6c1d396d89a4e1e16f11e752d2c80dcb1e4b85e1e548baa157437a2f677fd7cd

Analysis

max time kernel
145s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 663KB
Sample260808-eq86rss1dz
SHA256 6c1d396d89a4e1e16f11e752d2c80dcb1e4b85e1e548baa157437a2f677fd7cd
MD5 0c4f20e1d8884f3ca4855c33930a5abc
SHA1 25247a676a2ea734e1fbe032dc376e0437c9b273
SHA512 3905800a4cc86c3b7076a1a99ac08e74b8f401b50bdb611b74678cfdcbfea1d6cbbe9c09b86b740f1159b022183248a0a4ba103a412f9827be1efbb2e349f349
SSDEEP 12288:LYmIjE7esw2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/vMM4g:J7esnAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T107E423213773AD72E9C298750504EAE2D57F3C3053F69D5BBB94951E9EF0382CA0622E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3220	alg.exe
3620	elevation_service.exe
3804	elevation_service.exe
2736	maintenanceservice.exe
260	OSE.EXE
4780	GameInputSvc.exe
872	GameInputSvc.exe
5316	msdtc.exe
5484	PerceptionSimulationService.exe
4216	perfhost.exe
3136	ReFsDedupSvc.exe
1804	locator.exe
3004	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b3f18cae05f6396.bin	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	GameInputSvc.exe
872	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2648	2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	3220	alg.exe
Token: SeDebugPrivilege	3220	alg.exe
Token: SeTakeOwnershipPrivilege	3620	elevation_service.exe
Token: SeTcbPrivilege	4780	GameInputSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3136	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 872	4780	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_0c4f20e1d8884f3ca4855c33930a5abc_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3804

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:260

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:872

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4216

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:3004

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1596

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4472

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0446845bde2f72ab51bca87e2c2300913612f99d99ca3f40270bab47073aca62
MD5 8fc9bb12ee577fde5215a9bde208efb5
SHA1 a4a29d22075c58349f1a31bba7658abee81b7cf2
SHA512 4f29f0f66d267ce5152e96984852675676bc2199bb429b035e78eeb66de384c16fd84d90f97db7cf23898d4c9ec15c3b0a56e18887b100ff4b68bb38f6528c7f
SSDEEP 49152:6b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnCGMHnUCqJSAVRj:s3q6gjBnUCoSA7
TLSH
T174D59D03F2DA00E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 dfba37592a4c14fd34f9af561726b69437180e31858fd36ce4fed2b6cfabad1e
MD5 434272bb5634477d5c06603bd3598fdf
SHA1 e9408516a81b90ba19cc3787198b97d3f17084df
SHA512 10430e08e98914f489d1900f85b2a7c44e407a37f74cc0ef9ef324e8f5a1b06f8ef9d77880d10b86bb3fb76e377e5a8ba67d1833a1367205fae6d6390ec4c575
SSDEEP 24576:/XYgJtczA0nAJiodw/jhMOnUCqJB0BKVRe4:JtcjGMHnUCqJSAVRj
TLSH
T1AB05012867A50DF9EDA7817CC8A29902E633785043B0EB9F03E4D9295F633C45E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 212c6a01daf4aa772fa72fd9cfeff3536712a1600154a3e937dab07f219e3f5e
MD5 f67bd1eb5e3dd8d570f71e985a25fed1
SHA1 4ea10fb4d048ed5ac7708e3c52d0c1be9e2df028
SHA512 1fbc05e35df793bb52869cf7d3b433b245a5e8e04e71f18b8b7b1e2d9e3e0ade833cb9a55882b6eb01ef3a7b53f8fdd99ad17bb9def80791fadadf2fdf7d75cf
SSDEEP 24576:Owu+OWcnAJiodw/jhMOnUCqJB0BKVRe4:OwlOpGMHnUCqJSAVRj
TLSH
T16405F14627A91CF9EAA391398547D536F3F7B8012621DB2F1760C61B6F33352AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d9908380c6286c874064d4c50e11031f3292f13dd950d700adab9283f4dda550
MD5 e7475c8e1d45bf05d2d7df0ea67182a3
SHA1 3f31b28454febd0a10aa012ca1a9c6798022f4aa
SHA512 2263459df0c7a5f0e0de9114b8bd3a0ade79c3351acbd3315d23db8c90a37f20ddbe4115a8a260d956c1d91b065e6f6e8b33826df61840ae2a4735749b1dd7fa
SSDEEP 49152:iB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glndGMHnUCqJSAVRj:Qu6JmTxd2dnhUCoSA7
TLSH
T10BD59D13F1DA01E8D05ED478974AA233F962BC490B35B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 856217ea3764fa3cd50f92321c003c5934b66b61ad8a274232855a978ba394c5
MD5 1e6fed8ed3ef24abef0b32619433a4fb
SHA1 ff47dfc2eafc6a1d15795c91e6cd55f66aec5117
SHA512 5d5b91aee49755dde62fbaec3a0d969b0e39139faeaf0cc78836c66fbb3f516c4547afb2b99a695cea3030cbe9275deb8bccc98e331a56ce99d6b9a9fc480fe2
SSDEEP 12288:cT74w2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/vMM4AR:e4nAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T1BBD423120B3F2EA6FBD1E8B51105B99AA03F796447B29EEFAD50E44CECF03825D1512D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 75c044d03aceb75bc30e0f77ec957852376695b937dd10ec1cb49a6a2f276720
MD5 1f2f6b3585d3412cbb96f072785c4620
SHA1 3c498cb5a6da4e03f666204a88b8809a3521adbd
SHA512 4c9a8a5a4f3abda1a01c6cb2089b0161ccf39124cc78efc9f8a58b8332aa6c468388335b926820e92766c6200d4fe013cd38de924fbf0cf97dbfe9dda52d2f05
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYqnAJiodw/jhMOnUCqJB0BKVRe4:5gb4mBIBhGF/GMHnUCqJSAVRj
TLSH
T13065AE1E22EC02F5E1F5E2B89DA64417D6B378160732D6DF1250422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 0c9fb2a2bca7ca50b64cde6d0aafd61b0ea9e35edc240473d98e98c5972168c7
MD5 1170a2a9cc7b13306af947b69a1a82eb
SHA1 debbdc3197ef6bedcc0b881e13fc9173348f85ba
SHA512 c10e161dcb15414879f965622c042f8395f510536d79505459fa5ab2aa4f025c58ab72129c3813d3a6eaeef55e2cd58fc3e4351071aacce5d38aaba1a2ef4f1d
SSDEEP 12288:r5GrHw2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/vMM4AR:VGDnAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T1D5E41225167F3EE4DAB5D5B90401B997B0BE356043761EFF49E0E438DEA02C16A39C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 2a82c67137659da3b43fa38d8167a43c4d392e0463aee9551acf7de64f2fc870
MD5 e2e289f812548cd14748d5d5a513edf7
SHA1 a11d6a2e3779965192abfc006046cdfb4fa61d23
SHA512 dc8cca595a48c7a8ae880c837943b7f595b01beaf26128f81e7c92c8a731f179b16874f1063a3537d07d25f140d429653ccfa503e46076fb04ba87805d0aac8f
SSDEEP 12288:3zw2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/vMM4AR:3znAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T1EFD423520A3F2FE9EBC1E8B611017D8A907F291493B75FFB69A4E419DDE02C35A3506C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 36f6837933e92206541a13fb3c7b932886be692f508bdbd94c7e65cc4b08f820
MD5 862fe64a16dbc645d1c2f6c5ae727bb6
SHA1 fc4321d229595741ab88854d6ecfb0ddf6f8f14d
SHA512 7ebe059b487b0722fec7f99d37cd34f69161edff168320f8d5297594776aa96fbb55d795914eee9c75492c0902aa3072cec15eafc12cea64a7dbf3c12f608e48
SSDEEP 24576:ogb8u8FpJqH17zria7/mbnAJiodw/jhMOnUCqJB0BKVRe4:9AZFPqV+a7/aGMHnUCqJSAVRj
TLSH
T1AC35016167E506F0D4B7D13889424AA3F6B2B4250375EFEF0BA88A551F237D10B3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 96f3937b26a347aefb50789304e0a831c16dc7e022b3a930cd4dc11169140075
MD5 7fa60e44009c1f2d32f0ccb2e698fe2e
SHA1 19229d24b54d993320e8454586dd89ecfe7ea3e6
SHA512 44ba8e0b8ccf73dfcdcd1122a4f978b87cc3f7f18b4412d75c458c1cea4b2c789dfc9d0b5c4aa08056ee5a68b8c004d8e51d4944e40c7010fce1bd701cef95d8
SSDEEP 24576:PPUr+NQHnAJiodw/jhMOnUCqJB0BKVRe4:PJQHGMHnUCqJSAVRj
TLSH
T1BA05F12F26AD1CE5E6B6E17D85429709F27274620312D6DF02E0817E4E63AD4BD3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 2622a25559db91a7f297d5b5c2873ed74365be742751445238cc3eb2ac0c585c
MD5 57ba3c4672f982e2d9dd69ad745c4d8c
SHA1 998b36a6408fcb2d353b9df8553a3db13f8b2599
SHA512 b59482e438328378c2d6410606bd6c255f1ebd03cf1ec6d60135b74867b44782fa805d4f96b445156813698ea7b2845b822f695e6af614c35a36f4d42d503019
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0GMHnUCqJSAVRj:/G05lO43b3UCoSA7
TLSH
T154D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23815033556CF02A486A91F23FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b443167a0edb9ba9dfdea14591582909c07f048f611356b4d41e0df7ec94b81e
MD5 ddc673dc3819579c3e0bf6dc25e817fa
SHA1 49819229d8ff612c0550bb6bbe1b1ed8ded2c329
SHA512 54c2581a869645b798f3d2fe1488998aae27fd8a0a90df2820f94313ef5d62adda64a8af872d5f66be74b0402c28bd52ab7dfd89cec65e44a224a60482efc822
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkQnAJiodw/jhMOnUCqJB0BKVRe4:MNc/zEOVHFVGMHnUCqJSAVRj
TLSH
T1C3858C1623E901E4F5BBE1BE89679946FA75786513308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 3557c573af48dd26f0f9295d8cd42aa00a59ff6cd404008ed489d362cc9d116b
MD5 483c3f82b1d8b2f8f843d930b2be674d
SHA1 c3a6ed02a5fbc8f49c5a9ab3d5978d4c807dee67
SHA512 70bd104433e54c3485aa318cabd534902d9e2600731adafc88030f3f589944941b5f5d9e08df3b468f36aae886735d086bd7f1224889d2a9e336a4e64ee46a8b
SSDEEP 24576:eJnJPbzB4SknAJiodw/jhMOnUCqJB0BKVRe4:eJnJv6SMGMHnUCqJSAVRj
TLSH
T1F015D13DD2A810E8E4B7D1B4411A2B5AFE71387C2B2269DB19B4D4347F52FD0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 3c34abbcdb2d688410c17a115909f5a2fc189fa99da234bc15938bbf6f2801d2
MD5 005c0f899e83b7de811e8838a66ec19f
SHA1 a057c93d1fe8e92cb9e001d4292e197a6eac78a7
SHA512 24d53c4dc06c932b9d59fcaaa44b5ad949300609eade3575b21ddef3d3ac0b7f56437992c3fc51f738f7b19b37be62ed5a7c3a6c8d2413b6328e6d1eeb287fbf
SSDEEP 12288:i1Hck6j5ZI719w2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/H:+6DIJ9nAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T11FF4011D237B21F9D1A7E03E81830542D1B7B07083625AEF0AA4C47D9EE3EC9B93DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 bfd1cfa5ea48a46aa428317c065a5f1a358a2cb49c34bc1353b0586298cb15c5
MD5 3ef15a035ded0e5c14aa0ea44c3ceef8
SHA1 32fd8428a5f147bedccaa84993a29205ffdc66a5
SHA512 0e4607bcef3b3a3288a157bdbf9b6367b03d7849595740187ab370172b9738f607ed2a3d31836d2828d8356acb9a06104733be887f9afd3e47ec56c7529975e0
SSDEEP 12288:OG6kyr9w2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/vMM4AR:HtyxnAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T120F41201037939D4EBE591784A12A6D5C93E7C2097725BEF29E0E53EAEB13C1AD3072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 1dad1cb852cebaaec5877f5f211bf1b2ecae7e516c2a9254a686fd8bec152fe5
MD5 405b4a487181ca73ade39370601f12c5
SHA1 3ef43beb45f08f873bdcfadad76fb0e51ccbe931
SHA512 8f4dbed3c46c2adc4fde86b7b59a05bbf375ddeef2009eb91f939162943d0e7534f2f5ae3aea275db132675fce73023e63babb45e970a711ca15070024b05913
SSDEEP 12288:Drsw2AJiVLadUHf4b+TLndDMOnw1zbufJ0CEfmmB0BKVCLWgZiZq/vMM4AR:XsnAJiodw/jhMOnUCqJB0BKVRe4
TLSH
T133D422550B3F3EA9EAC1E9BA11017A8AD07F356453B31EFF69A0E428DDE03C2593546C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 26704f4a8565fb61f1b935da427308b6c350bd74ddfb593779aaed63264f1f29
MD5 41e630efc3e89f7c23a60c3cd72bc860
SHA1 1753026448626a7c7ba5a80949cf5acfc5793b1a
SHA512 55639f8fe3a9723ce08381dbf84dec144a16c95372a8ee0e1ecddfb9d3750d5904077f1df48cf71d6f3ad46023b17261355c2b1e7e5cb19983aab8fdddf0d7cd
SSDEEP 24576:SXgILoTfaidZnvnAJiodw/jhMOnUCqJB0BKVRe4:YgHTrZvGMHnUCqJSAVRj
TLSH
T1AC559D1D67FA09CAE2B2D675D8621493D633B4315372C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-58-0x000002761E970000-0x000002761E9D6000-memory.dmp

Download

memory/260-57-0x000002761E740000-0x000002761E83B000-memory.dmp

Download

memory/260-59-0x000002761E970000-0x000002761E9D6000-memory.dmp

Download

memory/872-320-0x00007FF6E85A0000-0x00007FF6E8668000-memory.dmp

Download

memory/872-245-0x00000214B12C0000-0x00000214B1326000-memory.dmp

Download

memory/872-244-0x00000214B12C0000-0x00000214B1326000-memory.dmp

Download

memory/872-243-0x00007FF6E85A0000-0x00007FF6E8668000-memory.dmp

Download

memory/1596-321-0x00007FF730B90000-0x00007FF730E32000-memory.dmp

Download

memory/1596-323-0x000001D7D8550000-0x000001D7D85B6000-memory.dmp

Download

memory/1596-324-0x000001D7D8550000-0x000001D7D85B6000-memory.dmp

Download

memory/1804-297-0x00007FF7FB7B0000-0x00007FF7FB85D000-memory.dmp

Download

memory/1804-291-0x0000022AC1480000-0x0000022AC14E6000-memory.dmp

Download

memory/1804-292-0x0000022AC1480000-0x0000022AC14E6000-memory.dmp

Download

memory/2648-0-0x0000000002480000-0x000000000258C000-memory.dmp

Download

memory/2648-1-0x00000000026E0000-0x0000000002749000-memory.dmp

Download

memory/2648-7-0x00000000026E0000-0x0000000002749000-memory.dmp

Download

memory/2736-54-0x00007FF6B1C70000-0x00007FF6B1DD7000-memory.dmp

Download

memory/2736-52-0x000002737DEF0000-0x000002737DF56000-memory.dmp

Download

memory/2736-47-0x000002737DEF0000-0x000002737DF56000-memory.dmp

Download

memory/2736-46-0x000002737DEF0000-0x000002737DF56000-memory.dmp

Download

memory/2736-45-0x00007FF6B1C70000-0x00007FF6B1DD7000-memory.dmp

Download

memory/3004-303-0x00007FF7D46E0000-0x00007FF7D4AF6000-memory.dmp

Download

memory/3004-301-0x00000246D4030000-0x00000246D4096000-memory.dmp

Download

memory/3004-302-0x00000246D4030000-0x00000246D4096000-memory.dmp

Download

memory/3136-284-0x0000014EB5480000-0x0000014EB54E6000-memory.dmp

Download

memory/3136-296-0x00007FF6D24A0000-0x00007FF6D2BE3000-memory.dmp

Download

memory/3136-285-0x0000014EB5480000-0x0000014EB54E6000-memory.dmp

Download

memory/3136-357-0x00007FF6D24A0000-0x00007FF6D2BE3000-memory.dmp

Download

memory/3220-16-0x000001ED9F360000-0x000001ED9F3C6000-memory.dmp

Download

memory/3220-21-0x000001ED9F360000-0x000001ED9F3C6000-memory.dmp

Download

memory/3220-17-0x000001ED9F360000-0x000001ED9F3C6000-memory.dmp

Download

memory/3220-63-0x00007FF728B70000-0x00007FF728C92000-memory.dmp

Download

memory/3220-15-0x00007FF728B70000-0x00007FF728C92000-memory.dmp

Download

memory/3620-29-0x000001F671450000-0x000001F6714B6000-memory.dmp

Download

memory/3620-31-0x000001F671450000-0x000001F6714B6000-memory.dmp

Download

memory/3620-28-0x000001F671210000-0x000001F67130B000-memory.dmp

Download

memory/3620-30-0x000001F671450000-0x000001F6714B6000-memory.dmp

Download

memory/3804-39-0x0000015E276C0000-0x0000015E27726000-memory.dmp

Download

memory/3804-37-0x0000015E274A0000-0x0000015E2759B000-memory.dmp

Download

memory/3804-38-0x0000015E276C0000-0x0000015E27726000-memory.dmp

Download

memory/4216-340-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4216-278-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/4216-273-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/4216-272-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4248-352-0x0000023562100000-0x0000023562166000-memory.dmp

Download

memory/4248-353-0x0000023562100000-0x0000023562166000-memory.dmp

Download

memory/4248-358-0x00007FF7DA110000-0x00007FF7DA39A000-memory.dmp

Download

memory/4324-332-0x0000020E36DB0000-0x0000020E36E16000-memory.dmp

Download

memory/4324-333-0x0000020E36DB0000-0x0000020E36E16000-memory.dmp

Download

memory/4324-331-0x00007FF7D4B00000-0x00007FF7D4C94000-memory.dmp

Download

memory/4472-342-0x00000243511E0000-0x0000024351246000-memory.dmp

Download

memory/4472-341-0x00000243511E0000-0x0000024351246000-memory.dmp

Download

memory/4472-346-0x00007FF703010000-0x00007FF703330000-memory.dmp

Download

memory/4472-347-0x00000243511E0000-0x0000024351246000-memory.dmp

Download

memory/4472-349-0x00007FF703010000-0x00007FF703330000-memory.dmp

Download

memory/4676-312-0x00000185BD6C0000-0x00000185BD726000-memory.dmp

Download

memory/4676-313-0x00000185BD6C0000-0x00000185BD726000-memory.dmp

Download

memory/4676-311-0x00007FF612010000-0x00007FF6120C3000-memory.dmp

Download

memory/4780-236-0x0000020ED6A00000-0x0000020ED6A66000-memory.dmp

Download

memory/4780-234-0x00007FF6E85A0000-0x00007FF6E8668000-memory.dmp

Download

memory/4780-310-0x00007FF6E85A0000-0x00007FF6E8668000-memory.dmp

Download

memory/4780-235-0x0000020ED6A00000-0x0000020ED6A66000-memory.dmp

Download

memory/5316-252-0x0000024B58A40000-0x0000024B58AA6000-memory.dmp

Download

memory/5316-253-0x0000024B58A40000-0x0000024B58AA6000-memory.dmp

Download

memory/5316-330-0x00007FF62F5D0000-0x00007FF62F6E9000-memory.dmp

Download

memory/5316-248-0x00007FF62F5D0000-0x00007FF62F6E9000-memory.dmp

Download

memory/5484-263-0x00007FF7A0410000-0x00007FF7A0559000-memory.dmp

Download

memory/5484-265-0x000001FCB20C0000-0x000001FCB2126000-memory.dmp

Download

memory/5484-266-0x000001FCB20C0000-0x000001FCB2126000-memory.dmp

Download

memory/5484-338-0x00007FF7A0410000-0x00007FF7A0559000-memory.dmp

Download