0x0000029124216000-memory.dmp

Download

memory/3472-22-0x00007FF7D6990000-0x00007FF7D6AB0000-memory.dmp

Download

memory/3472-19-0x00000291241B0000-0x0000029124216000-memory.dmp

Download

memory/4256-309-0x00007FF7D6DA0000-0x00007FF7D6E68000-memory.dmp

Download

memory/4256-234-0x0000025AF9450000-0x0000025AF94B6000-memory.dmp

Download

memory/4256-232-0x00007FF7D6DA0000-0x00007FF7D6E68000-memory.dmp

Download

memory/4256-233-0x0000025AF9450000-0x0000025AF94B6000-memory.dmp

Download

memory/4268-292-0x000001E76C5F0000-0x000001E76C656000-memory.dmp

Download

memory/4268-290-0x000001E76C5F0000-0x000001E76C656000-memory.dmp

Download

memory/4268-359-0x00007FF6AB410000-0x00007FF6AB4BD000-memory.dmp

Download

memory/4268-291-0x00007FF6AB410000-0x00007FF6AB4BD000-memory.dmp

Download

memory/4300-283-0x00000203FDDC0000-0x00000203FDE26000-memory.dmp

Download

memory/4300-282-0x00000203FDDC0000-0x00000203FDE26000-memory.dmp

Download

memory/4300-289-0x00007FF7AF870000-0x00007FF7AFFB3000-memory.dmp

Download

memory/4300-350-0x00007FF7AF870000-0x00007FF7AFFB3000-memory.dmp

Download

memory/4456-301-0x00007FF762960000-0x00007FF762D76000-memory.dmp

Download

memory/4456-299-0x0000026F30820000-0x0000026F30886000-memory.dmp

Download

memory/4456-300-0x0000026F30820000-0x0000026F30886000-memory.dmp

Download

memory/4604-318-0x00007FF7D6DA0000-0x00007FF7D6E68000-memory.dmp

Download

memory/4604-241-0x00007FF7D6DA0000-0x00007FF7D6E68000-memory.dmp

Download

memory/4604-242-0x0000015812F60000-0x0000015812FC6000-memory.dmp

Download

memory/4604-243-0x0000015812F60000-0x0000015812FC6000-memory.dmp

Download

memory/4896-330-0x000001F176A90000-0x000001F176AF6000-memory.dmp

Download

memory/4896-331-0x000001F176A90000-0x000001F176AF6000-memory.dmp

Download

memory/4896-329-0x00007FF7A3DD0000-0x00007FF7A3F64000-memory.dmp

Download

memory/5336-328-0x00007FF775740000-0x00007FF775859000-memory.dmp

Download

memory/5336-251-0x000001318FDC0000-0x000001318FE26000-memory.dmp

Download

memory/5336-249-0x00007FF775740000-0x00007FF775859000-memory.dmp

Download

memory/5336-250-0x000001318FDC0000-0x000001318FE26000-memory.dmp

Download

memory/5452-319-0x00007FF6F18B0000-0x00007FF6F1B53000-memory.dmp

Download

memory/5452-321-0x000001D206A00000-0x000001D206A66000-memory.dmp

Download

memory/5452-322-0x000001D206A00000-0x000001D206A66000-memory.dmp

Download

memory/6120-35-0x000001CA71000000-0x000001CA71066000-memory.dmp

Download

memory/6120-37-0x000001CA71000000-0x000001CA71066000-memory.dmp

Download

memory/6120-36-0x000001CA71000000-0x000001CA71066000-memory.dmp

Download

memory/6120-34-0x000001CA6FD90000-0x000001CA6FE9D000-memory.dmp

Download