450bf87823a302720924d9f5fdd7e4bb1403410f04e0b0d0c6307b1c475a8545

Analysis

max time kernel
142s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260804-p37htabb93
SHA256 450bf87823a302720924d9f5fdd7e4bb1403410f04e0b0d0c6307b1c475a8545
MD5 1d26a56086488a0701a66764c58edde9
SHA1 fd31d99e4801cd38068236bb1284e03482099a85
SHA512 b38a288eb869db72c9077a387d5c5298daff86bb0cb4c4a8b3caa8c5d35048437b42dd1a9d4ffad55e12e56764b62b88aba3afde7c895fd06691f93e68a2e677
SSDEEP 12288:mg49H6l7Q2NbKAd1/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:949H6NhKM/Hf0YNctoffVU0ss41eqC5
TLSH
T1A935BF02B7F9A134F1F32B31AE7592659A7ABC729D35C60E23C4160D4DB0A80E975B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5552	alg.exe
6116	elevation_service.exe
5000	elevation_service.exe
2748	maintenanceservice.exe
1508	OSE.EXE
3648	GameInputSvc.exe
3188	GameInputSvc.exe
1640	msdtc.exe
4280	PerceptionSimulationService.exe
5532	perfhost.exe
2392	ReFsDedupSvc.exe
1408	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb3fe7645387db0e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3188	GameInputSvc.exe
3188	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2576	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeDebugPrivilege	5552	alg.exe
Token: SeDebugPrivilege	5552	alg.exe
Token: SeTakeOwnershipPrivilege	6116	elevation_service.exe
Token: SeTcbPrivilege	3648	GameInputSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2576	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
2576	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
2576	2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3188	3648	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1d26a56086488a0701a66764c58edde9_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5000

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3188

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5532

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2816

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:2784

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4184

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5056

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3748

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3cd7851616c1c230dbdccc9148a28b20a29dfc23cf7cdd94fcba9b0516f87d01
MD5 74255dbe40d94491c70a8066c24513ab
SHA1 c519091d9b58aa945676d2e675e4de4f6f83138b
SHA512 2251699f380df41e65582b647e4a4b92b114fb0d5a0eac4c4d9d27df7fb1a54761cfb0287bffc262ad54527ee10030ac0f679d789fb8c7dc8b68c64511a71757
SSDEEP 49152:xvq632BuPkFKRrdE6oh7stBhuXjfS4LWxnQ/woffVUVlC5:T3q6gjBdIoffV7
TLSH
T12ED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 329680a031e04f3efe2c0d8a17aa756197c5a8bff4d1a88b2cde3c67fbcd7030
MD5 3b3263c4618990825205547dccc2aaa7
SHA1 097315c5e939b1f6ebf0c870cd481f48e886b337
SHA512 ed02b7acde754c1d4e2e96cc009bb741dc9b6bf18ad3b94da58af49915c9d76523bad0bd6b0e0290eddfb7075004125b17cbe198454a969370c77237d53bfb19
SSDEEP 24576:rXYBYdczA4/Hf0YNctoffVU0ss41eqC5:HdcT/woffVUVlC5
TLSH
T1A305022967A408FDEC67917CCCA1C115EB73B8254760EB9B03E4892A1F533D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 c98b9ab84dd5fc6f1e882b081ed69081ae5c7d72f8ab9a8bef3f4c8c83c53d14
MD5 9fbab86495f86b8e87108ba316a9a55e
SHA1 65a563c8eee45eb38654b3dd7b173b636695e6ae
SHA512 c3e5970054b62ce02bbf6f19bb4783f4e3d403bbe323b71eb8bac0c3b1fc55698a84ec270a5e3b14574aec9218333b4a8cb90bffb955b5ae7e303e90c16cf43c
SSDEEP 12288:Vmw5HEjsChNnBFgl0WDm+Cd/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGC5:Qwu+OWI/Hf0YNctoffVU0ss41eqC5
TLSH
T12205F14A76A41CFDE5A791388957C136F7F2B8163A21DB1F0360C61B6F63361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d705a3c009d4c3d5fbdf0a24520035a5ee074a541f02a1ee4f6026e1c9f80a08
MD5 013504cb7e43f435ef70b9f7eb5d0661
SHA1 0dbcc2aaf4294082cc9114c2400f95e585d2a174
SHA512 655cd46a406ad01da28e85ee93c8b856a30f46214bed2d8d6dd9b0474c53689e2bb033e8567bbbcda4c0c50171f139c495f809bb9d567f5e957e875ded365068
SSDEEP 49152:Bp+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl7/woffVUVlC5:Pu6JmTxd2d7IoffV7
TLSH
T189D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 97291dc8d207698ddf39877089ae590bfbbe29beb19bdc5211df917416477043
MD5 859e9f0ec695df67ee5951bd8304455d
SHA1 78a7899cb20a145538413a5763a3877199589ca5
SHA512 dcc710ab6ba6dc2152b2db7de750fb124fdfd46a32125281f50707d8fa995c71e270c7e19e41e63e286785e87ae782e307caeadb78bcb5c303546c5ba29a125a
SSDEEP 12288:c57N/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:sN/Hf0YNctoffVU0ss41eqC5
TLSH
T199D4231B8A3CF58FF0A571B07C69C13CD57DE83EBF0258A3A109421AA8C37D9CD59559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d8ca648dd7a77f321bfee243152d12b2c0f5ca22883eb3ae1c3dbfd75e26f60e
MD5 ddb8e5f17031362b65f82c6d952ea32a
SHA1 d81835407e7c7970a44a0923b903a1346bdea3d0
SHA512 d09825ab24e6a555e3686bf35db0de86d17ce44ed4f2126dd6b91947f9aafc6211bf4fcb72dd1d006a5c6e81d793d32baab4ecb6e5f0f3e5d861fe276860be57
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYWiGL8a8+t7hjQbT8kmyHCVizN:Sgb4mBIBhGFhLR7hjQ/VRp
TLSH
T16565AE1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 1c00a566d4e3b9cebfa444f3df733fecdbd65205e4f8e968052868d7ae3a44ff
MD5 25fd095e701c9c61ddaf1d4d5b23d6db
SHA1 025300cd5d1815c05cd743d856fb210dccc86006
SHA512 8017f01d339859550ef5d60e48ace99b2b12f193c6ec3a4dfd158d5d267a633cb6a95a4322daa9569f06743401e6fbd81e287c0b7beaa28b0c1a083f4d67ff36
SSDEEP 12288:72Gjk/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:CG4/Hf0YNctoffVU0ss41eqC5
TLSH
T135E4222E1439B0DDD07AE2B8BC74916AF9B0B4396B0519FF4185813A9EC3BE4E93DC54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 6e0cf1dc276452d1afcde3e52df068336f2354ecc2ba5321229782f67ea65d9e
MD5 a64cdcd1c035661531b9f1b3204d00ea
SHA1 5690049fcf3e93cac79976cea74f174406ed7082
SHA512 b08d340b44b20120c1d1c0261c50b4bb0495c2744c8acc414bfecd10c468e6c4f1df6c53175cf1f27a8f7a23c7df1f2b50f11bffa0371f8fc6e6a835dd4ceec5
SSDEEP 12288:tB/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:tB/Hf0YNctoffVU0ss41eqC5
TLSH
T18CD4231F4828F48FF09272F47C65C16DD9A8D83EBF4719E3A10A421AA8C77EAC97D454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9f24d57399bdad784f7d548aaa445cd48025adb1385622899d0784f9d3c60582
MD5 1938748446537dcbd8e26fe632b2aeb2
SHA1 24d7e346d9133a69683d6239bd661ddd23ed61c5
SHA512 886e144bd48f977a75334031da8871bf43a783460e5798874d5f07f7c86afc71d7515579eeafef53bfbb1a5694068279e72e0d24d0b1cf4fc1a2bcb1d91233dc
SSDEEP 24576:Kza8g8FNJqH1Mzria7/mZiGL8a8+t7hjQbT8kmyHCVizN:ApfFjqVra7/ULR7hjQ/VRp
TLSH
T1D535F16566E101F5E47BD1388A424663F6B2B8250334EBDF0B988B551F23BE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 17a510e7f699d3ac15f791d2837a22386d18836cd2061e9c8c241b4e92bcc749
MD5 ee81c759408ef36b617d74405b158503
SHA1 416e11d4964c047eaa350fd8dd03ea67cc08e00b
SHA512 39ba7af5f1dc3a99b7b52b59cb85161af0e5b9f012249457bb6b90b14bc7351d72753af8416d9c3b03e16f91b0ae40f190d8d7014090b9e418159cd601e058e5
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjh/woffVUVlC5:mG05lO43bWIoffV7
TLSH
T177D5CF6E62EC11F9D0BBD17CD9C6860BEBB23425033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e91d879985975beba6325334003dff54237a528c93615150579586356893cbd2
MD5 d42988bb1c3d5f5c9d73ac6ec33d3b92
SHA1 74323767d333aa7380a54796701eec7d4791e48f
SHA512 c5c4ef1e143298ed495da4cb78e662e285bae6485d64e95cf0ef62cb81fc0c2bb42c9934ffcb3baa7da4508a6ef2eae32411fbb9f7ecd88551112f194456e5f2
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fko/Hf0YNctoffVU0ss41eqC5:oNc/zEOVHFx/woffVUVlC5
TLSH
T123858C1622E901E4F1BBE1BE89779546FAB1786957308ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 7324a875b95c69394243618c1a14a77d55fd022a80b246bdf713aaca3b6f5e34
MD5 b5fe9a1208b4d78ad0c3670117667862
SHA1 0052e7907aa3cb71b0475205565dc9f671c382a8
SHA512 81e7ee6e6625492f0e2317ad5722154653ce0290c2810c212e03aa0bbf8eb70a05b9d81932cd8682d76ff8ab89625155cda636669018c7b67e8386cf2d6e0dbb
SSDEEP 24576:XJnJPbzB4SMiGL8a8+t7hjQbT8kmyHCVizN:XJnJv6SOLR7hjQ/VRp
TLSH
T10F15D02DD2A810E9E4B7C2B4411A175AFF71387D2B2169D729B4D5343F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c6f8bdf220155c55ae0195c8c9ec996fede6f3c15dd72a07c4ac66ec8e0eca82
MD5 2e351b38ceca58c5435c3c59489f3974
SHA1 e465b33ebe836e90021f089187bb86a1b1d705f2
SHA512 3d63cfe73d0ed5c6dc09228635f090b2ee7f9469dc5dbee15390b53a1a2db440b932f33b256150c5178d6fcbc54ea832022e46c8819c535a2af50e35e6f67183
SSDEEP 24576:+CLHGL0MoeVtFumTijCmlKQWDkviGL8a8+t7hjQbT8kmyHCVizN:+CLHGeeV5ijCmlDWDkvLR7hjQ/VRp
TLSH
T1A7A56B05A7EB5184F8F3CAF4CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 bdc4af0666d8eabf1ece2b8a61db0eabc92bc39bf760bde8268ccc0271cba59c
MD5 f399271be03f8e978e5175b6625b6f05
SHA1 d8df0b0a5e65abeb00e3a53f34a4f4120af3e749
SHA512 2af0874f1e72fdd80f1d65c2e2bac55e6efbe5fe8ed6be309c3a352afb98f96017e2f844c6cec2a02f4bd3d8faa7de8e299826a7765dcc8c092a7b8b4697292a
SSDEEP 12288:5pHck6j5ZI7W/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:F6DIa/Hf0YNctoffVU0ss41eqC5
TLSH
T102F4011D233A20FAE0ABE03D95824116D2B2B47597121ADF0698C57E9ED3EDCF93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 11248caf168ff43036074884f9750ce29b11cc1964b0bef0f734a65c141d08be
MD5 3515c7eea56b3b241361eab2f6cbe22e
SHA1 d46a7e2a4805c4e128b72661c98ecaaa60f07da5
SHA512 9c1a5a9fc6180f67c68bdd600f995dfffa5819d7589039052dbeb5b3260a9ca6df2617a364e5545fae47a41c772e710b82d71ba8467ae2c12e3e22033170af0a
SSDEEP 12288:JG6kyv5/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:gtyB/Hf0YNctoffVU0ss41eqC5
TLSH
T13DF412094328B0C9F5B66274AC7281A8CA74FC35AF1256EF5180923E6EF37D8EC35B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 2de0adfa2217b3c1b6cd59cff459248283d70e210a4ee11d5cc89e39c4ed5480
MD5 6ec4313f39597dcb95c95c3d1984f7a1
SHA1 c88e61041efd1c6e01f53717abaf7c2a96290945
SHA512 8434792bfd5463dde0a41bc92d14b0535c31492a9942933ef2cded9e566dfe22967723185ad0bcb7f889b8ec90e91b011b22ee15a91539a4242b700d91fa439a
SSDEEP 12288:/Qb/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:Ib/Hf0YNctoffVU0ss41eqC5
TLSH
T1F1D4231E4538F18EE091B2B47868826DC1B8E43E7F0719FB6089863ADDC77D9C97AC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 ded34c3782f3ad32adb382ec1104d4cda22d4de36086e11bdda77efdf12994e7
MD5 b1dcd21e1a300d00892c234963371607
SHA1 ffcd35f924dbbfccd861f80c64d85755dec1702a
SHA512 ec915e9c9434676d591f0058e4e30792d1e2058fc187b60b728865b4ec09c3cfc8eb7990922235f1d9dfb76fa88ae67f1c08cb034fe1594afa1f5d5e914548b1
SSDEEP 24576:XDgGLoTfaidZ+iGL8a8+t7hjQbT8kmyHCVizN:Tg1TrZELR7hjQ/VRp
TLSH
T13D559D1DA3EA05DAE2B2D675D9231493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 ec372525eec39c4e2e99be30559df26a2ea8011ebcf516319dfee4bfb0db052f
MD5 6cdaa66aa2f4f1d447d3135a27742bfa
SHA1 b9d29c810a9351d964a8664aaf1871ffdc2737a3
SHA512 fea1654b02cb3d07a391d4b0a526240c8e26254d566c7359904c32ece710adcd97dddf6cb04a798b9cf12604c35f504be934045535ea9ed175441f2a443ad921
SSDEEP 49152:2DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3bLR7hjQ/VRp:X3Upow8sBwdhjURp
TLSH
T15BA58C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 f46b1924a662caf041da67e30a493bbb2f34f3243a1855a892524d12b99076ac
MD5 b3a0447c26ce2a44579fd1fa13a9007c
SHA1 4f39ef27905afc49fada4f632d466b649c51f091
SHA512 882708946630aafe37d980185548d0277100993f2945303ca77a29f83f807f32a7fbd5c26cb142a36dab1b98286c660940855de6eee5f3bf63eded4d5098a951
SSDEEP 12288:MHvUrBFrEjwaQPb/HaIF0YKjYcaEXobgaRlhrRi0svfbDPsl41e6iGCb1:MPUr+NQz/Hf0YNctoffVU0ss41eqC5
TLSH
T17E05F12F26AC18E9F676F17C9982831DE771B466171296DF0290813E5E53EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-370-0x00007FF6719A0000-0x00007FF671A4D000-memory.dmp

Download

memory/1408-295-0x0000023C41B60000-0x0000023C41BC6000-memory.dmp

Download

memory/1408-294-0x0000023C41B60000-0x0000023C41BC6000-memory.dmp

Download

memory/1408-293-0x00007FF6719A0000-0x00007FF671A4D000-memory.dmp

Download

memory/1508-58-0x0000025FD6D70000-0x0000025FD6E9C000-memory.dmp

Download

memory/1508-59-0x0000025FD6F70000-0x0000025FD6FD6000-memory.dmp

Download

memory/1508-61-0x0000025FD6F70000-0x0000025FD6FD6000-memory.dmp

Download

memory/1640-247-0x00007FF793170000-0x00007FF793289000-memory.dmp

Download

memory/1640-331-0x00007FF793170000-0x00007FF793289000-memory.dmp

Download

memory/1640-248-0x0000026FDFCC0000-0x0000026FDFD26000-memory.dmp

Download

memory/1640-249-0x0000026FDFCC0000-0x0000026FDFD26000-memory.dmp

Download

memory/2392-287-0x00007FF647A50000-0x00007FF648193000-memory.dmp

Download

memory/2392-367-0x00007FF647A50000-0x00007FF648193000-memory.dmp

Download

memory/2392-286-0x000001F1211D0000-0x000001F121236000-memory.dmp

Download

memory/2392-285-0x000001F1211D0000-0x000001F121236000-memory.dmp

Download

memory/2576-26-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/2576-6-0x0000000002500000-0x0000000002569000-memory.dmp

Download

memory/2576-1-0x0000000002500000-0x0000000002569000-memory.dmp

Download

memory/2576-7-0x0000000002500000-0x0000000002569000-memory.dmp

Download

memory/2576-0-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/2748-55-0x00007FF7AFDD0000-0x00007FF7AFF37000-memory.dmp

Download

memory/2748-46-0x00007FF7AFDD0000-0x00007FF7AFF37000-memory.dmp

Download

memory/2748-48-0x000001F0B80E0000-0x000001F0B8146000-memory.dmp

Download

memory/2748-47-0x000001F0B80E0000-0x000001F0B8146000-memory.dmp

Download

memory/2748-53-0x000001F0B80E0000-0x000001F0B8146000-memory.dmp

Download

memory/2784-313-0x000001EA2EE40000-0x000001EA2EEA6000-memory.dmp

Download

memory/2784-312-0x00007FF72CA60000-0x00007FF72CB13000-memory.dmp

Download

memory/2784-314-0x000001EA2EE40000-0x000001EA2EEA6000-memory.dmp

Download

memory/2816-304-0x0000020DAB6D0000-0x0000020DAB736000-memory.dmp

Download

memory/2816-302-0x0000020DAB6D0000-0x0000020DAB736000-memory.dmp

Download

memory/2816-303-0x00007FF77C520000-0x00007FF77C936000-memory.dmp

Download

memory/3188-244-0x00007FF709750000-0x00007FF709818000-memory.dmp

Download

memory/3188-322-0x00007FF709750000-0x00007FF709818000-memory.dmp

Download

memory/3188-253-0x000002975D900000-0x000002975D966000-memory.dmp

Download

memory/3188-254-0x000002975D900000-0x000002975D966000-memory.dmp

Download

memory/3648-311-0x00007FF709750000-0x00007FF709818000-memory.dmp

Download

memory/3648-237-0x00000157B9EA0000-0x00000157B9F06000-memory.dmp

Download

memory/3648-236-0x00000157B9EA0000-0x00000157B9F06000-memory.dmp

Download

memory/3648-235-0x00007FF709750000-0x00007FF709818000-memory.dmp

Download

memory/3748-349-0x00007FF780E60000-0x00007FF78117F000-memory.dmp

Download

memory/3748-347-0x000001C97D810000-0x000001C97D876000-memory.dmp

Download

memory/3748-343-0x000001C97D810000-0x000001C97D876000-memory.dmp

Download

memory/3748-342-0x000001C97D810000-0x000001C97D876000-memory.dmp

Download

memory/3748-341-0x00007FF780E60000-0x00007FF78117F000-memory.dmp

Download

memory/3984-361-0x00007FF73C650000-0x00007FF73CB1F000-memory.dmp

Download

memory/3984-362-0x000001FC29A10000-0x000001FC29A76000-memory.dmp

Download

memory/3984-364-0x000001FC29A10000-0x000001FC29A76000-memory.dmp

Download

memory/4152-353-0x000001AEF2410000-0x000001AEF2476000-memory.dmp

Download

memory/4152-354-0x00007FF78BE50000-0x00007FF78C0D9000-memory.dmp

Download

memory/4152-355-0x000001AEF2410000-0x000001AEF2476000-memory.dmp

Download

memory/4184-323-0x00007FF7A56E0000-0x00007FF7A5982000-memory.dmp

Download

memory/4184-324-0x0000024829F40000-0x0000024829FA6000-memory.dmp

Download

memory/4184-325-0x0000024829F40000-0x0000024829FA6000-memory.dmp

Download

memory/4280-266-0x000001D2D4480000-0x000001D2D44E6000-memory.dmp

Download

memory/4280-264-0x00007FF6C6AF0000-0x00007FF6C6C39000-memory.dmp

Download

memory/4280-267-0x000001D2D4480000-0x000001D2D44E6000-memory.dmp

Download

memory/4280-340-0x00007FF6C6AF0000-0x00007FF6C6C39000-memory.dmp

Download

memory/4876-376-0x00007FF77E870000-0x00007FF77ED75000-memory.dmp

Download

memory/4876-372-0x0000025873F60000-0x0000025873FC6000-memory.dmp

Download

memory/4876-371-0x0000025873F60000-0x0000025873FC6000-memory.dmp

Download

memory/5000-40-0x000002AA9C000000-0x000002AA9C066000-memory.dmp

Download

memory/5000-38-0x000002AA9ADB0000-0x000002AA9AEDC000-memory.dmp

Download

memory/5000-39-0x000002AA9C000000-0x000002AA9C066000-memory.dmp

Download

memory/5056-333-0x000002CC36F30000-0x000002CC36F96000-memory.dmp

Download

memory/5056-332-0x00007FF714D10000-0x00007FF714EA3000-memory.dmp

Download

memory/5056-334-0x000002CC36F30000-0x000002CC36F96000-memory.dmp

Download

memory/5532-352-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5532-279-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/5532-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5532-274-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/5552-64-0x00007FF6880C0000-0x00007FF6881E2000-memory.dmp

Download

memory/5552-16-0x000001BB34A80000-0x000001BB34AE6000-memory.dmp

Download

memory/5552-17-0x000001BB34A80000-0x000001BB34AE6000-memory.dmp

Download

memory/5552-18-0x000001BB34A80000-0x000001BB34AE6000-memory.dmp

Download

memory/5552-15-0x00007FF6880C0000-0x00007FF6881E2000-memory.dmp

Download

memory/6116-31-0x000002C814C40000-0x000002C814CA6000-memory.dmp

Download

memory/6116-29-0x000002C814A00000-0x000002C814B2C000-memory.dmp

Download

memory/6116-30-0x000002C814C40000-0x000002C814CA6000-memory.dmp

Download

memory/6116-32-0x000002C814C40000-0x000002C814CA6000-memory.dmp

Download