f6cf91c8b2dd220b3ad555bd6089fac593ce597628ccaf5cbcd363cf9b67bf54

Analysis

max time kernel
144s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe
Size 999KB
Sample260806-by1b2swvb1
SHA256 f6cf91c8b2dd220b3ad555bd6089fac593ce597628ccaf5cbcd363cf9b67bf54
MD5 61917e4553b2a013d69a7d10a0f47e08
SHA1 671c047ae5c0398cd1f89f244829e621ab4d5fe8
SHA512 06cc4d7f39174e8948186613ab04f459347bda5c0c3a5e896c847bb8481154741477f2b7b4dbbc3e84de96a8262866fceb7e3a70d45b184e7e9866a8ab2471c2
SSDEEP 24576:bNEHd0EKpxtJFtDYgo289TMFZ2qrRI8cbWhVS6QFQmM7OlgcVP576z:bNEHJKrtJF6/289TMn24eBAE3MHcVha
TLSH
T11325F115B780D033C13702768E5AD3A9A5B9F5B188214507B7E89FBD7F705C2EA38B86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
1560	alg.exe
1056	elevation_service.exe
2032	elevation_service.exe
1484	maintenanceservice.exe
5268	OSE.EXE
4152	GameInputSvc.exe
1100	msdtc.exe
3200	GameInputSvc.exe
4576	PerceptionSimulationService.exe
4588	perfhost.exe
3020	ReFsDedupSvc.exe
3276	locator.exe
124	SensorDataService.exe
6136	snmptrap.exe
2412	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b157e933e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3200	GameInputSvc.exe
3200	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2624	2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe
Token: SeDebugPrivilege	1560	alg.exe
Token: SeDebugPrivilege	1560	alg.exe
Token: SeTakeOwnershipPrivilege	1056	elevation_service.exe
Token: SeTcbPrivilege	4152	GameInputSvc.exe
Token: SeBackupPrivilege	3020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3020	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 3200	4152	GameInputSvc.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_61917e4553b2a013d69a7d10a0f47e08_amadey_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2032

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5268

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:124

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6136

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4708

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2296

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 58420753698c7c6441f9c1509a700d67f6429b9674fbc335d38430406e0e3299
MD5 bf1cb49ecda7a3976baca14448ad52af
SHA1 e68d45c88b010e26bc61697f3b31e18fb2ac9eb2
SHA512 bd1bc33787642237e97fc2b60055138dcfaf5d633f9a66cfc49d0c0a64d95d1c0626d96f07c9e87f43ced828a851e25d55c6ec5835659f7b39aacf9766172e03
SSDEEP 49152:Bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnjBAE3MHcVha:H3q6gjBYl3M8Vg
TLSH
T1C1D59D03F29900E9E06AD178D74A9133E9A2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 832e922f1f2b315f94c185cb65f418d67f05f97b4e1b551ccdc340bdfefb77c6
MD5 91ff86631cd043bb329e973e19d36304
SHA1 bbc2ea5aafede3b120827b6fb11bb4b9fce009ba
SHA512 da3926b5190c915b2b733b13adfbcb16a34451685f65d7895aa4178bf21242af70cf48ab9609b9c2fe39bd7e8a17eb7c873dd33f507aad03360de738c785155a
SSDEEP 24576:OXYLDtczArI8cbWhVS6QFQmM7OlgcVP576z:dtcdBAE3MHcVha
TLSH
T1FE050229B3A008F9EC57817DCCB68502E673BC524364EB9B03E486695F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 fc12a4b5c4f5f489041096374f484a454bdc4737545d9babe8dda27934067c8b
MD5 9c577a15c0ecd8299640a0bd848851b4
SHA1 fadf6e6359b85b6579f167580aceaf9aabf59a41
SHA512 e64d2394305f2506f7710bac6ca1f9b4020ce6a289c19287c8cf2f443092603b155f7a36c31514d37e3a9515ec667bc8815338e1543db6b454403670b33ffd51
SSDEEP 24576:Owu+OWeI8cbWhVS6QFQmM7OlgcVP576z:OwlOuBAE3MHcVha
TLSH
T11A05F14673A40CF9E9578139859B8136F7F3BC122A25DB1F07A0C75A6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cdde8b9d0625b5f2c7a6462a8b7c0ef678104d1ceb253ea17ff05f43ef294a1c
MD5 8aebf130f0a07dcb2efe8d33142ac846
SHA1 e0fe3506a0768c4cef0c943343f19d7ae4593393
SHA512 f4fba573432f06f2dfd4c23a5764ac4a6958c84731b219ef24ebf3d9ea31d71a38661578202001ef1a22a1ef8d4b5c74380748a8d3114f2b102c020abf3f0119
SSDEEP 49152:RB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5BAE3MHcVha:Hu6JmTxd2d5l3M8Vg
TLSH
T16ED59D13F2DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 f376b75e870305a8ec7520d65ede3081c1cb0f53e5106d89f9513be094e727fa
MD5 ae7cd905e7cc6e5c0be263953acf119e
SHA1 77af8659847bc91566621ffc20426f66e396138c
SHA512 2da1be8e155469d35f405d3cf0c1e02ca86794bc608645ef2811fafa57de191d56ccf9f3fd476dba821f8d22f3b80a0bd001db58263bace6985b04d93af72a15
SSDEEP 12288:cG7dIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:XdI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1B9D42362D3194972F40A51F505AF5007A02BFEB7471ADE97AA8183CCB836CC5ADBCB4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1dcd7593e92ea3d54a1f3f9e85cb1b18bbe5fd42477b3ad37a52681d6c9bb913
MD5 b9d244f9dc7aa5f8759e7dadb05037ba
SHA1 e58712b2ef51b80bdfb194691969154fd3ec6a21
SHA512 b338f2496334b467cba03e012205de65b60df147c398c40ea16cf0e7a1924c64b169c9c0d14321aa99063d8bce10a0029f2e24ae49fce4e7eaa5845d4563f57b
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYOI8cbWhVS6QFQmM7OlgcVP576z:qgb4mBIBhGF+BAE3MHcVha
TLSH
T15565AF1E22EC02F5E0FAD2B8CDAA4417D6B278160732D6DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 fc186921e40677763afc0bf86ccde4f16e309efd200aa833d7eeba0a71faa940
MD5 23dde871850c4b6c0bc5742b3c50e076
SHA1 16a072da895ad659726489c68c4578a2cdd6e86b
SHA512 4ceb0a8d946d686c0b0219fc12ce0a8f63cac302dc454442714604ac898c62019d0407f3ad5b715d48f332f21cf6bda79cf3a090b7e04bb219b96ccfaaee5d2f
SSDEEP 12288:1YGM2IghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:CGlI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T195E42369A26521F1D41B82B9447E5057B0B2B9B243266EFF05C1C3BCAF36CE4767CE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 0fcc2259afe50aa98a7c00f9c8a0de0b8eb9c4ed6e7d87898cdfdee75999baee
MD5 d37e2e0ab1c730e54b819d339ac6dc78
SHA1 862629651a11542319185fcacd15bd062c037579
SHA512 3096330ef7c948de5b375ec5bc248d38ef27b099f142f55523733bec5af40e0fcc62ed15d5aca4a427041daea844ea16d2fb8372ebdca9357f48bdfb5d1da64c
SSDEEP 12288:mYIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:mYI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T108D423A5D31545B2E40751FA056F0047A066FEB3432BAFD35AC283CCA93BCD665BCB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d28aadabde47d0b95baa4f6419105219cfb20579128226d56d2bef1c281d7fab
MD5 e64b7b3f74ef3c573138bae5a32c450b
SHA1 c6c5261c78362653976a7eee732020c9fb877701
SHA512 b8255f14032fe9393c319be6eb2929403517d2a03985b44b7bb7b20d22a498b8582e3e970b06489e7dad8820badf500870a8a993ce7241dab1d70f5ddcac0cd3
SSDEEP 24576:rDe8K8sEJqH1Mzria7/mNI8cbWhVS6QFQmM7OlgcVP576z:3dtscqVra7/dBAE3MHcVha
TLSH
T17535F165B3E101F1D47BD13889864663F6B2B8260324EFDF07A88B551F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 850912d09048c9b8b6c6cbf206258f8d34c60a0c9b3f64d19afb5cdfe33d30d8
MD5 d2a1009bd7a40123ea4dd5c22bcfd256
SHA1 cb62b3c2386305e737f3d7362a0dc3d84d64d6ef
SHA512 6e23e3f4f7fa632f513f3a68b7ddc4158290d4078f480a1f58285615836c324c55f3e48f11dd132ae400bd147c1e1c54bf5fafcf97d19d1ab75abb14ec8707cd
SSDEEP 24576:IPUr+NQcI8cbWhVS6QFQmM7OlgcVP576z:IJQzBAE3MHcVha
TLSH
T1B905F12F62AD18F5E666E17D89864609F372B8620312D6CF02D0817E5F27DE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8935aed76a474dee890ce68ae71a1f655fb3b7f180d34671e0ca3734b318a6a7
MD5 57de859ebad2c1c860b3ece49f6e0bac
SHA1 49980e240923bd8ba28a41c3c07540bb3ccb8cfc
SHA512 04a74b12a5fc9b31aeb43b68f7625b0f908a9572c75a047fb3bbefc3cab8dd8cd40c8c6b63458b44a7426ca87fe49e3b119e64838e7aa71fe852d91dde081472
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXBAE3MHcVha:wG05lO43byl3M8Vg
TLSH
T151D5CF6A62EC11F9D0BBD17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2d7ed3fc75d8fbe1b8a883ad7c25a67a7e8bacf0ad51c83ad56101548fb90c8f
MD5 43b5b4978986b5e5c46dbc955c8e17b7
SHA1 b3955d01775aeb6809983f4e557782fb2285453f
SHA512 af058deb1c3bd9b5f98cc815227276495de83dd869bde7b25a04727afae47c55d48c568cd4dc60ee2b4b09f7b8e02eaee15e7f78fc583cf8d2d38c074c008188
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkJI8cbWhVS6QFQmM7OlgcVP576z:ENc/zEOVHF1BAE3MHcVha
TLSH
T181857B2623E901E4F5BBE1BE897B9546FA71786513348ACF0291811E1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 138b9b3058671eb91846a52647a94b59119519d72fbddf44e1b7a28bff317afd
MD5 2c8edb9d8e6b5f391597961f46a89e90
SHA1 8a0e09205fd0625a66026513ef9698b4f758e19c
SHA512 e5b6363b5cdbf6e80c599f7d7a80174eae8ae2bc4170103de32a2bf25f0fa0642e124df4e6513ec41e8ef96e645f7cfffcf57815b884f10db1d2d6333dddb9b4
SSDEEP 24576:9JnJPbzB4SKKI8cbWhVS6QFQmM7OlgcVP576z:9JnJv6SeBAE3MHcVha
TLSH
T1BC15E03DD2A810E4E4B7C2B4815A175AFE31387D2B266DC719B4D5343F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f868ed62cde25a502d3cd380216890c5798f519c89d01ccd94301d5afdba6bef
MD5 976bc9cc7e99d3f53a0e93a359d39dcb
SHA1 66be6878ef3bae349068e56c5c4a73d35396c701
SHA512 2970c9916bc4695a202fcaa8627ab08c4f78401d34ec78b88af1f11d5a36d65fc2872d1e6615fec72abaf71b66050fe5a6cc279c5e4d04346c4de83f751518e8
SSDEEP 24576:cCLHGL0MoeVtFumTijCmlKQWDk6HxsBPvm0zz6DQxNYic:cCLHGeeV5ijCmlDWDk6Hi5vTzsQxNvc
TLSH
T160A56B05F7EB5184E9F3CAF4CA2694169A327C549B34F7DF4A80C96A2E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 415be76e3ae92890a19d803bae2dbedf9659eafec437b60bce75896197827ade
MD5 8cb12991732f8f73f82483e6cd00826e
SHA1 21ca504b9511c36bce9dc410b8295826cbaebec8
SHA512 599592da7036c26f0253780e6cf8fab7e2a78898fe039d8948b2ec8b9123cbdbc1c69d56aa84e58cabf053b3b75b87bd7dd54c35ac43ae5b535bb90d49b72aff
SSDEEP 12288:01Hck6j5ZI7RTIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb778:c6DIlI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1ACF4015D633A10F6D05BD07E86970102E1B2B5B183265ADF0BD4C6BD9EA3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 d79960e6e72b40a536e9a97fa7caa74adaacbe3f794028a4ceb14ebbe9e65bac
MD5 8c3dfbb301119240f2f4a258d3b7a538
SHA1 d22061c7c2e18a5e650437dc292739a6de2ef4b9
SHA512 9c75da178e1825fe04819c5c9b9d67662955432c607e1381c2f55b0c0bc88616baa8483124e0babe4f0bab2d1f213051a8f8c4255bc0c6d0d1613587cc4f6729
SSDEEP 12288:BG6kyUIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:otyUI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1BEF41205A35420E1F95A02B88A7B4192DA36FC3247229BDF16C0D37D7F36ED4A978F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 fce07baa8979b139c505d369385c381033392d229ab16d53f79677e2e4c4c71b
MD5 112843167295f667dc10c354d61e1308
SHA1 f4176db731698bc346d1ca666ee3b46577d977dd
SHA512 f71b5cd287ffd2af8825ce9d37004b4f5f53a928ba78f93c74e9e159bbb9843e22cc5c845c179014685149b320844784b368feb8d8b4484cce0e5be76e5585f5
SSDEEP 12288:ymhIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:HhI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T103D423A9D31511B2E40651FA056E0147E076F9B3032BAEEB5AC1C3BCAE3BCD56578F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 03010d2ac2540d5e24e9fde5a152689e4c0ea4272c79aeae9cb84bd5127791f1
MD5 05efc1987f0fd777d07a20078f96970e
SHA1 66be072c6233d545bedf14bf00231ad3b01362b9
SHA512 f06742c67548b5af0eacd9404c69a0bd28e85b95eba1e4d5ffffaf382c22d4bf37978e649e8b8825553583e753ded0e2d7181934c07c40551d603a4d3ab009c6
SSDEEP 24576:k6gPLoTfaidZiI8cbWhVS6QFQmM7OlgcVP576z:LgUTrZNBAE3MHcVha
TLSH
T15F559D1DA3EA05DAE2B2D275D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fcf0b3b3edc35d17ea6ee74a02deecbdaf3c5999737f70b5a25de9567b19a761
MD5 b153197c4c6eddb8b31945ade17557ea
SHA1 cd7d0410893180f93c9015f249a3345aa971070a
SHA512 eb49f32354a57ca69f40fd0b6efb3aa9b53a109ed22291d1312ad8c6e1230581ac18e51592f94a09a4745e8ee6470d41dd77b828eb2c690f96ae2b3d684dc421
SSDEEP 49152:5DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3fi5vTzsQxNvc:q3Upow8sBB5vTHm
TLSH
T1C0A58C3DA2E810A8C9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-306-0x000002D837580000-0x000002D8375E6000-memory.dmp

Download

memory/124-305-0x00007FF7D9D80000-0x00007FF7DA196000-memory.dmp

Download

memory/124-307-0x000002D837580000-0x000002D8375E6000-memory.dmp

Download

memory/124-380-0x00007FF7D9D80000-0x00007FF7DA196000-memory.dmp

Download

memory/1056-31-0x00000214F2B40000-0x00000214F2C8F000-memory.dmp

Download

memory/1056-34-0x00000214F2DB0000-0x00000214F2E16000-memory.dmp

Download

memory/1056-32-0x00000214F2DB0000-0x00000214F2E16000-memory.dmp

Download

memory/1100-247-0x00007FF616810000-0x00007FF616929000-memory.dmp

Download

memory/1100-333-0x00007FF616810000-0x00007FF616929000-memory.dmp

Download

memory/1100-254-0x0000018F01A30000-0x0000018F01A96000-memory.dmp

Download

memory/1100-251-0x0000018F01A30000-0x0000018F01A96000-memory.dmp

Download

memory/1484-59-0x00007FF774410000-0x00007FF774577000-memory.dmp

Download

memory/1484-57-0x000001B4A86B0000-0x000001B4A8716000-memory.dmp

Download

memory/1484-51-0x000001B4A86B0000-0x000001B4A8716000-memory.dmp

Download

memory/1484-52-0x000001B4A86B0000-0x000001B4A8716000-memory.dmp

Download

memory/1484-50-0x00007FF774410000-0x00007FF774577000-memory.dmp

Download

memory/1560-15-0x00007FF6E0FD0000-0x00007FF6E10F2000-memory.dmp

Download

memory/1560-16-0x00000171CAA70000-0x00000171CAAD6000-memory.dmp

Download

memory/1560-18-0x00000171CAA70000-0x00000171CAAD6000-memory.dmp

Download

memory/1560-49-0x00007FF6E0FD0000-0x00007FF6E10F2000-memory.dmp

Download

memory/1560-17-0x00000171CAA70000-0x00000171CAAD6000-memory.dmp

Download

memory/2032-43-0x0000021D5F000000-0x0000021D5F066000-memory.dmp

Download

memory/2032-40-0x0000021D5DD40000-0x0000021D5DE8F000-memory.dmp

Download

memory/2032-41-0x0000021D5F000000-0x0000021D5F066000-memory.dmp

Download

memory/2032-42-0x0000021D5F000000-0x0000021D5F066000-memory.dmp

Download

memory/2296-367-0x00007FF7D5930000-0x00007FF7D5E00000-memory.dmp

Download

memory/2296-366-0x000001F8B5200000-0x000001F8B5266000-memory.dmp

Download

memory/2296-364-0x000001F8B5200000-0x000001F8B5266000-memory.dmp

Download

memory/2412-324-0x00007FF761F70000-0x00007FF762212000-memory.dmp

Download

memory/2412-327-0x000001AC25340000-0x000001AC253A6000-memory.dmp

Download

memory/2412-326-0x000001AC25340000-0x000001AC253A6000-memory.dmp

Download

memory/2624-6-0x0000000002910000-0x0000000002979000-memory.dmp

Download

memory/2624-0-0x00000000000A0000-0x000000000027C000-memory.dmp

Download

memory/2624-1-0x0000000002910000-0x0000000002979000-memory.dmp

Download

memory/2624-7-0x0000000002910000-0x0000000002979000-memory.dmp

Download

memory/2624-28-0x00000000000A0000-0x000000000027C000-memory.dmp

Download

memory/3020-288-0x0000016667650000-0x00000166676B6000-memory.dmp

Download

memory/3020-300-0x00007FF736AB0000-0x00007FF7371F3000-memory.dmp

Download

memory/3020-365-0x00007FF736AB0000-0x00007FF7371F3000-memory.dmp

Download

memory/3020-289-0x0000016667650000-0x00000166676B6000-memory.dmp

Download

memory/3200-253-0x0000022825920000-0x0000022825986000-memory.dmp

Download

memory/3200-250-0x0000022825920000-0x0000022825986000-memory.dmp

Download

memory/3200-252-0x00007FF783BC0000-0x00007FF783C88000-memory.dmp

Download

memory/3200-342-0x00007FF783BC0000-0x00007FF783C88000-memory.dmp

Download

memory/3276-301-0x00007FF619FE0000-0x00007FF61A08D000-memory.dmp

Download

memory/3276-295-0x000001E2AAC00000-0x000001E2AAC66000-memory.dmp

Download

memory/3276-296-0x000001E2AAC00000-0x000001E2AAC66000-memory.dmp

Download

memory/3276-373-0x00007FF619FE0000-0x00007FF61A08D000-memory.dmp

Download

memory/3344-335-0x000001A816A00000-0x000001A816A66000-memory.dmp

Download

memory/3344-336-0x000001A816A00000-0x000001A816A66000-memory.dmp

Download

memory/3344-334-0x00007FF7FC860000-0x00007FF7FC9F4000-memory.dmp

Download

memory/4152-322-0x00007FF783BC0000-0x00007FF783C88000-memory.dmp

Download

memory/4152-238-0x00007FF783BC0000-0x00007FF783C88000-memory.dmp

Download

memory/4152-240-0x0000014BE43F0000-0x0000014BE4456000-memory.dmp

Download

memory/4152-239-0x0000014BE43F0000-0x0000014BE4456000-memory.dmp

Download

memory/4576-269-0x0000024FB26E0000-0x0000024FB2746000-memory.dmp

Download

memory/4576-268-0x00007FF6E4460000-0x00007FF6E45A9000-memory.dmp

Download

memory/4576-270-0x0000024FB26E0000-0x0000024FB2746000-memory.dmp

Download

memory/4576-354-0x00007FF6E4460000-0x00007FF6E45A9000-memory.dmp

Download

memory/4588-276-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4588-282-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4588-361-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4588-277-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4708-351-0x00007FF6596E0000-0x00007FF659A00000-memory.dmp

Download

memory/4708-345-0x00007FF6596E0000-0x00007FF659A00000-memory.dmp

Download

memory/4708-349-0x0000020D56D90000-0x0000020D56DF6000-memory.dmp

Download

memory/4708-343-0x0000020D56D90000-0x0000020D56DF6000-memory.dmp

Download

memory/4708-344-0x0000020D56D90000-0x0000020D56DF6000-memory.dmp

Download

memory/5268-63-0x00000210E2F20000-0x00000210E2F86000-memory.dmp

Download

memory/5268-64-0x00000210E2F20000-0x00000210E2F86000-memory.dmp

Download

memory/5268-62-0x00000210E2CB0000-0x00000210E2DFF000-memory.dmp

Download

memory/5300-374-0x00007FF6AC5D0000-0x00007FF6ACAD6000-memory.dmp

Download

memory/5300-375-0x000001961F400000-0x000001961F466000-memory.dmp

Download

memory/5300-376-0x000001961F400000-0x000001961F466000-memory.dmp

Download

memory/5828-357-0x000002C8F8BF0000-0x000002C8F8C56000-memory.dmp

Download

memory/5828-356-0x000002C8F8BF0000-0x000002C8F8C56000-memory.dmp

Download

memory/5828-355-0x00007FF616A80000-0x00007FF616D0A000-memory.dmp

Download

memory/6136-314-0x00007FF7B8F20000-0x00007FF7B8FD3000-memory.dmp

Download

memory/6136-315-0x000001E88E7A0000-0x000001E88E806000-memory.dmp

Download

memory/6136-316-0x000001E88E7A0000-0x000001E88E806000-memory.dmp

Download