6d766e813ee8962f547bce6d8913bea10698481a867bad694ad885d5a7a1147c

Analysis

max time kernel
147s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 770KB
Sample260805-dkqlssxalg
SHA256 6d766e813ee8962f547bce6d8913bea10698481a867bad694ad885d5a7a1147c
MD5 6414996a0d985c834e5f87a5048e934e
SHA1 eb0463cf50a2e8c7ab288a6f5b078c15b7f4d507
SHA512 de4244add72bff109cfabd78fd1ceabe67120c09cccea7fdf480b0318ad0b3eba4c841b62f92edd364bb69261c28b05e45d412bc743fb63e52d1836dd4adb517
SSDEEP 24576:Sd68dsCesTeWvz19AWLt6++6fzdjYUZxsE:SDmChT9r5ACjYU3n
TLSH
T1B2F41270B2C09032D52711714AE9CEB1877ABD7E6560584F3BF9397D0E727E08229B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5156	alg.exe
4268	elevation_service.exe
4452	elevation_service.exe
2760	maintenanceservice.exe
256	OSE.EXE
4552	GameInputSvc.exe
3496	GameInputSvc.exe
5340	msdtc.exe
3200	PerceptionSimulationService.exe
4592	perfhost.exe
2496	ReFsDedupSvc.exe
3428	locator.exe
3180	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cc6e5c62e62f061e.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\ResetSubmit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3496	GameInputSvc.exe
3496	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3316	2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	5156	alg.exe
Token: SeDebugPrivilege	5156	alg.exe
Token: SeTakeOwnershipPrivilege	4268	elevation_service.exe
Token: SeTcbPrivilege	4552	GameInputSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2496	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3496	4552	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_6414996a0d985c834e5f87a5048e934e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:256

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3496

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3180

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:924

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4168

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc7925ff8c05575db393647351640bfe74335203d2217b2aa43639b7b1b2afe8
MD5 748feab96b7606d4f419f0b78c1430b8
SHA1 a9b10dfbd54ac2a97e206456ce14f8f7b946ef2e
SHA512 a651777d4c6e0f5701c8f28eeac511ac49680e829461ea59f971a9e7901c89cec3299382564809df6557cacc9a69b09485e0833fe552a95ef7ee93a23738f443
SSDEEP 49152:l6p632BuPkFKRrdE6oh7stBhuXjfS4LWxntr5ACjYU3n:X3q6gjBA2m3n
TLSH
T15AD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d9022bb401326a4509abe2e858b3796d33f1d732e4c9c0d33303d800acd901d0
MD5 2269e1c10d4f9a7fc66097009be2df3a
SHA1 bef92e7ae62cb4fa980d4dc08ae5d5382bf2197e
SHA512 37de142723b32677b448b98506d3b59ef34781b694368319d7d211e78aa9baf6c42602bd880bc96ed342bc36b9475f718df7191834dcb52931b2497969c50d3a
SSDEEP 24576:/XYveKczA8vz19AWLt6++6fzdjYUZxsE:fKcBr5ACjYU3n
TLSH
T10A05F12877E508F9ED67427CCDA28512E733B8954360EB9B03F489290F237985E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 0463334208d02375446f492d2cf116dcbfc5889226878a773e4a4e781361c47a
MD5 995d5435460af7c91214a04588c765d3
SHA1 df1e6bedf5a2dfc7b07f37ef69f545e282e65896
SHA512 6b4ffc0f4705862659d93aa193bc56264397e669a4484a5716b6a759b43a44bd62f3ccaae558dba7942d51c385356b746cd70eff7b20c8be7f8f1fe1b090c0dd
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CGodAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGw:uwuuOW5vz19AWLt6++6fzdjYUZxsE
TLSH
T1A605F15577E50CF9E9674238869BC532F7B2B8112620DB1F17B0C61B5F27361AE3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0d4a25064b0f9f94bcfcda3bbb84a186500a535b55edf3967f8847ad22183542
MD5 61a27437bbde5a324901610b8a00c0f2
SHA1 393f5e8ebf5040289b1dde2ba8833942e277b9e1
SHA512 b8010b99b52dc72f1402be6b2818edd7745ee84fc64d2ee24ee9dfba30cbc0060c53caa3dcd6bd5eae26954e8e121d751b1563bee601bfdf9798cccb68c1e3af
SSDEEP 49152:Mg+taZ3usBWOBr4tEGp0bqx0z+n217aau1glbr5ACjYU3n:Xu6JmTxd2dP2m3n
TLSH
T17FD59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 dc34c169f163e95e021bce6e2d1fbfbffe3ed19f0e467ae320e1b22d62fd97ea
MD5 42846bffb42bc02e08fac6410590f0ac
SHA1 b1dea147a908f719a78ef2e6aa10f70d39f43e34
SHA512 0338706c1ab257d1850514a19384afec34aa4a8bcafd1c2b333f3a244bf5f63b18a472b7ebb313cecb8ac9c992ca2d489685508320fafe1d81670615df00a986
SSDEEP 12288:s27godAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFiodB3N:Tgvz19AWLt6++6fzdjYUZxsE
TLSH
T1D0D423759BFD1D2EE96113B40ADF8822E30AF7A997006DD7B6F6020C4054EB59E32D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 afc8cb70e01a0e6edcca1a623f5eb680b1a28d6db958d7a0bb07c5339de41eb7
MD5 093c24abf0b51ef536032cfcfb28f4e2
SHA1 448872fc44e5e3f0fe3abea6712864ac5a467331
SHA512 54cee6cb4977a775cea851c5fec863b4489e9bb59d4177db9cd9debe3e3a77aa6f4380dfe9c6ef40bb06591946138ff517766f00ef5fdb33d08fe9ae8b84f6a9
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYOvz19AWLt6++6fzdjYUZxsE:/gb4mBIBhGFBr5ACjYU3n
TLSH
T1B265AE1E22EC02F5E0F6D2B8DDAA4417D6B278160731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 e473df4c8bbea3db3415fdf308a71e8951a6f114928ebc8483c2bd655d30276e
MD5 087b29f801c947c9fcb035d3caa88186
SHA1 4f6aa0959991e391485aa3de476ccf7b92dc5cea
SHA512 dd44da3e15d4a56bf28547d161e5a075daa4418fa7f74d101a3c6378144c3c694cfa2ebda79f4225958464817ca35d07bcaf65711bfce40571e1b6f5d88770da
SSDEEP 12288:RuGCodAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFiodB3N:4GCvz19AWLt6++6fzdjYUZxsE
TLSH
T1F8E4227C26FA242DC93643B949EE4863F761B2A1A3042DFF56F1413D8A54EF0A736C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 a178b446e4a7740c73b2821ae372899be75e9cf40dfc5efd88e729991ed1af31
MD5 3d811b554db7035610035e92fb22db4f
SHA1 8b35569b1c1b6b2e1526127bc921c04ae9dee3a8
SHA512 0d49c3865b26c033ac54c61927e8017d0b8591b5038f37b742088956c524a5f27747a3ae5450633ac71eb241c6b498a6cecbcee37321757086c32391858053ae
SSDEEP 12288:1rodAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFiodB3N:1rvz19AWLt6++6fzdjYUZxsE
TLSH
T106D423B46BFA192EDA5213B91ADF4C52E305F7AAA3042DD7B6F6010D4048EF59732D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5fbf8b56ea10f3558a7d88dab6070d65691ba1d161ca5d3530f09b7630ddecb3
MD5 7699c6122845d11e4626f709a843a818
SHA1 c4c11b21f21201d0dacb3323828a80f0a16be192
SHA512 4d66479d3214ae75158d410c0649b6675c3e2c2e00e7e7e31ff86fb3c045fde737bf11c6f7bb80ac72572e5f43d19c853fb859dc6bbee3c45410fd138a5217fe
SSDEEP 24576:mr/8T8VpJqH1szria7/m/vz19AWLt6++6fzdjYUZxsE:I0gVPqVLa7/ir5ACjYU3n
TLSH
T17C35F16577E101F5D47BD1388A864A63F6B2B4250324EFDF07A88A551F23AE54B3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 a735e477238bf66ba157c6f4067ab8efc34dd8001a434e6fcaff3fcbf5606612
MD5 56d3a21218d3cc4d3062d5e8584e8797
SHA1 158d368a717897da084368c2d2ca3ca9d1ec394d
SHA512 0df7f792eb1fb66ebee457a75458753d551a32107714a517a330cc3b09cbf1186d97844f5ffad184ac7f7571d9cb510322b5c804771b99f5e34c42330a04446f
SSDEEP 12288:vHvUrBFrEjwaQEodAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFi6:vPUr+NQEvz19AWLt6++6fzdjYUZxsE
TLSH
T12105F22F26ED1CE9E676A17C89C64609F371B4621311D6CF02E1413E4E57EE8BD3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 482f868a0ebcd11cd8a4d07dbcfe06d9e23df354f1eb24c672c124f844f34a80
MD5 c05169be101b8c293d48d13d3fe90b13
SHA1 0398eed9e29b83b35132a11f299603d1bca4ec5e
SHA512 ebe22829c94a1a5321940ba9848dde5125cfc80fbea4210f1eda77cc69fbb63e8a1511c9b2b7834626aa226d4c81b3525ee4f4c5a19c0ef6f9db9270c13c844f
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFr5ACjYU3n:7G05lO43bi2m3n
TLSH
T167D5CF6E62EC11F9D1BBD17CDAC64A0BEBB23415032456CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c25bc8e0196a3d210fae401fb59b6078972614905744a66145953637ecffaa5a
MD5 3e454765750cc381a09fff6da51e8477
SHA1 f32acc9e0159599184282731265eccb948783457
SHA512 395cfadbb428b0d4f34d3fc228bc081288ec7c97bef3049c8d134d9d0dad5508b83317cff32ca2d67e4a933f30a383c8d2aae8e97582a43859750f1c69aa952b
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fkn1vz19AWLt6++6fzdjYUZxsE:gNc/zEOVHF+hr5ACjYU3n
TLSH
T1E2857B2623E901E4E5BBE1BE897B9546FA71786553308ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 527cf17931b053db18865339f34ef76c271221f74a6a5f6a094dbd1408410714
MD5 b8cd7c43ac12cc79220bb86dd3ad4e4f
SHA1 3c90814e2deee669dd94a8a3e63f58b435653d37
SHA512 0c95df0f0ae54227d9e514c76f0c7d39929f1ffbd9de8b6acad66edda7928b11f839a24c60fcc87b207833fae2b91f37684a4312291f5508f38fd663614e3fb9
SSDEEP 24576:rJnJPbzB4Stvz19AWLt6++6fzdjYUZxsE:rJnJv6S5r5ACjYU3n
TLSH
T18715D03DD2A810E9E4B7C2B4815A1A56FF31347D2B2169C769B4D5343F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 384KB
SHA256 6880eed5bebfde13acf95990cadfa64d1a27ff293d87cc908aff2d5e9caeeade
MD5 e1fb61f7b271d37c046dfcdf542473ac
SHA1 3b023554b1cab92c59246822eb423486288eb0c8
SHA512 dd4c7e6dd68ba03039f2f9976a98c524987fc961482289de272b9c57c8eeccf30ee4f791e4525d45808ef0d78203442616535bc3b262d7510ba04615d61d287e
SSDEEP 6144:B+kjAFxyw8YkmjvwHGy0NNYMav+jUWaw91U6oGktqzvzZ1XgVKDqj2jmzhEvg+tE:BIC0wHGLYRvlWaEU6ohtqzvfm104wKN
TLSH
T13784091DE3A691D5C9B5C1B4C60A9227EB317828533877DF9FC1CE7A5F21AE1A13CA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 cd9b0ac488c99c2be57769d2af2d22164f4994ec9816681a88465aa1a81d8592
MD5 5618f68ba8a165610859f27c32606dff
SHA1 e7fb9e27e6ee39d716888cae2731cfc3047771b9
SHA512 87b9d36dd2ae3436e000161877ea9a0a682ff180a67cc89eb2349df57dcc439cbdd2a7777111e98d42f117fedb4e899073eb860a4355a0e2b6a0765df252ae06
SSDEEP 12288:g1HzkLj5ZI7LLodAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFiod:1LDI7vz19AWLt6++6fzdjYUZxsE
TLSH
T15E05026C33BA10B9D167917D86C70502E3B2B1B1C3112ADF57E4857D4EA3EE8BA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 3ea5d09da73ea8016b05ba6bc35697197246c54789cdd032ec7539f252b025d1
MD5 d8f3e66274e84f3c864ce6dfa81ae743
SHA1 949bb9d597020ac911a01c2f3b7e9b05973c580a
SHA512 1fd6b335efb93596afea9224e2f6c78e19eff9c3637c9d854223872b9b72657aa31f60667e145b77c0c54ec64ccec7e98f1b3b73f1394c8766a09653e53c7a39
SSDEEP 12288:ZG6ky+odAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFiodB3N:Qty+vz19AWLt6++6fzdjYUZxsE
TLSH
T1D6F4221463E82469EAB503788EE74191DB35FC2097106BDF66F1823E1E35FE0AA31F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 f1bfa8ed8aab3a9ab842c3de8d9f36f2b6b38cdf32a2161cf606d9d7c7d60cf9
MD5 61419518d3bab8625695c25c4777b579
SHA1 f8b113975b4eb7871d1c99efd1200e6df76b7c99
SHA512 f78b65b27d9e4433acadfac27b42f198adaa12797ad96f07fdbba2539e941f84d0108c36a4f00b7cbaa9e38aa3ab0a765ab7a0c25322610d5d2dcab223d7f3aa
SSDEEP 12288:IhpodAzlRry+va14E6AWyMt6gHUR8atJxwfzdsm/AUGOP80ZxbFiodB3N:2pvz19AWLt6++6fzdjYUZxsE
TLSH
T117D423BC67FA292ED95113B90ADF0952E315B2F9A3042DEBB6F2013D4548EF19732D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 d0539038a4261257cd9f60fb6aa82806169420249cb231cb53e77cf0fa456fd8
MD5 daf1fb8db1816890e61bdfdf4323ac45
SHA1 2091cbedf1e7cfd00190e994d871e6b5bede8d9b
SHA512 fdaf0c22e8f0ad979fb52e9a49029bfec5c41746ef5d44b5987fc766dcc976b9d5e821f8578859ce0552bc1961836c16b582abe1db2b3f543abf0eb5bc6c5e3e
SSDEEP 24576:H4gkZoTfaidZyyvz19AWLt6++6fzdjYUZxsE:YgtTrZjr5ACjYU3n
TLSH
T151559D1D67EA05CAE2B2D279D9631493D633B4315372D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-62-0x0000025DEDB80000-0x0000025DEDBE6000-memory.dmp

Download

memory/256-60-0x0000025DED9A0000-0x0000025DEDAAE000-memory.dmp

Download

memory/256-61-0x0000025DEDB80000-0x0000025DEDBE6000-memory.dmp

Download

memory/788-362-0x00007FF606500000-0x00007FF6069D1000-memory.dmp

Download

memory/788-363-0x000001BCD3150000-0x000001BCD31B6000-memory.dmp

Download

memory/788-364-0x000001BCD3150000-0x000001BCD31B6000-memory.dmp

Download

memory/924-325-0x000001C61D240000-0x000001C61D2A6000-memory.dmp

Download

memory/924-324-0x000001C61D240000-0x000001C61D2A6000-memory.dmp

Download

memory/924-323-0x00007FF778A60000-0x00007FF778D03000-memory.dmp

Download

memory/1900-354-0x0000028C27F90000-0x0000028C27FF6000-memory.dmp

Download

memory/1900-355-0x0000028C27F90000-0x0000028C27FF6000-memory.dmp

Download

memory/1900-353-0x00007FF696E00000-0x00007FF69708B000-memory.dmp

Download

memory/2496-286-0x00007FF64F0E0000-0x00007FF64F824000-memory.dmp

Download

memory/2496-288-0x000001E007C90000-0x000001E007CF6000-memory.dmp

Download

memory/2496-287-0x000001E007C90000-0x000001E007CF6000-memory.dmp

Download

memory/2760-48-0x00007FF7E2930000-0x00007FF7E2A98000-memory.dmp

Download

memory/2760-50-0x00000279F52B0000-0x00000279F5316000-memory.dmp

Download

memory/2760-55-0x00000279F52B0000-0x00000279F5316000-memory.dmp

Download

memory/2760-49-0x00000279F52B0000-0x00000279F5316000-memory.dmp

Download

memory/2760-57-0x00007FF7E2930000-0x00007FF7E2A98000-memory.dmp

Download

memory/3180-305-0x000002B846AF0000-0x000002B846B56000-memory.dmp

Download

memory/3180-304-0x000002B846AF0000-0x000002B846B56000-memory.dmp

Download

memory/3180-303-0x00007FF6D87D0000-0x00007FF6D8BE7000-memory.dmp

Download

memory/3200-265-0x00007FF7AEE70000-0x00007FF7AEFBA000-memory.dmp

Download

memory/3200-267-0x0000017374110000-0x0000017374176000-memory.dmp

Download

memory/3200-351-0x00007FF7AEE70000-0x00007FF7AEFBA000-memory.dmp

Download

memory/3200-268-0x0000017374110000-0x0000017374176000-memory.dmp

Download

memory/3316-7-0x0000000002AC0000-0x0000000002B29000-memory.dmp

Download

memory/3316-26-0x0000000000F90000-0x00000000010BC000-memory.dmp

Download

memory/3316-1-0x0000000002AC0000-0x0000000002B29000-memory.dmp

Download

memory/3316-6-0x0000000002AC0000-0x0000000002B29000-memory.dmp

Download

memory/3316-0-0x0000000000F90000-0x00000000010BC000-memory.dmp

Download

memory/3428-294-0x00007FF76D4C0000-0x00007FF76D56E000-memory.dmp

Download

memory/3428-296-0x00000244D5330000-0x00000244D5396000-memory.dmp

Download

memory/3428-295-0x00000244D5330000-0x00000244D5396000-memory.dmp

Download

memory/3496-331-0x00007FF74CF10000-0x00007FF74CFD9000-memory.dmp

Download

memory/3496-245-0x00007FF74CF10000-0x00007FF74CFD9000-memory.dmp

Download

memory/3496-247-0x00000291FABE0000-0x00000291FAC46000-memory.dmp

Download

memory/3496-246-0x00000291FABE0000-0x00000291FAC46000-memory.dmp

Download

memory/4100-313-0x00007FF6323C0000-0x00007FF632474000-memory.dmp

Download

memory/4100-314-0x000001FFCD660000-0x000001FFCD6C6000-memory.dmp

Download

memory/4100-315-0x000001FFCD660000-0x000001FFCD6C6000-memory.dmp

Download

memory/4168-352-0x00007FF7455E0000-0x00007FF745901000-memory.dmp

Download

memory/4168-348-0x00000233C08E0000-0x00000233C0946000-memory.dmp

Download

memory/4168-341-0x00007FF7455E0000-0x00007FF745901000-memory.dmp

Download

memory/4168-342-0x00000233C08E0000-0x00000233C0946000-memory.dmp

Download

memory/4168-343-0x00000233C08E0000-0x00000233C0946000-memory.dmp

Download

memory/4268-31-0x0000019966140000-0x00000199661A6000-memory.dmp

Download

memory/4268-29-0x0000019965FE0000-0x00000199660EE000-memory.dmp

Download

memory/4268-32-0x0000019966140000-0x00000199661A6000-memory.dmp

Download

memory/4268-30-0x0000019966140000-0x00000199661A6000-memory.dmp

Download

memory/4452-38-0x00000299A93F0000-0x00000299A94FE000-memory.dmp

Download

memory/4452-41-0x00000299A9620000-0x00000299A9686000-memory.dmp

Download

memory/4452-39-0x00000299A9620000-0x00000299A9686000-memory.dmp

Download

memory/4452-40-0x00000299A9620000-0x00000299A9686000-memory.dmp

Download

memory/4552-238-0x000001A8A0240000-0x000001A8A02A6000-memory.dmp

Download

memory/4552-237-0x000001A8A0240000-0x000001A8A02A6000-memory.dmp

Download

memory/4552-236-0x00007FF74CF10000-0x00007FF74CFD9000-memory.dmp

Download

memory/4552-322-0x00007FF74CF10000-0x00007FF74CFD9000-memory.dmp

Download

memory/4592-280-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/4592-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4592-275-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/4592-359-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5100-334-0x000001EC6EB00000-0x000001EC6EB66000-memory.dmp

Download

memory/5100-332-0x00007FF65D800000-0x00007FF65D995000-memory.dmp

Download

memory/5100-333-0x000001EC6EB00000-0x000001EC6EB66000-memory.dmp

Download

memory/5156-17-0x00000150D8510000-0x00000150D8576000-memory.dmp

Download

memory/5156-18-0x00000150D8510000-0x00000150D8576000-memory.dmp

Download

memory/5156-15-0x00007FF6B6070000-0x00007FF6B6193000-memory.dmp

Download

memory/5156-47-0x00007FF6B6070000-0x00007FF6B6193000-memory.dmp

Download

memory/5156-16-0x00000150D8510000-0x00000150D8576000-memory.dmp

Download

memory/5340-340-0x00007FF778940000-0x00007FF778A5A000-memory.dmp

Download

memory/5340-254-0x0000027E04970000-0x0000027E049D6000-memory.dmp

Download

memory/5340-255-0x0000027E04970000-0x0000027E049D6000-memory.dmp

Download

memory/5340-253-0x00007FF778940000-0x00007FF778A5A000-memory.dmp

Download