07b5e3ed88fdbf8f4839bec8b22ab7c536dca9c78c1e4b94a82e6a13f0808bd3

Analysis

max time kernel
145s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260804-krzllsgd28
SHA256 07b5e3ed88fdbf8f4839bec8b22ab7c536dca9c78c1e4b94a82e6a13f0808bd3
MD5 f975881ce95f7788b6b9a3c47a4be6e5
SHA1 766508292145e1d7b834383ec55453c8033b832f
SHA512 219859c62ace67ce3ef8adefec59e8436b4d9bdb51cb7c489419985a3ada524e37ce4e6d652d022657bbb7c9266501ff5ec207cd265843affbc212678ca33352
SSDEEP 24576:OhfDc6X3lQMJxr4cQFTj0OZeVJzSZCKebQyFY62UugqBW+H3ZVXhP1s5ks:Nul1JqcQFTIOZejSmbQyFkBWspBhts
TLSH
T11245E11ABAF0C032C03351319D2AD319A2F5A0B188264947BBDD676D2FB15D3DB39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
2856	alg.exe
1712	elevation_service.exe
5008	elevation_service.exe
2420	maintenanceservice.exe
4264	OSE.EXE
5344	GameInputSvc.exe
4756	GameInputSvc.exe
1260	msdtc.exe
5676	PerceptionSimulationService.exe
4564	perfhost.exe
2312	ReFsDedupSvc.exe
4488	locator.exe
1708	SensorDataService.exe
5996	snmptrap.exe
5396	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43d5aaedb05c2f27.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4756	GameInputSvc.exe
4756	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4676	2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	2856	alg.exe
Token: SeDebugPrivilege	2856	alg.exe
Token: SeTakeOwnershipPrivilege	1712	elevation_service.exe
Token: SeTcbPrivilege	5344	GameInputSvc.exe
Token: SeBackupPrivilege	2312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2312	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 4756	5344	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f975881ce95f7788b6b9a3c47a4be6e5_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1260

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4564

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4488

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1708

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5396

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1208

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:6040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1068

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8e302073e75d002fba4f98e89cec7b46f92893639608c54236d01b86f171c025
MD5 8eb13ab388d223c1454134d43faed805
SHA1 5daecdb960e8ae34eb21fdb930467cf130afdd9e
SHA512 ef068f35b70a1aba1de0a7fe5fe6dad8e41c122b106e855b908bdca8162e53a8b7980e0af3b38a5fe65ad690b66b61ce1d63e817bf2ae6d841d6ad9d338ab484
SSDEEP 49152:bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn8SmbQyFkBWspBhtsL:p3q6gjBjzkBG
TLSH
T1C8D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 f33ec703f2c3fae9546569b08785eaac16255470170bbb84cb3583e547bc17ee
MD5 84fbf46b968514e42d6ba7faad5d3143
SHA1 a1ebf1022d8a2d7b6784bffe5bfce2e18843114d
SHA512 f149e157d1081a145241d8b4b515345958c45ce4f05463f32bee05857691a9927a1ee8a2d28d88d4d176df71eb35c9b1838b28c6000f8b17c2cac2a22c5dc2bc
SSDEEP 24576:uXYfDtczAySZCKebQyFY62UugqBW+H3ZVXhP1s5kst:ttcRSmbQyFkBWspBhtsL
TLSH
T1D4050125A3D009F9EC37813DC9628513E773749147A0FB8F03A49A795E636C8AE3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 824KB
SHA256 e7913b30a161ae2c365a49badefbd8fcac18c8ed940be823d6353153fd8c9e0d
MD5 7281872cfe9332ad184244f85342005c
SHA1 c869d6ef92e9c66f7cd15aacd60a6c3f9de662ee
SHA512 5fe002551dd486d0205e09d58b93493f4f6a12f25859b5aa44a14d7aa6297f2aa6a2c543ced6a57f50b9383d9cfcb2f1b23a38587ca459e1f2044648c5238568
SSDEEP 24576:bwuROW/SZCKebQyFY62UugqBW+H3ZVXhP1s5kst:bwGOKSmbQyFkBWspBhtsL
TLSH
T1DE05F08672E40CF9E972853A8657C533F7F2B8512A21DB1F0360C66B6F77251BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6fb63e2ed9e0649c4826bc457b060cd39e1669d5962b9e059234cf737679b922
MD5 8b24c555bab49ae12d49110f580660f1
SHA1 097a878818385e3b09e3b405768fddbe8a37f2e9
SHA512 980c8133764de77016c7b7d0b31aaf39b30ff46fb5cbc876989d41ae0804715e7475dc17b5128611d720727ae7e34dc60d24d8fede0cfb27d738cfb64cc17d41
SSDEEP 49152:2B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl7SmbQyFkBWspBhtsL:Eu6JmTxd2dhzkBG
TLSH
T1E1D5AD13F1D901E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 8797c0cb63fb50311ac20135442a7a409b90fbbf0bfba897fa9485640ee12c5c
MD5 3797138a44d73f876e3172d6d07cdff1
SHA1 0a3136845b82a665b8a094dedc18d7db49cba0d9
SHA512 c774b9ce9d7737f0c3708467965edfe7886a1395c489bc9de18945a608d15743ad7cec9f3f8ae3c72cab80498b2ae9ca2744fe10dec867aa79601a45fb83b9d4
SSDEEP 12288:6g7UdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:7ASZCKebQyFY62UugqBW+H3ZVXhP1s5R
TLSH
T131D42393D2C40E13F03058772516E62366E671F0AB91FF8EA31566B990BB9CDFD6430A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 77faba5217ec6ac919b0a70197ad45f71d903984bbb3ed07edb71dbe95c7f204
MD5 dce240ba3d21236ba85fb9fa484e4f1c
SHA1 2e1e95bea01fcd2f091d5cf315940b53b5a7dc2c
SHA512 f543b9f356703dfce518d157c48c11583549770fac0822ff1e949d1e3c9515660f482c216626f9628f346d91b998171d8e13419aa0c6992825bff7795e13dd8c
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYMSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:hgb4mBIBhGFlSmbQyFkBWspBhtsL
TLSH
T1AA65AE1E22EC02F5E0F5E2B89DA64417D6B278160732D6CF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 86023fd84b49ad470ea4d7474d6c0dc952dd1cf2f89f803154d660b57d18596b
MD5 a69da05a50bbd804455fc8a42a26d442
SHA1 ec4167a0c9939ee1baf2a5e51eb24a57c159c644
SHA512 8104906f2c023a87025ed4419afb3ae989fb9365f57bd1278eb0c5345ee1111fea295d9bb41f09f16d2ca964dad353da361976b9bae9066c5d6151cbc55a815f
SSDEEP 12288:RZGndP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:XGdSZCKebQyFY62UugqBW+H3ZVXhP1sL
TLSH
T151E42396A1E42551D031C53B5921A623B6F131F0A711BFDF42E0B2B9CAAB9CCF538F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 9524dfabc4ca791bceb961e7d8f896336697f21dfd6bb07cb2af0ae9c4c7ad56
MD5 3dfa20d27bd88002ff50b525380b9821
SHA1 f1f1001c1f1cad6f6d5e66c64f260af0a679367a
SHA512 54298605070f2574b0e617fc7ed2b68966ce478320ec36513903d5e90892bd5bc2cfb4a373b8a0c42aabf7d768730883822ab7797f70ed543f3c0a54b882022a
SSDEEP 12288:BhdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:BLSZCKebQyFY62UugqBW+H3ZVXhP1s5R
TLSH
T1A6D423C3D2C44A13E13098372612A61366E261E0B792BFCF936576B980EF9CDF57435A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 2d87dc8646662d1f27322ec48771cb1b622ea1bfdb04040d85bfc769c2a037f0
MD5 397fbe92922e3684a0e472347b6dad2f
SHA1 47359572c3c12ba569e1afb52aebfcd72412ab92
SHA512 8c3a9ccb013fc3e3cdd5c0263946274ed25656537d348d21703454722587fd4a86a5e8d380ce6ee8e60aecd74adbfff92aa6485bf12de0df8ae84152f8fe619c
SSDEEP 24576:K548k8FpJqH1Mzria7/mkSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:qHrFPqVra7/JSmbQyFkBWspBhtsL
TLSH
T12835F162B6E002F1D477D1398A424663F6B2B4211360FFDF07A88B651F23AD55B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b609c6a17bbe481d4f4cb8116a3a582c412236b9c54d30e9702fabf437164f66
MD5 6c72624551953857905c3cf93bb4328c
SHA1 52038d642c888c0a19033b015811d877bdc48b0f
SHA512 5635cb9f22be0114ebf3856aacc36d22ccee726ec83875e4ec2571a5bdb098ae2bdd2f4178fe15b4adcb4fc359b66c6a9a7acb11618d523d6a061480fc45946e
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrSmbQyFkBWspBhtsL:KG05lO43b2zkBG
TLSH
T176D5C06A62EC11F9D1BBD07CDAC6460BEBB23425033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dc849371960e0504ce44b7de3d90aac8d7dc486302242a3720f4312f56e26a36
MD5 77465fa888f52845bea0fe8aeaa02fa4
SHA1 1936276fbee721f3428633ffa84cd9527736fb5a
SHA512 9fc9b3ab5270ac1e7c22ddc375f0ee08dbc987229702764ca721d5e132646494af3990c6385fb5654f03d8670bb04c17b17e4b1e3081f15fe1b26d93b26cca48
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkfcSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:dNc/zEOVHF6cSmbQyFkBWspBhtsL
TLSH
T1EC858C5623E901E4F1B7E1BE89679546FAB1786553308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 4ae47103cbbf1fa5b3aa658afd5f568c38f0645b3a10baf7ec1bba9482c50dc2
MD5 8264aa10a8b76ba2cd9d8ed82f6ed784
SHA1 8e7589c9f728c97c83204c551164c8675cb871d7
SHA512 83816dcb4a0de25557c1b90f0d12a188374eb6176b7a1e2d255e849fd043a998d26faa6916636e6be486663c49ea71e60aac335b439657ebb27ebe0bba7d9f07
SSDEEP 24576:lJnJPbzB4SkSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:lJnJv6SkSmbQyFkBWspBhtsL
TLSH
T12D15D06DD2A810E8E4B7C2B5811A175AFF71347C2F226ACB19B4D5343F52ED0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bfca2c0331245b98dbe677714787654cff90118f6cba2e93408d7ae7eb7c9bbb
MD5 fa8bb9e1eb3a83c5b40206111b912c66
SHA1 0d3102cf2534300c520d88395bc2386ce1d9502c
SHA512 5181f12933466cd6669f42f1251767441ca965f92378237668d1e32fa0436fb8bd814bd225acb764c82771098cbf8c8f72549ce869d9820995b3349b282683fa
SSDEEP 49152:pCLHGeeV5ijCmlDWDkpSmbQyFkBWspBhtsL:wNzkBG
TLSH
T128A56B05E7EA4184F8F3CAF5CA2294169A327C549B34F7DF4A80CA6A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 d2793f156fa942f6a6e31d7ef43ff5a3e0402bd32fd8737063a097e28a095397
MD5 9674271e39c2ae75a200f5cfa0ea9874
SHA1 2e131ef3df85327ba9422c4e43910dc1acd650d3
SHA512 ac26f92873a5d90752fd3de4dcef71644c79b027991fb6ec4dd051f6aef551ecb70e799a73ad82a13d67c8d1628e59495291e7e16249ec4059786229037467b3
SSDEEP 24576:A6DIqSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:A6DIqSmbQyFkBWspBhtsL
TLSH
T176F4F15D63AA01B6D077D03E86434513E2F2B0B197626BCF4794D5BD8EA3ECCB938A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 f48cc9cc42212c166dfb95ae9fa0fd2ad48346b41982e6cb67426ed7e48d193d
MD5 009b87979920c0d419b5b2adfed95c39
SHA1 9c55a7e49e66aa52098d32004a98d18c8767aea9
SHA512 3f6b346a8ee6ee757496f8db290a3fba2bcb22e00a7048b4ab9bd93f7a6284f43b50fb5788977ed1bd353aaf53960034132c43fe38cf2137b5ea73e81ba11852
SSDEEP 12288:wG6kypEdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:htypQSZCKebQyFY62UugqBW+H3ZVXhPg
TLSH
T1ACF4134193D41591F535553A9A2382139BB17870AB62ABCF52A0F73E5E7BBCCF830706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 d816aa7ae70d607fc5e8069eb7464f444f6674efff054c831d5911163d95226c
MD5 df838163c016c90eaa596c30cff20b1a
SHA1 4b6dbcddb98bd04315bfe589ae3f9aa7afe97e62
SHA512 3d9f42aef1bf693de64a4f77195074cb28b40f991c091fedf5a46219925bee63d52911e96c818aae5a36b7d00efd8f4b94c8f6c75f5665f96a50c56ba757495f
SSDEEP 12288:bqudP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:GmSZCKebQyFY62UugqBW+H3ZVXhP1s5R
TLSH
T169D423D292D41A12E43098772512A61362F271F0AB93BFCF93A4A6B9C4EF9CDF570705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 33766bcfe8d4503c036eea771bd9bf190690424483f7a04258d6261443f052b3
MD5 0669d3f43f47d9c3cc8f60e2dda3923b
SHA1 3e21754c16fc1d94f080b5e0704eecb8362f2e0f
SHA512 061cf81070e31877db50b702f9920232ec82bf5be539cb899dd5bda461965d5897610c6b42667a9cb447fa3a3c3c35a80d4af3b56f4981569b9c8ba7c5d58230
SSDEEP 24576:gggILoTfaidZNSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:FgHTrZNSmbQyFkBWspBhtsL
TLSH
T17E559D1DA3EA05CAE2B2D675D9225493D633B0315772D6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 6c2ca5fb6fdddec11fc315ed955e0039251568fab715334b286b166a401e6bc3
MD5 8b6339168a219f4bc2134eeb71f901f5
SHA1 a555485b4bc4dce182570b1a7bfc10c091977fbb
SHA512 76803780aa6a555f64e0673e32d0f5b36d346bd597ef0d5b8be5171cf1329fa65733c1d930c2889473c3f251175f42585c2c8c126d698191b3bc50a9379097dd
SSDEEP 49152:iDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3PSmbQyFkBWspBhtsL:D3Upow8sBGzkBG
TLSH
T186A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 03262229df1abcc08c75ce6792261c9e0941bc70130379e5b05ebecc72833d68
MD5 ec572d7c3b9c67fcd4797ea4fb862148
SHA1 9132f220b665d8c4173ddd022259fe082deaff99
SHA512 8255b528aa0998ae2ad2f48387ccde5ee393a8d6b52a8df3e7e311c49d89c61321630ff52530fd19359893bac43da35640e902fabbdadf9cb97d2689d99c444c
SSDEEP 24576:yPUr+NQLSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:yJQLSmbQyFkBWspBhtsL
TLSH
T19305E15B62E81CE5E676E17D8942870AF7B274621712E7CF02A0817E4E67DDCBC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-363-0x00000282AF2A0000-0x00000282AF306000-memory.dmp

Download

memory/1068-362-0x00000282AF2A0000-0x00000282AF306000-memory.dmp

Download

memory/1068-361-0x00007FF6BA360000-0x00007FF6BA82F000-memory.dmp

Download

memory/1208-342-0x00000209D53F0000-0x00000209D5456000-memory.dmp

Download

memory/1208-346-0x00000209D53F0000-0x00000209D5456000-memory.dmp

Download

memory/1208-348-0x00007FF7957B0000-0x00007FF795ACF000-memory.dmp

Download

memory/1208-340-0x00007FF7957B0000-0x00007FF795ACF000-memory.dmp

Download

memory/1208-341-0x00000209D53F0000-0x00000209D5456000-memory.dmp

Download

memory/1260-339-0x00007FF694780000-0x00007FF694898000-memory.dmp

Download

memory/1260-252-0x00007FF694780000-0x00007FF694898000-memory.dmp

Download

memory/1260-253-0x0000020359F30000-0x0000020359F96000-memory.dmp

Download

memory/1260-254-0x0000020359F30000-0x0000020359F96000-memory.dmp

Download

memory/1708-303-0x000002160D890000-0x000002160D8F6000-memory.dmp

Download

memory/1708-302-0x000002160D890000-0x000002160D8F6000-memory.dmp

Download

memory/1708-307-0x00007FF740070000-0x00007FF740485000-memory.dmp

Download

memory/1712-28-0x000002D1E55F0000-0x000002D1E571C000-memory.dmp

Download

memory/1712-30-0x000002D1E5520000-0x000002D1E5586000-memory.dmp

Download

memory/1712-31-0x000002D1E5520000-0x000002D1E5586000-memory.dmp

Download

memory/1712-29-0x000002D1E5520000-0x000002D1E5586000-memory.dmp

Download

memory/1804-369-0x000001A2D30C0000-0x000001A2D3126000-memory.dmp

Download

memory/1804-370-0x000001A2D30C0000-0x000001A2D3126000-memory.dmp

Download

memory/1804-375-0x00007FF649E90000-0x00007FF64A395000-memory.dmp

Download

memory/2312-287-0x0000023A2FCE0000-0x0000023A2FD46000-memory.dmp

Download

memory/2312-286-0x0000023A2FCE0000-0x0000023A2FD46000-memory.dmp

Download

memory/2312-285-0x00007FF790540000-0x00007FF790C82000-memory.dmp

Download

memory/2312-374-0x00007FF790540000-0x00007FF790C82000-memory.dmp

Download

memory/2420-54-0x000001B5E19C0000-0x000001B5E1A26000-memory.dmp

Download

memory/2420-48-0x00007FF60C2F0000-0x00007FF60C457000-memory.dmp

Download

memory/2420-47-0x000001B5E19C0000-0x000001B5E1A26000-memory.dmp

Download

memory/2420-49-0x000001B5E19C0000-0x000001B5E1A26000-memory.dmp

Download

memory/2420-56-0x00007FF60C2F0000-0x00007FF60C457000-memory.dmp

Download

memory/2856-18-0x00000201382A0000-0x0000020138306000-memory.dmp

Download

memory/2856-46-0x00007FF720690000-0x00007FF7207B1000-memory.dmp

Download

memory/2856-17-0x00000201382A0000-0x0000020138306000-memory.dmp

Download

memory/2856-16-0x00000201382A0000-0x0000020138306000-memory.dmp

Download

memory/2856-15-0x00007FF720690000-0x00007FF7207B1000-memory.dmp

Download

memory/4264-60-0x0000028738C50000-0x0000028738CB6000-memory.dmp

Download

memory/4264-59-0x0000028738A50000-0x0000028738B7C000-memory.dmp

Download

memory/4264-61-0x0000028738C50000-0x0000028738CB6000-memory.dmp

Download

memory/4488-376-0x00007FF694590000-0x00007FF69463C000-memory.dmp

Download

memory/4488-293-0x00007FF694590000-0x00007FF69463C000-memory.dmp

Download

memory/4488-295-0x000001B2F2F50000-0x000001B2F2FB6000-memory.dmp

Download

memory/4488-294-0x000001B2F2F50000-0x000001B2F2FB6000-memory.dmp

Download

memory/4564-274-0x0000000000710000-0x0000000000779000-memory.dmp

Download

memory/4564-360-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4564-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4564-279-0x0000000000710000-0x0000000000779000-memory.dmp

Download

memory/4676-1-0x0000000003750000-0x00000000037B9000-memory.dmp

Download

memory/4676-0-0x0000000003550000-0x0000000003646000-memory.dmp

Download

memory/4676-7-0x0000000003750000-0x00000000037B9000-memory.dmp

Download

memory/4756-246-0x0000015503FC0000-0x0000015504026000-memory.dmp

Download

memory/4756-244-0x00007FF65F6F0000-0x00007FF65F7B7000-memory.dmp

Download

memory/4756-330-0x00007FF65F6F0000-0x00007FF65F7B7000-memory.dmp

Download

memory/4756-245-0x0000015503FC0000-0x0000015504026000-memory.dmp

Download

memory/5008-37-0x00000249D4000000-0x00000249D412C000-memory.dmp

Download

memory/5008-38-0x00000249D4200000-0x00000249D4266000-memory.dmp

Download

memory/5008-39-0x00000249D4200000-0x00000249D4266000-memory.dmp

Download

memory/5008-40-0x00000249D4200000-0x00000249D4266000-memory.dmp

Download

memory/5344-320-0x00007FF65F6F0000-0x00007FF65F7B7000-memory.dmp

Download

memory/5344-236-0x000002DC6B590000-0x000002DC6B5F6000-memory.dmp

Download

memory/5344-237-0x000002DC6B590000-0x000002DC6B5F6000-memory.dmp

Download

memory/5344-235-0x00007FF65F6F0000-0x00007FF65F7B7000-memory.dmp

Download

memory/5396-321-0x00007FF6B18A0000-0x00007FF6B1B42000-memory.dmp

Download

memory/5396-323-0x0000020777890000-0x00000207778F6000-memory.dmp

Download

memory/5396-322-0x0000020777890000-0x00000207778F6000-memory.dmp

Download

memory/5676-351-0x00007FF70FDF0000-0x00007FF70FF38000-memory.dmp

Download

memory/5676-264-0x00007FF70FDF0000-0x00007FF70FF38000-memory.dmp

Download

memory/5676-267-0x000002433C5C0000-0x000002433C626000-memory.dmp

Download

memory/5676-266-0x000002433C5C0000-0x000002433C626000-memory.dmp

Download

memory/5988-333-0x000001DE1E5A0000-0x000001DE1E606000-memory.dmp

Download

memory/5988-332-0x000001DE1E5A0000-0x000001DE1E606000-memory.dmp

Download

memory/5988-331-0x00007FF7A60F0000-0x00007FF7A6283000-memory.dmp

Download

memory/5996-313-0x0000028468EB0000-0x0000028468F16000-memory.dmp

Download

memory/5996-312-0x0000028468EB0000-0x0000028468F16000-memory.dmp

Download

memory/5996-311-0x00007FF7650C0000-0x00007FF765172000-memory.dmp

Download

memory/6040-357-0x00007FF79D970000-0x00007FF79DBF9000-memory.dmp

Download

memory/6040-352-0x000002177BA10000-0x000002177BA76000-memory.dmp

Download

memory/6040-353-0x000002177BA10000-0x000002177BA76000-memory.dmp

Download