3a536ffde51f3499a196f39c0c08fc4a7838f7b0d2404e93c3f1e2db2be393fc

Analysis

max time kernel
143s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe
Size 999KB
Sample260804-mtrd5acr5v
SHA256 3a536ffde51f3499a196f39c0c08fc4a7838f7b0d2404e93c3f1e2db2be393fc
MD5 94bcfcb4e3b4eaa070fa869f5ad65b23
SHA1 0055e0c1833ef61b0c8963b18e8549d3e338ca55
SHA512 1068718d1ce3697282b0bbaf300dc4d525e9c65f5be603aff7ddb7f78d0c13f134ae4b1278b54d304e6a6df1c4cf7cc39e5e23c7893af6a56b18571ffab55c90
SSDEEP 24576:bNEHd0EKpxtJFtS9Jtr89TMFZ2qr4bWRw/PPO6hAnOZfPbWyC9e:bNEHJKrtJFoHr89TMn244qRw3PgnOZf6
TLSH
T13B25F115B784D033C577013A8F56D3A4A9BAF5B188214107B7E8AFBD7E701C2DA39B86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2040	alg.exe
5916	elevation_service.exe
1672	elevation_service.exe
3816	maintenanceservice.exe
2940	OSE.EXE
3948	GameInputSvc.exe
4596	GameInputSvc.exe
696	msdtc.exe
4272	PerceptionSimulationService.exe
2832	perfhost.exe
5348	ReFsDedupSvc.exe
5156	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4726af05763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	GameInputSvc.exe
4596	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3544	2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe
Token: SeDebugPrivilege	2040	alg.exe
Token: SeDebugPrivilege	2040	alg.exe
Token: SeTakeOwnershipPrivilege	5916	elevation_service.exe
Token: SeTcbPrivilege	3948	GameInputSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4596	3948	GameInputSvc.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_94bcfcb4e3b4eaa070fa869f5ad65b23_amadey_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3816

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3036

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5416

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2412

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4304

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b96f0343d69b7257f29fa0f547aaf8cd923403164e38e192d4591f2897cc4b0c
MD5 80a12cc5c4e1a7ad497388b70ddfc73e
SHA1 8d9ba8ae8dc5a6cfaabad26aaa859f4f27e72341
SHA512 2f13eca4d92d7563f932fbbcc785ec4805d00ea60ae27682cf57af90fcf3a0b6904299c62d0b0b2d7870535d74b3cf7bf92c8e416062ba971bae07b817a07a8c
SSDEEP 49152:ub+632BuPkFKRrdE6oh7stBhuXjfS4LWxnJqRw3PgnOZfPy:w3q6gjBBwo1
TLSH
T17BD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 bdbea21f272519f3dc7206e3d29a76c5978eb1b52e30311827c453db552a3740
MD5 eaaee1248d0b38c4358d6f990afc1981
SHA1 989c6057042ea03ec95e26db9b0c56596a312492
SHA512 71163b99ea4105f472b7c0401c999f486bea5d95a05491ea7e1ee2d42620c14742d3e4afcc0fef52120a43c1a82a777a0a05c7414f4be5a749ec4859e7ec45a7
SSDEEP 24576:nXYeDAczAebWRw/PPO6hAnOZfPbWyC9e:BAcLqRw3PgnOZfPy
TLSH
T13605022873E448F9ED6B813DC9B28512EB73B8554760E79B03E489351F236C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 4660442715e2a61a43a3574d2cdf79684e3577017e92bf603d39329b63356f39
MD5 4edba6234ab649b644de21afdce68227
SHA1 b786c40a4795d600fdfb78f55f6605a6ec49ae95
SHA512 852ae92d0e6a3c3e7883987f0e45aae4e0db827a429ff20866d06409fae1945e28b38574b67e14d974edde794b5275d977312ea5830e26b5f2655d713bdbf0da
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+Cmig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicL:Owu+OWRbWRw/PPO6hAnOZfPbWyC9e
TLSH
T1CD05F14573E44CF9EAA685398657C132FBF3BC112A24DB2F1760C65A6F23251AD3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c4c4e2e7d0d7ecbee7ae3c19e8af7b49597084e53d6e75b71510c7850df46754
MD5 a3ebee618167a32bfad0ce73b9e5d44b
SHA1 fa4cd3ae1c309d5817006cf975dc74a50cc47037
SHA512 1b2a87bb8d65a4d3092a2f8b6904b88ae16a17be53d3fc4419a7b86af853b314d3431c32eff89f21f16ff3175d5bb90115585be4893007dd996e70b3bb3fe846
SSDEEP 49152:oy+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBqRw3PgnOZfPy:tu6JmTxd2dGwo1
TLSH
T17DD59D13F1DA01E8D06ED479974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 a253a1d8da6ab1e6437d17869b0c4a3ea0dd57d3301e735e450501d14a1bc034
MD5 21a260b29188b5c16f39666b9325e37a
SHA1 d09060fcc0306563859faa56d85b2218d2647b5e
SHA512 b88bc39d308ccbdafc6c8b5db6699165f99dd3db16398e278a0abc7a7cf69c737211353e930d9edf7a8e12d21f20633712f82bdb6c6ba905dcb1a0492c4d9bd3
SSDEEP 12288:cH77ig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:q7bWRw/PPO6hAnOZfPbWyC9e
TLSH
T13ED42381A3F9C856E7AC987B42764032BE5FFB758F04C5F6B7444A187862C858D3A3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ef6e2c602de5ed417cd74d5789aac33e867a7bdf68d66deead0f2210a83d258
MD5 af6730f0e48927d3d6aed352472500bd
SHA1 5aef4d504956950cd084f45fb3234580d8a95dfe
SHA512 624d109c53d3cf1886358a6752c263eacc04d3c7c8bf871c326094582cfcadecad4e1eb500ef18e421f40681f90cf1245e9f577bcda4d2d19450d2763e65772e
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYHPG3DHwgRb/Zkf/EUz3:vgb4mBIBhGFUPQBb/Zkf/tz3
TLSH
T11865AF1E22E802F5E0F9D2B8CDA64417E6B278560731D2DF1251523D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 cd602f23aa93e2a78a1c7d0c44ce80c14e8d13bbab235cc0ebb0c6a68a46bb11
MD5 ba3020b7f9050469baa65841330d5154
SHA1 34acd4fd355b5b12a98dd5f430b0213aac397e12
SHA512 f95f6dc8f779e23dd3098b43c7dfdbffbd36e047dc9656f16fbe5c979aa30f2e65706f34be33f1ea707ef66539920e31b35fbe42fa06dd729ad4f03e3f645a79
SSDEEP 12288:9nGiig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:tGibWRw/PPO6hAnOZfPbWyC9e
TLSH
T117E4224C72F6A4D4C67CC53E85714033BDBA7A709B04A6FF46E4C5349E528D09A3EEA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 116cc4affbdd46c2a6666ab921bc1d29e5a96cea9f72e5f0457f81651bd04f4a
MD5 4e4da73f40a673526f8175ab4b63d94b
SHA1 cd8943e0346983efbac9105079b5b64fd347a584
SHA512 87e085ad8377d3aae330b8a1a0dd92da155b8dc5fdc8ea9c3306cacbe3d80e9e64b0cc73e15b39e3d384afa79c8bfafee468b0905a12f2a20b1255c50eddbb54
SSDEEP 12288:Ayig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:AybWRw/PPO6hAnOZfPbWyC9e
TLSH
T125D4238462B5C896D78C987F42624433BE9FBB758B4496F7B7944A242843CC68D3E3F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 be2723549ce8b2ec0b4b5de89eb7414ed1e487e6a1113b18b42e7324e973d2de
MD5 572a433760c0fd3503f23e62e4701381
SHA1 427de36cfdb8581740edcb7c0eb8268224a1aa3b
SHA512 3c0b7d91a7757391a91554896a7a2b9ac24550470063045b36a39ff4fe1bf3bc9cd4122b3c1df755b302d2bc25bb412a490b0f160cb789d43e0c3e816a414df8
SSDEEP 24576:EOQ8R8FpJqH1Gzria7/mXbWRw/PPO6hAnOZfPbWyC9e:nfaFPqVRa7/0qRw3PgnOZfPy
TLSH
T1AE35F16577E101F1D47BD0388A924663F6B2B8250364EFEF07A88B551F23AD54B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 d03b580f39d719bdb27850106a039e43d57c584168cfa82cdf502eeb8d638e67
MD5 529b4bd191b850a05041e06e832efce9
SHA1 569b5b80732eea213b9cd0e9db47bcccea17deb3
SHA512 1e57222371a991058054db6f3055fd7276981212070f9fc1497a86b3e66abe67d0c17656cb4ec9682ca048aea862e6fe3025f9cdb72affd5eaf77c8cfa479048
SSDEEP 12288:wHvUrBFrEjwaQJig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCNG:wPUr+NQJbWRw/PPO6hAnOZfPbWyC9e
TLSH
T13C05F11F62ED18E5E679E17D86828619F772B4620711D2DF03E0813E5E63DD8AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8808fcc097d07d695de81a2e15932d0fe4f06176d784132e958eb565217d88c2
MD5 dd04cb966f13549477a4930572befd3e
SHA1 f387b77d118381a82877611c9149c932c4ad83f8
SHA512 f696d727a7c6c7ae9af4aa5267f73275ba49d22afda61035d46485d8f03364662caaa24d3e2a7365050a79aa27565093d1f9492fbe05fefa4ea8a6e022ec78db
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTqRw3PgnOZfPy:UG05lO43bJwo1
TLSH
T171D5CF6E62EC11F9D1BBD07CDAC6460BEBB23425032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 876394d9224d819b4bad9688b029e1053ac34cc9611655dcbca3a9b9cbe38c2a
MD5 834c9435a987b3d88fe53f5e2cf3aa1e
SHA1 5005c6cede488b479d7f4e05499cc338f7b1ba95
SHA512 b3efd88efc63f25b8491a71eb8b24a02042a768198e65d16f87cb74bd796b3a50b88ed22986497b351fb19abaa90f19e4a79d7a5204c62d8de06eb4472f779d5
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkubWRw/PPO6hAnOZfPbWyC9e:nNc/zEOVHF1qRw3PgnOZfPy
TLSH
T140858B1623E901E4E1BBE1BE89779546FAB1786953308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 5403341aa89d090c7508541d8f0c25e4f03a10e631bee59017fc57e0be32368d
MD5 ac9c01987a55815c0a9e0ba4b416744d
SHA1 892baa113da1b445f43281732f4b38d725649445
SHA512 26dbc7a7b8981a92ab8afbc6e6dd066106e82ae087a63b80a95d26c812a7c119248ad3660fbdfcf475d46ec2b1f01d062c9ba36ec850da60553e28c6ba7cf34b
SSDEEP 12288:7pHPJnJP6szeCs6Rl28dfuPG3Dspyi7gxz7sjM/paEMK9SBHewStuzQaZiC/8Ki6:ZJnJPbzB4S2PG3DHwgRb/Zkf/EUz3
TLSH
T15F15E13DD2A810ECD4B6C274811A1B59FE3138ED2F2259CB59B4E5313F52ED0A939F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 791fe728f3eaa872b8849cb053275c11d1da72fec17f9643dcb0e0009d37770e
MD5 25a2882ca20fec041958d59254d41181
SHA1 069adfacd67a4fa167e212409cb563bacea8f108
SHA512 6868363a1faed135130c8fd1036ab93bb4fc9b2eb29905595f11ac5da263be4739ab056a8863f174d52edb07c47bfe5e236cd3e3ed1453d12604dec6aa6467db
SSDEEP 24576:LCLHGL0MoeVtFumTijCmlKQWDkvPG3DHwgRb/Zkf/EUz3:LCLHGeeV5ijCmlDWDkvPQBb/Zkf/tz3
TLSH
T1E6A56C05E7EB4188E8F3CAF5C92295169E327C549B34F7DF4A80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 d2242dd38d8e6fc26592cf874f0b664ad03847e495072d581be1e8c882f190e1
MD5 30b185086e213d569fcafca1d85a15ba
SHA1 055d03f311b5c2574c05d5490986d48076f64290
SHA512 ae9bdb44d0fcf7340e6a322ec4645f8ab9cc87a0cc7df659ec744b263906f1534567eef493dda00535046dc7dc68ef267258eb8e58de534dd5c2603a027dd89d
SSDEEP 12288:r1Hck6j5ZI7Yig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PW:v6DIkbWRw/PPO6hAnOZfPbWyC9e
TLSH
T153F4014C33BA10F5D1ABD03E86930512E6B2B57187125AEF0BD4C5795EA3EC8B93DE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 8b04f3d36ae79b071fc5f03cf7afe55f3a6f8de2aa3ecffd55957e81da4bbb64
MD5 595eed6986472d6b23b6d8abfc5e63e1
SHA1 945b1c07c9d4a3b17a531c74c1e9634645dadeea
SHA512 4b6e7190ae5a07a0eed801fb53a18ad5b146902b3e7c5b6c2230cdf2a5e4c5ed876ab4eda22231a25ac4b89fb509008841608ed1a65d7aeb70185df0797c910c
SSDEEP 12288:NG6kyqig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:0tyqbWRw/PPO6hAnOZfPbWyC9e
TLSH
T14BF4124463E890D5E7BC453D8A7381629F7ABC309B1093EF66D0DA3D2E32AC49D35B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 9bacf348cc5e8158848c9cb3f8c99040f70c1cf64ce7f148b914dd6e2e5b037a
MD5 23d8e9bccfc9d3223d9eeb000eb021ad
SHA1 c7e6a26d93539bcede19fab6c6a7165eec187a6f
SHA512 7fb198d0b0720dc9e909cabf4ec5f2cfd766af2ee7219176387e6e656be422912e6715496b1eca60091422ee8ea1dd89c289d97c654461cd3418a6bf38ec39a1
SSDEEP 12288:kw7ig9rH2FDbfH8jDLw7+POxkeg7hbZcRnOFmCfPbicP6otagxCN/PktD:j7bWRw/PPO6hAnOZfPbWyC9e
TLSH
T1EBD4238C62B6D495C78CD87F02624133EA6FBB754F0496FB77D48A3458538C68D3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 48e2ca309919607432e3aee82883c61688343dc4748ee256c8d137f8c56ed47d
MD5 b5ce830b4a42bb60ddda939aac3d3732
SHA1 8acc76cc4117021bc2f924a64aff0291e8d12439
SHA512 adf683871e9fbfdcc28cd5ca1e817fbfd9e6aa40428a3c9d46793e8151b4852938ca025ecea508b63b8a664627bd4c66dc91fc3cfc13ec3e6bf12b0b5ff3395b
SSDEEP 12288:ZggIuZyFDK3tT5Tr7aVLIH9lH3cauPG3Dspyi7gxz7sjM/paEMK9SBHewStuzQa5:ZggILoTfaidZCPG3DHwgRb/Zkf/EUz3
TLSH
T1BA559D1D67EA05DAE2B2D239D8721493E633B4711772C6CF2458C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 e3d3d49ac4bde8b62538ff825a01edc784b3015df61dffde737acd4c15a5a252
MD5 ea740491f51636967a6fdabf82eb0c6c
SHA1 8095aca90b5c14dd72e654a2f8c88d9fcbcd837a
SHA512 4a34bf900c6368c2bea8f3a160443f21020f06c5ce7662c016a3075200cccef9cd703272b9a55cc1555853c92e46366b8c01c5633ed8633ffd0f7a821894a44b
SSDEEP 49152:3DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3GPQBb/Zkf/tz3:M3Upow8sBa/ZkF
TLSH
T160A57C3DA2E810ACC9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDE19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-342-0x00007FF7F22B0000-0x00007FF7F23C9000-memory.dmp

Download

memory/696-255-0x00007FF7F22B0000-0x00007FF7F23C9000-memory.dmp

Download

memory/696-256-0x00000119C6B10000-0x00000119C6B76000-memory.dmp

Download

memory/696-257-0x00000119C6B10000-0x00000119C6B76000-memory.dmp

Download

memory/1672-41-0x000001AFE8740000-0x000001AFE87A6000-memory.dmp

Download

memory/1672-40-0x000001AFE84F0000-0x000001AFE861C000-memory.dmp

Download

memory/1672-42-0x000001AFE8740000-0x000001AFE87A6000-memory.dmp

Download

memory/1672-43-0x000001AFE8740000-0x000001AFE87A6000-memory.dmp

Download

memory/2040-15-0x00007FF7FC9C0000-0x00007FF7FCAE2000-memory.dmp

Download

memory/2040-16-0x000002816F940000-0x000002816F9A6000-memory.dmp

Download

memory/2040-18-0x000002816F940000-0x000002816F9A6000-memory.dmp

Download

memory/2040-67-0x00007FF7FC9C0000-0x00007FF7FCAE2000-memory.dmp

Download

memory/2040-17-0x000002816F940000-0x000002816F9A6000-memory.dmp

Download

memory/2412-352-0x00007FF7BA630000-0x00007FF7BA94F000-memory.dmp

Download

memory/2412-349-0x00000170680D0000-0x0000017068136000-memory.dmp

Download

memory/2412-344-0x00000170680D0000-0x0000017068136000-memory.dmp

Download

memory/2412-343-0x00000170680D0000-0x0000017068136000-memory.dmp

Download

memory/2412-348-0x00007FF7BA630000-0x00007FF7BA94F000-memory.dmp

Download

memory/2580-334-0x00007FF654F50000-0x00007FF6550E3000-memory.dmp

Download

memory/2580-335-0x000002A817F90000-0x000002A817FF6000-memory.dmp

Download

memory/2580-336-0x000002A817F90000-0x000002A817FF6000-memory.dmp

Download

memory/2620-357-0x000001BC13620000-0x000001BC13686000-memory.dmp

Download

memory/2620-355-0x00007FF6EC660000-0x00007FF6EC8E9000-memory.dmp

Download

memory/2620-356-0x000001BC13620000-0x000001BC13686000-memory.dmp

Download

memory/2832-282-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/2832-362-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2832-276-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2832-277-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/2940-63-0x000001D488220000-0x000001D488286000-memory.dmp

Download

memory/2940-61-0x000001D487F90000-0x000001D4880BC000-memory.dmp

Download

memory/2940-62-0x000001D488220000-0x000001D488286000-memory.dmp

Download

memory/3036-315-0x0000014CA4150000-0x0000014CA41B6000-memory.dmp

Download

memory/3036-316-0x0000014CA4150000-0x0000014CA41B6000-memory.dmp

Download

memory/3036-314-0x00007FF77C2D0000-0x00007FF77C383000-memory.dmp

Download

memory/3544-28-0x0000000000C50000-0x0000000000E2C000-memory.dmp

Download

memory/3544-6-0x0000000000BA0000-0x0000000000C09000-memory.dmp

Download

memory/3544-7-0x0000000000BA0000-0x0000000000C09000-memory.dmp

Download

memory/3544-1-0x0000000000BA0000-0x0000000000C09000-memory.dmp

Download

memory/3544-0-0x0000000000C50000-0x0000000000E2C000-memory.dmp

Download

memory/3816-49-0x00007FF6F8C90000-0x00007FF6F8DF7000-memory.dmp

Download

memory/3816-50-0x0000026E92540000-0x0000026E925A6000-memory.dmp

Download

memory/3816-51-0x0000026E92540000-0x0000026E925A6000-memory.dmp

Download

memory/3816-58-0x00007FF6F8C90000-0x00007FF6F8DF7000-memory.dmp

Download

memory/3816-56-0x0000026E92540000-0x0000026E925A6000-memory.dmp

Download

memory/3948-239-0x000001BD36A10000-0x000001BD36A76000-memory.dmp

Download

memory/3948-241-0x000001BD36A10000-0x000001BD36A76000-memory.dmp

Download

memory/3948-238-0x00007FF714E80000-0x00007FF714F48000-memory.dmp

Download

memory/3948-323-0x00007FF714E80000-0x00007FF714F48000-memory.dmp

Download

memory/4272-354-0x00007FF708E30000-0x00007FF708F79000-memory.dmp

Download

memory/4272-268-0x00007FF708E30000-0x00007FF708F79000-memory.dmp

Download

memory/4272-269-0x000001A245EF0000-0x000001A245F56000-memory.dmp

Download

memory/4272-270-0x000001A245EF0000-0x000001A245F56000-memory.dmp

Download

memory/4304-365-0x00007FF6C2920000-0x00007FF6C2DEF000-memory.dmp

Download

memory/4304-366-0x00000238F5970000-0x00000238F59D6000-memory.dmp

Download

memory/4304-364-0x00000238F5970000-0x00000238F59D6000-memory.dmp

Download

memory/4552-379-0x00007FF69F340000-0x00007FF69F845000-memory.dmp

Download

memory/4552-375-0x000001BA4D350000-0x000001BA4D3B6000-memory.dmp

Download

memory/4552-374-0x000001BA4D350000-0x000001BA4D3B6000-memory.dmp

Download

memory/4596-333-0x00007FF714E80000-0x00007FF714F48000-memory.dmp

Download

memory/4596-249-0x00000207D2010000-0x00000207D2076000-memory.dmp

Download

memory/4596-247-0x00007FF714E80000-0x00007FF714F48000-memory.dmp

Download

memory/4596-248-0x00000207D2010000-0x00000207D2076000-memory.dmp

Download

memory/4948-310-0x00007FF76A050000-0x00007FF76A466000-memory.dmp

Download

memory/4948-306-0x000002562B450000-0x000002562B4B6000-memory.dmp

Download

memory/4948-305-0x000002562B450000-0x000002562B4B6000-memory.dmp

Download

memory/5156-297-0x0000025C4CBD0000-0x0000025C4CC36000-memory.dmp

Download

memory/5156-296-0x00007FF69F2D0000-0x00007FF69F37D000-memory.dmp

Download

memory/5156-298-0x0000025C4CBD0000-0x0000025C4CC36000-memory.dmp

Download

memory/5156-373-0x00007FF69F2D0000-0x00007FF69F37D000-memory.dmp

Download

memory/5348-288-0x0000023258990000-0x00000232589F6000-memory.dmp

Download

memory/5348-290-0x00007FF6A4330000-0x00007FF6A4A73000-memory.dmp

Download

memory/5348-289-0x0000023258990000-0x00000232589F6000-memory.dmp

Download

memory/5348-371-0x00007FF6A4330000-0x00007FF6A4A73000-memory.dmp

Download

memory/5416-325-0x0000016B214B0000-0x0000016B21516000-memory.dmp

Download

memory/5416-327-0x00007FF7DFA40000-0x00007FF7DFCE2000-memory.dmp

Download

memory/5416-326-0x0000016B214B0000-0x0000016B21516000-memory.dmp

Download

memory/5916-31-0x0000022AD6200000-0x0000022AD632C000-memory.dmp

Download

memory/5916-33-0x0000022AD6410000-0x0000022AD6476000-memory.dmp

Download

memory/5916-34-0x0000022AD6410000-0x0000022AD6476000-memory.dmp

Download

memory/5916-32-0x0000022AD6410000-0x0000022AD6476000-memory.dmp

Download