180bf7c0b7ba6ac8154c6ff498adb9366b32ec414586eb046efa7a9c0af309ef

Analysis

max time kernel
146s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260804-lr6wcssxcy
SHA256 180bf7c0b7ba6ac8154c6ff498adb9366b32ec414586eb046efa7a9c0af309ef
MD5 c83ed963077c48c48fcc330e0132dd5d
SHA1 0e61ec3cfe7827b185d4e098e140c69fbca824f5
SHA512 18e701f26b7fff2dfa0849427607ceb0f59815285fbf15f58514d9d5e06c8ffe75665910d6c78b7b7b9b58fe773a2ae3b00731bb1a707fb7b0aa6c1de4647514
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJBBrtuKa4FHbb9Ci3C27rh/m:zul13qcQFTIOZeR/uKdkipY
TLSH
T11E45E02ABAF0C032C12351359D6AD30862B5E47288264887FBDD671D6F705D3DB39BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4912	alg.exe
1760	elevation_service.exe
3356	elevation_service.exe
2320	maintenanceservice.exe
4964	OSE.EXE
5880	GameInputSvc.exe
4864	GameInputSvc.exe
2804	msdtc.exe
5492	PerceptionSimulationService.exe
4608	perfhost.exe
2100	ReFsDedupSvc.exe
3436	locator.exe
2772	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4110961e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\ResetSubmit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	GameInputSvc.exe
4864	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3316	2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	4912	alg.exe
Token: SeDebugPrivilege	4912	alg.exe
Token: SeTakeOwnershipPrivilege	1760	elevation_service.exe
Token: SeTcbPrivilege	5880	GameInputSvc.exe
Token: SeBackupPrivilege	2100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2100	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 4864	5880	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c83ed963077c48c48fcc330e0132dd5d_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4608

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2772

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3528

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f643695af005d2c777dd497095c1026dec8ebff1f6e5798829f5da7c355d2e75
MD5 13dbfb0afdef97f48a295d03252a675e
SHA1 2fbe019bcaaa63fbbc1aba4c3d1a149fa1bf01bb
SHA512 dc98cd6487030117fc4858619915ed2741e246ca0d7e494e1cea597f082a61642e575ff5ba3e553cc3eaebccc79e752bf990a101d75e8647e7f570ebda9314d3
SSDEEP 49152:xb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnU/uKdkipY:33q6gjBfFnS
TLSH
T13CD58D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 ccf6cec9f5b0c9dcfce6bae389cf21520bb19478bbf201bd9fb96746e6e22600
MD5 95368b65666cd8f92449e99014df6c59
SHA1 3ee29b4a8bb1cef3bc67ed497891493baf5de094
SHA512 add80ecd37a5fa1bbe3124501366889faa0c999fdb451e07eb8ec46da3fa244e98e17910eb7bd8512ddd5b70d274e5dd06a802bb0c5f88ed8a15ac6791cd305f
SSDEEP 24576:sXYfDtczAdWBrtuKa4FHbb9Ci3C27rh/m:LtcB/uKdkipY
TLSH
T1A305013863F409F9DD67817DC8B28501E633B85547A0EB9F03E486256F233989E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 f2b8f047286f1c9b350efd7801a6c732bf83c1966d76a49b4553d90613ee8a4f
MD5 5f989578b388ef34d175f18f76638341
SHA1 8cf85351a2c008702f1f07338bf5d93be8a4fbbf
SHA512 ef8882e845dadc4c25cf182cb43c41ec3fa34843a27830281bff7fc925ce78dda6db683e2af08605eae3b4dd691a533c6fe1dd76b83c8be899b4c6e3e4a2557d
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CmBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHc:Owu+OWNBrtuKa4FHbb9Ci3C27rh/m
TLSH
T1F505F11532F81CF9E9668139C597C136F7B2B8162A60DB1F47A0C75B6F23321AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9a71657ab29d55ff9de0974d66bef002fa64d00608163dc1f72d0b5ee1ccfe5d
MD5 b2a83fce75bc3cffc5e56b969922e8f2
SHA1 8367b6e9a8b3e601ef0c753ee7e0738df3cd353b
SHA512 b87154e43eaa0a2b3a9ea225f9055650cc91cac7f25c58b09613a032330a47d6f475b73a3c9996005f172ce664e078ab2c3a756b42dbda82e8955f64b93a7f6a
SSDEEP 49152:KB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glc/uKdkipY:Yu6JmTxd2dcFnS
TLSH
T1FED59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073552E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 e80e032b9fcb8df4c8563bc1527ce36eb91afa840bb368c3fc7d5d1a5418df94
MD5 8d8086101cce5919bb5c722e43be64c1
SHA1 24e05f2137f27746b477568c6544350143e67a31
SHA512 0ac1cfab1b6008653120735f2eed77d2d41bd903dfb19e6e47ffd6425e4526bdfad04883636513e8e4aa120415eab24144a35637ead97bcf4929b3319136bcbc
SSDEEP 12288:cn79Brev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/Ub:q9BrtuKa4FHbb9Ci3C27rh/m
TLSH
T198D4233043BCAE86D92451F9A0B9E114221BB52DAFA0D8DFC7944340FE11A59EDF893F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 93125ad4e4ad8f325a1da756e17efa951daaefdaf280eb1429d7940ee2de9326
MD5 6f1f3dacee9279d50f1196e4d84437a2
SHA1 02e1e463d91a7f437eebb148533331abf401f678
SHA512 d123d1b36ee83939480dec1fc3994f82762daeecb3452cf2016749458821b487b626e61c62a91f9b06da5733dcc9c9dc0d3fb257379013a9560d43e753642774
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYDBrtuKa4FHbb9Ci3C27rh/m:rgb4mBIBhGFk/uKdkipY
TLSH
T18F65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 9aff07f886f8fd150b3a796863ec56589e5652f667046c5eba51c290a7fa2914
MD5 1b9c28e120cfcb24e761379b60b6c92f
SHA1 9f000f82ca2776d4f458dd54eeeed0f005dc2d59
SHA512 3a38cac2e6ba52e170cae980b50ed68f3dc1b6e47b1bd3b5bb36fc22534b84e13678f6cef0cc78a9ed25370d5dc65217785f68397285daf650cee2f545f2fcff
SSDEEP 12288:PYGhBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/Ub:wGhBrtuKa4FHbb9Ci3C27rh/m
TLSH
T1C3E4123821FC79D8C93482BDE4B1A516357274246B6069FF8AE48270EF116E4F67CC6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 60fd17661a5b15d12847b343ea31dba57975e2475d0d0f79cc87683899c78cfb
MD5 33fd245bd0dcd0f7333a290bf9fca7af
SHA1 3b8df46b6c89e8c1cad18640622ba164ad2511cc
SHA512 9c1ef94c96e6d94be60c34f99b78191fcfb02146b54b7572e349d5993a8a4cdff578c228aa488a206ab9bbcfe401379569af9bd33526c1010f9ccf6ba33281d8
SSDEEP 12288:klYBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/Ub:klYBrtuKa4FHbb9Ci3C27rh/m
TLSH
T183D4233002BCAED5CA1095FEA4B5A5042216B52DAFE099DFC7D94340FF026D9E5B887F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b5ce09163781c0747a976457298c6465469e17662d6250c37ff8f348ce4e7e9f
MD5 a8edbd6fc71e1a178eba1bfdc8f74870
SHA1 34e23193cf92ccf191e6fa4c7b20d75547ce25e5
SHA512 af0eb74ca9f524c3ad38c10ecf7c5c85ce160459097f893b6ece3597794e477d92b185cab55f851a0982e69110691b4900925617b2863238468a74509753e30a
SSDEEP 24576:Erm8/8FpJqH1Mzria7/mfBrtuKa4FHbb9Ci3C27rh/m:+lUFPqVra7/w/uKdkipY
TLSH
T17035F12566F402F0D47BD13889924663F6B2B4251360EFDF07A88B512F23AE54B7EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 29b7892aff05dee481ab243009c98ace2375d6720cccc9914971ee2d8521191d
MD5 b9c4565ba96445e487075809ff6dad5f
SHA1 e1ddaf349664b591f5e1b0822b12e763dc33da6b
SHA512 97575e7eb1105cddaf9a51c1d81d2e819be23ba9fdaeb309f959f4037eeecbe086f6c858172a84f3b157c12d7c342e743f8a0ebcccd178d221356d700b5cfea6
SSDEEP 12288:6HvUrBFrEjwaQUBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/m:6PUr+NQUBrtuKa4FHbb9Ci3C27rh/m
TLSH
T10F05E12E22BC1CE5E676E17D85828609F772B4661751D2CF02E0817E5F13AE8BC3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b59aacb97c63b678bfe4e20db150abc19bd343ad39469516dd7ce2e7b1190277
MD5 70837884ebf7a35882ae137a020cc508
SHA1 087617b0dd1e03b40d0d14fe3c2bbdc350c1d45b
SHA512 caad30b3a90151afb22d55a7e3aa135a93f3d86022b47377c82f125e7db8da544be8e91fa8569c8c6d9d7c224f7c1382e3f825778fbe97572f1f40d18ac106a5
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjF/uKdkipY:SG05lO43bgFnS
TLSH
T1D8D5CF6A62FC11F9D1BBC17CD9C6460BEBB23425032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f5f7f516cb1b5f6ec04b563bf437c81a1606f7ea06c75c7fed69df7c0d6217f4
MD5 2341e4127e88af9d849e32438394c75d
SHA1 aedc16ba7a4c5d13b254d0ffb6baf25c76b6676b
SHA512 8328fef7791c2534a7a5868d470daf82ff163a6555de88b77590cdc3d168ed299a5e7e2dc8beba1bfc4ecf18e65b4d4de9ec7afddb2e01b02e54e54c1d5510ef
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkUBrtuKa4FHbb9Ci3C27rh/m:lNc/zEOVHFn/uKdkipY
TLSH
T122858C2623E901E4F5BBE1BE89779546FA71786517308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 7f97daa6f3b78e3c04956fee4bac27e10475548b84d79682f9320f3bdd4f2faf
MD5 e636b324b45d0bb9cfdc093207d0ded6
SHA1 acf7a762be07e3669aadb99515dde28d8489a18a
SHA512 a6f309c160871356b3972491029c1b53faea54ec5884ecc167a50071f83382581c15b7c053f2aea36f51dcb878df1fc69dec1431634844d381db2a8a39b0cf98
SSDEEP 24576:ZJnJPbzB4SsBrtuKa4FHbb9Ci3C27rh/m:ZJnJv6Ss/uKdkipY
TLSH
T1B915D03DD2A810E8D4B7C2B8815A175ABF31383D2F2169CB59B4D5343F12EE0A979F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7eced567ef81c6754a787a4d6cb51757fdc3376a3d7cdb397f9c0748487221f6
MD5 e8b1f72055f58c0eea30f14051a2ea31
SHA1 1cf548374f030138771f5fdf8ee7982a3d8b76e2
SHA512 a61bbb2c80fe84fe98f50d3be203e29d09b8f5f936450012b4d5ad2bc70e83aae9bf4b3b9ed7aa5c76b6b0ec2481abd858d973cb7c3b03357a8ea8435dc4ccfc
SSDEEP 24576:FCLHGL0MoeVtFumTijCmlKQWDk5BrtuKa4FHbb9Ci3C27rh/m:FCLHGeeV5ijCmlDWDk5/uKdkipY
TLSH
T10BA56C05A7FA5184E8F3CAF5C92294169A327C549B34F7DF4E80CA6A2E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 f09adc88b73a47791cfe56edc065f4fec2750ce74fcbd96f6f17b916c84caf0b
MD5 1a09414455a54e893491d95957129808
SHA1 e56ffa095af177b24b3bcd8d5ab8b21ff0d6507f
SHA512 182ad138295c7539dcb50b8e98ee39a42aa06b9cb8c07dda686ddee873a893e6045b99254b6aa9f93f52b419d6f7f7c38c3aedfb8b6dbff6b7ddc56743d7bb13
SSDEEP 12288:r1Hck6j5ZI7uBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/Ub:v6DIqBrtuKa4FHbb9Ci3C27rh/m
TLSH
T131F4012C23B910F5C167D07EC1920101E2B2B0759B6259DF47D4C6B9AFA3ED8B93CE56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 83c5fcfa2ecabc3633fae16901b578bec0a690772912770f347cf3c033df247c
MD5 6c80999dac1658892ed8a8d5b3004eab
SHA1 45ddb8ea21535d2e369112c423493d8dc6a09109
SHA512 f612d0d0db891db9dc41cdc68632b32def4169c2461b42eb790f50aa0ee9aa864d2615a32cfb5e3c7621cdee8dff4a439cc5632cbbc0f27bbe013dcbc8849ee7
SSDEEP 12288:dG6kyiSBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/Ub:ktyiSBrtuKa4FHbb9Ci3C27rh/m
TLSH
T1E7F4122013B865D5DA7442BCD87281501A36BC246F6096EF86D0D72E7F327D4F874B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 cc955c939ff3569e374e4ad3fb4af81d47b31b7ea55710d25ed5890f90e3d89f
MD5 3306bebd1f7502294c37ebfd812be59b
SHA1 871c6621f148c718f8b75d3a56a8abe3f6454883
SHA512 1cbc550109b5c53e5d84b893907a5d1cc3ca532c823a7ce96ccbd9e16a848c6293b3c623e2e84290ad3e4ed8f1513c835e872b78416093f5e6ee062c74099e75
SSDEEP 12288:UqTBrev8uN0faokkcvqFHbbcE3S589IEDOWG0xFCjmHrup8rLkC/Ub:9TBrtuKa4FHbb9Ci3C27rh/m
TLSH
T1DCD4233802BCBAD5C91095FDA075A5052226B43D6FA098EFC7E48360FF126D5E5B8C6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7ac543450f467014537adbd55db97359c50d6ddbe12915b056892553ec134625
MD5 0a1b64dba419ab7b72a7b1bd9b4ece71
SHA1 4a4fa38470eee32c096771d527a338e6322c6856
SHA512 847ca2d99741eefc3bdfad5be13f1c0c99d14a846ff7a3e8e7cc49ded91b7279f2764fc0a73ad4531ff7324e6ca4e1773e7d98523e12e7b16ae8603b54036e75
SSDEEP 24576:VggILoTfaidZHBrtuKa4FHbb9Ci3C27rh/m:+gHTrZH/uKdkipY
TLSH
T1D1558C1D63F909CAE2B2D279D8625493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1760-28-0x000002D04ADB0000-0x000002D04AEDC000-memory.dmp

Download

memory/1760-30-0x000002D04AFB0000-0x000002D04B016000-memory.dmp

Download

memory/1760-31-0x000002D04AFB0000-0x000002D04B016000-memory.dmp

Download

memory/1760-29-0x000002D04AFB0000-0x000002D04B016000-memory.dmp

Download

memory/2100-287-0x00007FF680D40000-0x00007FF681483000-memory.dmp

Download

memory/2100-286-0x000001F2B14E0000-0x000001F2B1546000-memory.dmp

Download

memory/2100-285-0x000001F2B14E0000-0x000001F2B1546000-memory.dmp

Download

memory/2320-53-0x000001CD5F550000-0x000001CD5F5B6000-memory.dmp

Download

memory/2320-46-0x00007FF610A70000-0x00007FF610BD7000-memory.dmp

Download

memory/2320-55-0x00007FF610A70000-0x00007FF610BD7000-memory.dmp

Download

memory/2320-48-0x000001CD5F550000-0x000001CD5F5B6000-memory.dmp

Download

memory/2320-47-0x000001CD5F550000-0x000001CD5F5B6000-memory.dmp

Download

memory/2400-331-0x00007FF76F160000-0x00007FF76F2F4000-memory.dmp

Download

memory/2400-332-0x00000246749D0000-0x0000024674A36000-memory.dmp

Download

memory/2400-333-0x00000246749D0000-0x0000024674A36000-memory.dmp

Download

memory/2772-302-0x00007FF6CDF90000-0x00007FF6CE3A6000-memory.dmp

Download

memory/2772-304-0x000002A01F8E0000-0x000002A01F946000-memory.dmp

Download

memory/2772-303-0x000002A01F8E0000-0x000002A01F946000-memory.dmp

Download

memory/2804-251-0x00000182926B0000-0x0000018292716000-memory.dmp

Download

memory/2804-339-0x00007FF7E0FF0000-0x00007FF7E1109000-memory.dmp

Download

memory/2804-250-0x00000182926B0000-0x0000018292716000-memory.dmp

Download

memory/2804-249-0x00007FF7E0FF0000-0x00007FF7E1109000-memory.dmp

Download

memory/3316-0-0x0000000002780000-0x0000000002876000-memory.dmp

Download

memory/3316-1-0x0000000002880000-0x00000000028E9000-memory.dmp

Download

memory/3316-7-0x0000000002880000-0x00000000028E9000-memory.dmp

Download

memory/3316-6-0x0000000002880000-0x00000000028E9000-memory.dmp

Download

memory/3356-40-0x0000017587130000-0x0000017587196000-memory.dmp

Download

memory/3356-38-0x0000017587130000-0x0000017587196000-memory.dmp

Download

memory/3356-37-0x0000017587000000-0x000001758712C000-memory.dmp

Download

memory/3436-294-0x000001EADBA30000-0x000001EADBA96000-memory.dmp

Download

memory/3436-293-0x000001EADBA30000-0x000001EADBA96000-memory.dmp

Download

memory/3436-299-0x00007FF720B80000-0x00007FF720C2D000-memory.dmp

Download

memory/3528-324-0x000001FB85BE0000-0x000001FB85C46000-memory.dmp

Download

memory/3528-323-0x000001FB85BE0000-0x000001FB85C46000-memory.dmp

Download

memory/3528-322-0x00007FF71E0E0000-0x00007FF71E382000-memory.dmp

Download

memory/3556-342-0x0000027BB5270000-0x0000027BB52D6000-memory.dmp

Download

memory/3556-341-0x00007FF79F260000-0x00007FF79F580000-memory.dmp

Download

memory/3556-340-0x0000027BB5270000-0x0000027BB52D6000-memory.dmp

Download

memory/3556-346-0x0000027BB5270000-0x0000027BB52D6000-memory.dmp

Download

memory/3556-348-0x00007FF79F260000-0x00007FF79F580000-memory.dmp

Download

memory/3688-354-0x0000019AA9CF0000-0x0000019AA9D56000-memory.dmp

Download

memory/3688-352-0x0000019AA9CF0000-0x0000019AA9D56000-memory.dmp

Download

memory/3688-353-0x00007FF686AB0000-0x00007FF686D3A000-memory.dmp

Download

memory/4608-360-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4608-279-0x00000000007E0000-0x0000000000849000-memory.dmp

Download

memory/4608-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4608-274-0x00000000007E0000-0x0000000000849000-memory.dmp

Download

memory/4700-362-0x000001493DBC0000-0x000001493DC26000-memory.dmp

Download

memory/4700-363-0x000001493DBC0000-0x000001493DC26000-memory.dmp

Download

memory/4700-361-0x00007FF687AD0000-0x00007FF687FA0000-memory.dmp

Download

memory/4864-246-0x000002AB861D0000-0x000002AB86236000-memory.dmp

Download

memory/4864-243-0x00007FF7F8730000-0x00007FF7F87F8000-memory.dmp

Download

memory/4864-244-0x000002AB861D0000-0x000002AB86236000-memory.dmp

Download

memory/4864-330-0x00007FF7F8730000-0x00007FF7F87F8000-memory.dmp

Download

memory/4912-16-0x000001AFA7D00000-0x000001AFA7D66000-memory.dmp

Download

memory/4912-18-0x000001AFA7D00000-0x000001AFA7D66000-memory.dmp

Download

memory/4912-17-0x000001AFA7D00000-0x000001AFA7D66000-memory.dmp

Download

memory/4912-64-0x00007FF7AB870000-0x00007FF7AB992000-memory.dmp

Download

memory/4912-15-0x00007FF7AB870000-0x00007FF7AB992000-memory.dmp

Download

memory/4964-58-0x0000026F005F0000-0x0000026F0071C000-memory.dmp

Download

memory/4964-60-0x0000026F00530000-0x0000026F00596000-memory.dmp

Download

memory/4964-59-0x0000026F00530000-0x0000026F00596000-memory.dmp

Download

memory/5316-312-0x00007FF7F0A80000-0x00007FF7F0B33000-memory.dmp

Download

memory/5316-314-0x00000278483B0000-0x0000027848416000-memory.dmp

Download

memory/5316-313-0x00000278483B0000-0x0000027848416000-memory.dmp

Download

memory/5492-351-0x00007FF72D4D0000-0x00007FF72D619000-memory.dmp

Download

memory/5492-264-0x00007FF72D4D0000-0x00007FF72D619000-memory.dmp

Download

memory/5492-266-0x000002443E1A0000-0x000002443E206000-memory.dmp

Download

memory/5492-267-0x000002443E1A0000-0x000002443E206000-memory.dmp

Download

memory/5880-236-0x000001A69E490000-0x000001A69E4F6000-memory.dmp

Download

memory/5880-321-0x00007FF7F8730000-0x00007FF7F87F8000-memory.dmp

Download

memory/5880-235-0x00007FF7F8730000-0x00007FF7F87F8000-memory.dmp

Download

memory/5880-237-0x000001A69E490000-0x000001A69E4F6000-memory.dmp

Download