cf8339e6d13801c72b94a1217d42afd12f5779f1ac18acae0fa52f4648674053

Analysis

max time kernel
145s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 663KB
Sample260803-c15j8aar3w
SHA256 cf8339e6d13801c72b94a1217d42afd12f5779f1ac18acae0fa52f4648674053
MD5 70a1e8fb37acecd4c7e7bfd14167c071
SHA1 734427fbbffd1aea668a8d46dd7c24be59e273fa
SHA512 bd41045e029ff47dc6297ed4fdd8310fbc1f609b79a41c7663b37ae498a0d271ac5a2153eef4fbfd5c2ac37d5932edadd2849a7854fe12b17ed2ded31ce8026e
SSDEEP 12288:SYmIjEXY5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:uXYF4u82C0zn8oZpPYWuRt
TLSH
T164E42326B2D1C031E086157A0164CBF47EBDFD320895E043F7695B6A2FF1B98CB99627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
2296	alg.exe
4516	elevation_service.exe
1344	elevation_service.exe
1148	maintenanceservice.exe
4196	OSE.EXE
3756	GameInputSvc.exe
4272	GameInputSvc.exe
6084	msdtc.exe
1484	PerceptionSimulationService.exe
1512	perfhost.exe
1016	ReFsDedupSvc.exe
3304	locator.exe
244	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d094ae2283806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	GameInputSvc.exe
4272	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1368	2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	2296	alg.exe
Token: SeDebugPrivilege	2296	alg.exe
Token: SeTakeOwnershipPrivilege	4516	elevation_service.exe
Token: SeTcbPrivilege	3756	GameInputSvc.exe
Token: SeBackupPrivilege	1016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1016	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4272	3756	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_70a1e8fb37acecd4c7e7bfd14167c071_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4196

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4272

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6084

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5484

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5932

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1008

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3600

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cd97b816339d3a0f612917bfd8219df4d7ee7621e653e35cc20df4ee0e74d87c
MD5 413443fba5223379682c08a5526624d0
SHA1 6187e87869188baef2985c68013f70dfd1f0d9e9
SHA512 9744cc3b527f2cb97a27ee2fbc68902c1eb99226102a50bb94f8e06a4e89070eb28a388234556961588537bc85a77675e843c1e6c46b5e8eb71857b4fd036679
SSDEEP 49152:UAe632BuPkFKRrdE6oh7stBhuXjfS4LWxnoWu82fz8oZhYPf:13q6gjB7Wu8A8oZhC
TLSH
T1B2D59C03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 9d22df7b3d8da330a8f4bb86f8fd0e63cda7fa7b3e507fc3a189981bf9ba2d83
MD5 11a218ec9588d6d2e41d92dd3558a524
SHA1 839030194c180bfde9a1d3a86fa6c9bcff5cc7e7
SHA512 d29b4b69fa7b6f49f9d4094a1f70b5645b2cd1964f39bbe64ee7709ee7fac7999c0b1323f91bd679231276bc91e2a335db4822164f06699c6a03f62e98f167e4
SSDEEP 12288:Y1XLss9b+xzD0/+9czA95h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:eXYyEXczA9F4u82C0zn8oZpPYWuRt
TLSH
T142050228B3D408F9ED67827DC8A2C515EA73B8414760F78B03B49A651F237985E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 bd6a5b85d0c641767e00834a2bb795e76b1619c569088b6a464a315b5f4a9dc0
MD5 68a2a2fe88b7de2a06ac911e3ee4ebfc
SHA1 b15ab8b5869849fdc84c660949df9f476d1ed306
SHA512 a6db2ec078d992183da887e90ca2f7acc28f5438c5ba237dd0e80ee5be5cbb1d2c06dbc6b04bd0dff434f3d63ebed7bff40deb8cf921b03344d8eba65c0a8e70
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C25h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6F:Owu+OWNF4u82C0zn8oZpPYWuRtX
TLSH
T13705F14A73E80CF9E56752398197C536F7F2B8022A21D71F1760C65A6F73361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a9a3712ed9ac3bb7b7850a119756ece15413ea9ac4fa883347b2975aed4d9ade
MD5 bfeddd2db157a568fc04e13dcb88f706
SHA1 5a48699b854f86080a9be25ed6334924334f0b19
SHA512 1f63457f36f7f48e5b1265937582afb4e3346bae86e087b92c303a751ad35d878432f5c19a87022d934f832c91349888478565b4a2ebe6724be652e33a1f5b29
SSDEEP 49152:6p+taZ3usBWOBr4tEGp0bqx0z+n217aau1glaWu82fz8oZhYPf:Uu6JmTxd2daWu8A8oZhC
TLSH
T1D4D59D13F1DA01E8D06ED478974A9232FA62BC490B34B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 61f1beee2fbb10d913e4c3bc95e803d816dfa18a4b6ba1b28fad9b300cf0f346
MD5 cc966d64baf7ca965150a3fa9d8fd1cb
SHA1 02a79d37a41ae0a1c401535403437bbea8585a72
SHA512 180d4e22c283981e66f14d783bc96ddca6a0af2a527dd5344185155f83889612c98c14878f04e9c52b18ef3e9d34dec2f799b98885abe34610618fe27c41cb9d
SSDEEP 12288:IN7d845h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:ofF4u82C0zn8oZpPYWuRt
TLSH
T172D42326E3C88469F12A16FA00A58B5874A5FB510F40D1D3F7269BD42FB2EC94FB4D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1a631ffa50a859d444e34a9243fb8530a29fff5e165e0e9402c9c5d0c5418efc
MD5 3cac49f5a246d64df2d74d925e82d899
SHA1 847a29d185a68fc074ad7215c9a709c2d703f8bf
SHA512 e6ed0518a57c0dbb429edaf47f2c13cbf5b16ab477c64062032b6ce752a36c0b1dea25f3e3456a2321d92d91130fb6c20058657bc58fc94fef74488c766f2435
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bY1F4u82C0zn8oZpPYWuRt:lgb4mBIBhGFyWu82fz8oZhYPf
TLSH
T11B65AE1E22EC02F5E0FAE2B89DA64417D6B278160731D2DF1251427D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 32c6715af7f1f3650940b0428abd3886cd9526f641fb9b0a2832f623069c0859
MD5 b7772315480cfe5e19cea9e86b3626e2
SHA1 54a4c266d863cd4bb0c224c30241088e041fe9ea
SHA512 72a146efe7493b0a725aa9ee1e2c6b817fd8d8c19e19cc4b03e7533efd0d8cf401dd5dbe61a6959038f599bad9ab03bf9c801f2d64854b941235b94bee8c3f21
SSDEEP 12288:PZGx5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:hGxF4u82C0zn8oZpPYWuRt
TLSH
T1C4E4233E72E560A8D13E83BF40718A9978F0B6510B04A1FF46B5DA745FA2ED45B7CC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 edd85586421140415d4af401d84fa6239d1d8bbeb0a133d7c9439de5d3c5e44b
MD5 46bb28490623af6d3831637b2eec7e49
SHA1 c4d90ff0af4ac173a9696cff5757665f5aedc17c
SHA512 4879c33cf85556f3e3ed552e0d392d576856db7ce8df0a63cb6256d9d7a21c493a2ae035b0d7e53a4773fd565eefea151a908db4f1ff6a18adc79edb1582f379
SSDEEP 12288:sP5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:sPF4u82C0zn8oZpPYWuRt
TLSH
T178D42359B2C98468E11A15FB00618E9C74D0FB520B45A1D3F636AB942FE3EDD4FB8C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3e5b9c9a4680558258668fed55255e7e5a7e12d0ec7c492d33505a66755406bd
MD5 d4aa17dba816c00822a8be00e6f26f33
SHA1 21cdc31bc0768e0662d5e628c049a7e7af029134
SHA512 17857018d427421eb86eeeb716f5d45737a3913681a3031170764c02a49b06dab9d43507d67a4abebcb1b1cae14330368f6dc6b57e0e12096eb15922eb27b92b
SSDEEP 24576:W308w8ZtJqH1Mzria7/mQF4u82C0zn8oZpPYWuRt:ATvZDqVra7/zWu82fz8oZhYPf
TLSH
T11835F165B7E101F0D07BD13889824AA7F6B1B8250364EBDF07A88B551F23AD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 e134fb5e7c20d593aa841666245cffa024eceab24e19ed112363299e5a839959
MD5 ff4072fe519cd10a48f5a6bf771ac87e
SHA1 f58326958bc7bf43b45ae0325981b1abfac4b193
SHA512 fd7e9ef7b48cfadaedb94002bf3185e06c74c32f1002d0535c9aa40d3213f300d499b47661824479f936c62864314a313133f1dc58c8a5ff2023a9851cb2809c
SSDEEP 12288:rHvUrBFrEjwaQF5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:rPUr+NQFF4u82C0zn8oZpPYWuRt
TLSH
T1C505E12F62EC18E5E67AA17D8582871DF771B4620711D2CF02A1817E1F63ED8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 97387bf5066304cd904dba2a5d129bda7550a5d8c11a5b27ef132c24e416e617
MD5 8bb0bf9be9c9ce246e053a5e5b0b112b
SHA1 ff039cb45d008c8eaa570c83f52359db9fb25c6e
SHA512 f9ead51dbc3a32779d1d2803d994a8a7e25509d16a4f37663020977303d2fc3e9cdf5c803850e31e3f018ec2531056a44b1df4177a8fc8cfef7b03f0edb2ed36
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhWu82fz8oZhYPf:AG05lO43bwWu8A8oZhC
TLSH
T100D5C06E62EC11F9D1BBD17CD9C64A0BEBB23415033556CB02A486A91F23FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3e83de095b6784607657322004882cc07e950b0b2bf0553665628c1a11857b41
MD5 7cfc5ec018004b424edd36e238119aaa
SHA1 f64e8975cb4d6053ca319fa34f2fe9a2436b096a
SHA512 d4630be0ea3bdab39058325ce4fc6527d743375591501bb9713c68b34816b755ae3579dfa1ae48a1dddd935183d92be5b34b15bfcabd6e23fe7127d5c101dd31
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkLF4u82C0zn8oZpPYWuRt:KNc/zEOVHFoWu82fz8oZhYPf
TLSH
T176857C2623E901E4F1BBE1BE89779546FAB17865173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 091c78273a63c9ad5fee96c60f19260dd5a586b6d331e56ad435cfe5e0be49a4
MD5 a913a7ef1b881843632d73bfbee8f13d
SHA1 e0f7e71741f32b382d5d248a83f3cc916a48748c
SHA512 9746ea2dbeb4a59119de9a3e629331a0122f0f2dc440bd16149227f42f52f51ca96bc6a0f9b146de2cfed1ab167fd2394583c12a17cee226ed5f79d5d5e21c80
SSDEEP 12288:foHPJnJP6szeCs6Rl28dmW5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:qJnJPbzB4SJF4u82C0zn8oZpPYWuRt
TLSH
T1EC15E03DD2A810E8E4B7C2B4815A1B99FE71386D2F2169C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 11c57bacc8d20e9a5cf564e86423fad5ac2b820f32eda487476a0cac343dc020
MD5 ab3e55b793605994177f8f416e61f193
SHA1 6862bc8e5650e21968923b1a3471abc96029b48b
SHA512 ffb3358c330d102a04ab05d14e79667a9320db3fd11c0ad55dee9244461902e4cebc69a2f0b653e3bade5d1a3f24dc46f3410d5f16517c8861a0168efda64ff8
SSDEEP 49152:TeLHGeeV5ijCmlDWDkyWu82fz8oZhYPf:S0Wu8A8oZhC
TLSH
T16AA56B05E7EB4184E8F3CAF5CA2294169A327C549B34F7DF4A80CA6A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 fd7e7ad740d7ebe762c3c925f3b292b81fda39fe40d9be25ca95daf09ec8ac87
MD5 e49b3f1c4835b3cd296af383a30a3bce
SHA1 7b28216c2d6801caa5eed0ac11e6b6d3e15ae7e8
SHA512 41509fa72f64efdeab1f750259b0da12fe9063f1e0bbe92d20c9d9a71b3cfce0f4ae2d73c0e655e25a48be9c7dd35c2a81ccf7231c2b339a2d8637eea0f46cfc
SSDEEP 12288:l1Hkk6Q5ZI7/5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:t6+IbF4u82C0zn8oZpPYWuRt
TLSH
T1A2F4011D73BA00F9D06B907E81920645E1F2B5B1871266DF47A4C5B95FA3ECCBA3CE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 4995da23c2271fc0167895412b49f21e0d23a9d99e50ebaf7c9eaa502a0c2a0a
MD5 d836e67384ca0040f63d40496e21f020
SHA1 47a7a2de51d61f9f74903029d3c467db4f3b96ef
SHA512 8567ec45ca7526d9fc1afc92315ef90c7b029d30cd32c922c99d3dae8163eaafe13e6c782729d6093b4c67cf2c6fa08811ff96554c2e758919851d9e367d066f
SSDEEP 12288:bG6kyP5h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:atyPF4u82C0zn8oZpPYWuRt
TLSH
T1E5F42305A3D850E8E17A1279817286D4AEB0FC101B1193DF66A1EB7E2F72BD49E74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 909e08798e49dfb7ae8b9f4a8ff008210f120e06b09dc7eac4654d3f2b6f8b50
MD5 f4f2211465e6566e95c09a8df175b46c
SHA1 55971bb1dccaab4e9307f75b117debb0fd1b7d85
SHA512 4be7b2f76ecc1c1c9c9ada6a85a502d64109c207b2dde474955b000e406432a6f6b3cb8850b60fa3187cfad5662413114b0854362ae372971c752b7f3832704f
SSDEEP 12288:p405h6aiaABu85OTCsrMUs+Ca8oZpSMyCP4ZhMuUHP6t:u0F4u82C0zn8oZpPYWuRt
TLSH
T1F4D4236DB2D59468E01926FF00618B8874F0FA610B45A1E7B676DBB41FA3AC90BB4C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 272c21188a812132a235397644f55d02668e1641ae621202e524d6c605eb3eeb
MD5 4bd889d0a7bc6649e0fcb417bdc567ea
SHA1 1fe2528003da01936e6ceb5f0b02b442929016ba
SHA512 aeee053a895a87fd6c094a733be581365fd9a86ae012b0213b3a4c7be3836799cc02d6d36913e32e17ee359a62a21f304bf87e167eea469ed3f15d3b087f4012
SSDEEP 24576:T4gzQoTfaidZkF4u82C0zn8oZpPYWuRt:sghTrZkWu82fz8oZhYPf
TLSH
T1A8558D1D63EA05DAE2B2D279D8725493D633B4311772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ee6ef2d296d9f0634c84d8d3924ec4fb79f2639c19e64ef7ea86023e1fe6bf40
MD5 5ab7bf18ab9e1cbbc81cd4d9ae4ddeb8
SHA1 2710e9dd0c088f7ce05f5ac6c2370e94052b186d
SHA512 ec0e6e81002f080b2cdc1b36b92e77bf69206fcb1a7a9eae40025cb6ca8ae7702be8fdf39b15dbe756a855f6b251669fed0e1c766c2e4d47fdcf529d203ba8f5
SSDEEP 49152:rDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3UWu82fz8oZhYPf:A3Upow8sBNWu8A8oZhC
TLSH
T1FCA58C3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-303-0x000001945DD90000-0x000001945DDF6000-memory.dmp

Download

memory/244-302-0x00007FF7A8840000-0x00007FF7A8C56000-memory.dmp

Download

memory/244-304-0x000001945DD90000-0x000001945DDF6000-memory.dmp

Download

memory/440-357-0x00007FF74BC30000-0x00007FF74BEBA000-memory.dmp

Download

memory/440-352-0x0000023D08CF0000-0x0000023D08D56000-memory.dmp

Download

memory/440-353-0x0000023D08CF0000-0x0000023D08D56000-memory.dmp

Download

memory/1008-340-0x00007FF7FF400000-0x00007FF7FF720000-memory.dmp

Download

memory/1008-346-0x000001AE7FF60000-0x000001AE7FFC6000-memory.dmp

Download

memory/1008-341-0x000001AE7FF60000-0x000001AE7FFC6000-memory.dmp

Download

memory/1008-342-0x000001AE7FF60000-0x000001AE7FFC6000-memory.dmp

Download

memory/1008-348-0x00007FF7FF400000-0x00007FF7FF720000-memory.dmp

Download

memory/1016-286-0x0000021CDCA80000-0x0000021CDCAE6000-memory.dmp

Download

memory/1016-287-0x00007FF64AAD0000-0x00007FF64B213000-memory.dmp

Download

memory/1016-285-0x0000021CDCA80000-0x0000021CDCAE6000-memory.dmp

Download

memory/1016-374-0x00007FF64AAD0000-0x00007FF64B213000-memory.dmp

Download

memory/1148-55-0x00007FF6DB8F0000-0x00007FF6DBA57000-memory.dmp

Download

memory/1148-46-0x00007FF6DB8F0000-0x00007FF6DBA57000-memory.dmp

Download

memory/1148-47-0x0000024689090000-0x00000246890F6000-memory.dmp

Download

memory/1148-48-0x0000024689090000-0x00000246890F6000-memory.dmp

Download

memory/1148-53-0x0000024689090000-0x00000246890F6000-memory.dmp

Download

memory/1344-40-0x00000245978F0000-0x0000024597956000-memory.dmp

Download

memory/1344-39-0x00000245978F0000-0x0000024597956000-memory.dmp

Download

memory/1344-37-0x00000245976C0000-0x00000245977CE000-memory.dmp

Download

memory/1344-38-0x00000245978F0000-0x0000024597956000-memory.dmp

Download

memory/1368-0-0x0000000002FF0000-0x000000000309F000-memory.dmp

Download

memory/1368-1-0x00000000017D0000-0x0000000001839000-memory.dmp

Download

memory/1368-7-0x00000000017D0000-0x0000000001839000-memory.dmp

Download

memory/1484-267-0x000002D591C90000-0x000002D591CF6000-memory.dmp

Download

memory/1484-264-0x00007FF7A3180000-0x00007FF7A32C9000-memory.dmp

Download

memory/1484-266-0x000002D591C90000-0x000002D591CF6000-memory.dmp

Download

memory/1484-351-0x00007FF7A3180000-0x00007FF7A32C9000-memory.dmp

Download

memory/1512-360-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/1512-279-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1512-274-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1512-273-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/2296-15-0x00007FF605B90000-0x00007FF605CB2000-memory.dmp

Download

memory/2296-17-0x000001DA32A00000-0x000001DA32A66000-memory.dmp

Download

memory/2296-64-0x00007FF605B90000-0x00007FF605CB2000-memory.dmp

Download

memory/2296-16-0x000001DA32A00000-0x000001DA32A66000-memory.dmp

Download

memory/2296-18-0x000001DA32A00000-0x000001DA32A66000-memory.dmp

Download

memory/3304-293-0x00007FF6AB1E0000-0x00007FF6AB28D000-memory.dmp

Download

memory/3304-294-0x0000023092120000-0x0000023092186000-memory.dmp

Download

memory/3304-295-0x0000023092120000-0x0000023092186000-memory.dmp

Download

memory/3316-311-0x00007FF6588C0000-0x00007FF658973000-memory.dmp

Download

memory/3316-312-0x0000025582230000-0x0000025582296000-memory.dmp

Download

memory/3316-313-0x0000025582230000-0x0000025582296000-memory.dmp

Download

memory/3600-362-0x000001D867800000-0x000001D867866000-memory.dmp

Download

memory/3600-363-0x000001D867800000-0x000001D867866000-memory.dmp

Download

memory/3600-361-0x00007FF66BE00000-0x00007FF66C2D0000-memory.dmp

Download

memory/3756-320-0x00007FF7EACF0000-0x00007FF7EADB8000-memory.dmp

Download

memory/3756-235-0x00007FF7EACF0000-0x00007FF7EADB8000-memory.dmp

Download

memory/3756-236-0x0000029530A00000-0x0000029530A66000-memory.dmp

Download

memory/3756-238-0x0000029530A00000-0x0000029530A66000-memory.dmp

Download

memory/4196-59-0x0000026CD7FB0000-0x0000026CD8016000-memory.dmp

Download

memory/4196-58-0x0000026CD7DD0000-0x0000026CD7EDE000-memory.dmp

Download

memory/4196-60-0x0000026CD7FB0000-0x0000026CD8016000-memory.dmp

Download

memory/4244-369-0x000001EFA9190000-0x000001EFA91F6000-memory.dmp

Download

memory/4244-370-0x000001EFA9190000-0x000001EFA91F6000-memory.dmp

Download

memory/4244-375-0x00007FF7675A0000-0x00007FF767AA6000-memory.dmp

Download

memory/4272-246-0x000001E1FA1E0000-0x000001E1FA246000-memory.dmp

Download

memory/4272-245-0x000001E1FA1E0000-0x000001E1FA246000-memory.dmp

Download

memory/4272-244-0x00007FF7EACF0000-0x00007FF7EADB8000-memory.dmp

Download

memory/4272-330-0x00007FF7EACF0000-0x00007FF7EADB8000-memory.dmp

Download

memory/4516-30-0x0000015BA0820000-0x0000015BA0886000-memory.dmp

Download

memory/4516-31-0x0000015BA0820000-0x0000015BA0886000-memory.dmp

Download

memory/4516-28-0x0000015BA0610000-0x0000015BA071E000-memory.dmp

Download

memory/4516-29-0x0000015BA0820000-0x0000015BA0886000-memory.dmp

Download

memory/5484-321-0x00007FF6837A0000-0x00007FF683A42000-memory.dmp

Download

memory/5484-324-0x00000144A6E10000-0x00000144A6E76000-memory.dmp

Download

memory/5484-323-0x00000144A6E10000-0x00000144A6E76000-memory.dmp

Download

memory/5932-332-0x000001944A1B0000-0x000001944A216000-memory.dmp

Download

memory/5932-331-0x00007FF6B0A60000-0x00007FF6B0BF4000-memory.dmp

Download

memory/5932-333-0x000001944A1B0000-0x000001944A216000-memory.dmp

Download

memory/6084-254-0x000002A87BD90000-0x000002A87BDF6000-memory.dmp

Download

memory/6084-253-0x000002A87BD90000-0x000002A87BDF6000-memory.dmp

Download

memory/6084-252-0x00007FF744400000-0x00007FF744519000-memory.dmp

Download

memory/6084-339-0x00007FF744400000-0x00007FF744519000-memory.dmp

Download