a8301679e810c155b871d4dcbec827de7814bb793a1da85294c1baba8e3da387

Analysis

max time kernel
147s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample261006-1snthaws7n
SHA256 a8301679e810c155b871d4dcbec827de7814bb793a1da85294c1baba8e3da387
MD5 72aba798799061b9633d6626447fc207
SHA1 b08f93a905ef7d63cb9df89a02d5e36e8ef25699
SHA512 46c829160c07756bd89eacefed3bd17b7db9f12124d8ab2b3806d2849e71a1d527108f5c227a743a92e2ee756f14ef551b96c5e34f19f897b041787228e84d4d
SSDEEP 24576:HmewsAj2chr2eB7pszrYnQeqK0sgoAP3f3:GljN2g7pszrYQf2g93
TLSH
T1FE15E031FA74D032C7BF0D761B26C306687DB9214B611AC3F3E89D9E99202D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
4376	alg.exe
4672	elevation_service.exe
5596	elevation_service.exe
4220	maintenanceservice.exe
4936	OSE.EXE
4676	GameInputSvc.exe
5228	GameInputSvc.exe
5368	msdtc.exe
4396	PerceptionSimulationService.exe
4788	perfhost.exe
4220	ReFsDedupSvc.exe
4636	locator.exe
5328	SensorDataService.exe
3720	snmptrap.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\64fb73c867fac3b7.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5228	GameInputSvc.exe
5228	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3780	2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	4376	alg.exe
Token: SeDebugPrivilege	4376	alg.exe
Token: SeTakeOwnershipPrivilege	4672	elevation_service.exe
Token: SeTcbPrivilege	4676	GameInputSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 5228	4676	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_72aba798799061b9633d6626447fc207_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3780

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5228

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4788

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5328

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5156

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:928

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3934c90f88e14195e1c943b5a412f8606c6a707f5adb11f2190c87aef152bb81
MD5 5263783bff145519bcbcc829c8a391f3
SHA1 4ed3aa4c238e0c52fd492ca860aa284f5264d0b1
SHA512 a2e9e023e2ea15cae1cae311dee1b6dd593465db09016b1e1bd1f5a5961cffae58e75dcd3cb3a252ce4768e1ec8a6283f68c5ef341f5747baffb302b3ede9292
SSDEEP 49152:nb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnF2g7pszrYQf2g93:V3q6gjBWVErYK2G3
TLSH
T1B8D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 fc315121f42e383ac122ec34e266920cc8e9c3f65b69979431b554c2db539dfa
MD5 f8239dfe9481e2e026ee5ea7c9c28b0b
SHA1 17224f1824c9a6d5efaddcedcbafe1571fe234c8
SHA512 b7cf88e5c954eb992cfc28228e6e41179a1542412bf2a83b309072419c1ff3c32d537476cc1a1c0b53d446c244ff1418615ba289ab4f0500bc1736559ba1c4e5
SSDEEP 24576:vXYqD/czA0chr2eB7pszrYnQeqK0sgoAP3f3:t/ca2g7pszrYQf2g93
TLSH
T19A05F22873E004F9ED6B823DC8A2C501EA737C564774E79B03E499265F233999E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 7ec57ba7dff7c9f0b867e9472e20694f3869b0ad9c33d2d6467f66dccf6c8bd9
MD5 c6d28183f00eea8e7cd05f113adcb1da
SHA1 3c7797fe75dbfaeb7cfff2fe644793ac0ad6f2c3
SHA512 68f492c03d978ede6fe39d4acc4531836f5a5644eab17821bcb7fc763ab321cd62b6ec624bab6c2d47737a9714eaea6ab2084d4e887df187d7a762b43046c32a
SSDEEP 24576:uwuuOWdkchr2eB7pszrYnQeqK0sgoAP3f3:uwVOW2g7pszrYQf2g93
TLSH
T14E05F14672A40CF9E9A692398557C135F7F3BC122A35DB1F1760C61BAF27312AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90c2c922f07eec7235ce139d31e876caa32f688f6843832c037eb3610fae2017
MD5 99033fcbf650a20fdcfc3bf01c9a4bc6
SHA1 5f023bbb80a1978108e99a08254e9354aba55168
SHA512 fc69cc7bc037871fe887b232387a7f29b8f087b188c358e88c5375eb152a9fd63f25fddad85a51928fcff95e555f09f7af4f7ca435f7b0489d2da0efc4da61ea
SSDEEP 49152:RB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glM2g7pszrYQf2g93:Hu6JmTxd2dkVErYK2G3
TLSH
T110D59D13F1D901E8D06ED079974A9233F962BC490B35B6EF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 2785470d2dc28406d18ea375c6f44d3b6db1162a90e9a2fe9ad0ba2a6520d78a
MD5 77dd75997833c0b5e07b33c30399fe47
SHA1 e0603aec3c8ff7ef1315cc0493063543ea248b42
SHA512 053a4387fa172de623cf77333cece73399fc000bae2711c64db842c14f603b879fa47bccb56f3dc0e658fb5327f304926e195b3b6c84ab16b1d5028e93e8ad99
SSDEEP 12288:RV7UuXBchr2oNdz7pklKWrYdrVPQeuZK0jggL30xPyaAIBVy3f3a:/xchr2eB7pszrYnQeqK0sgoAP3f3
TLSH
T153D4232193648182F9BCD237042FC210F96FBD3B973599EB7B4B6812E621707DEB4925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 720d763c8455c0fb26ac009749e045c26ab1bda05399489db6e1f0c9c7844973
MD5 9b50070b7cff01da57298a3e72024775
SHA1 a1fc63820dc09aa68cf474409237cb164afcdc00
SHA512 5c3c2485fb9134e945dc2b3042c60e60f76d457721c7f6d3c4b4d3eccdc8b85cf6b992459a07c28e63d2b028bf970138070ed20003f03751cabb0fbb805bc7a2
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bY5chr2eB7pszrYnQeqK0sgoAP3f3:lgb4mBIBhGF12g7pszrYQf2g93
TLSH
T1DC65AE1E22EC02F5E0F9D2B88DAA4417D6B378161731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 4050cb17bcf5531782e7b19cde427e88b0cb82e4b155da23a20e9d4ca00abaa3
MD5 1e76e136c28213b7ca100bff1a669254
SHA1 ead4357c86136af118279a385e6effa00c0ee287
SHA512 237814bb45f9de335e931eb562c2cd2eb2dd96c528934a3762546c2625e6dc4c7e9e1d5919d9f71442e6c3de6a85c5ef86408e33bb0e86e3e43bb76cf9cdb82b
SSDEEP 12288:oAGHuXBchr2oNdz7pklKWrYdrVPQeuZK0jggL30xPyaAIBVy3f3a:BGQchr2eB7pszrYnQeqK0sgoAP3f3
TLSH
T19FE4222D61B560C5D97DC33B442A8252F9B27C2393355AFF1ADAE836DB117D2E638C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 c1ef60d9e104d0dddb9d60873f315c6b971d9f3f9bcc145fae63dff46f2e38b5
MD5 a2682c79f02eedd04fd11548e2efb16f
SHA1 d1284d9f78a3ec37e2e164401aeca7081d433f01
SHA512 58c3e7d68631c2c9360f7e65c4020402f6e13490a7ef39846fdcd1ea8ac7837cd69556428f1df4adb0d0c0ea98e18a5b909f1f82a07e4cdd137d1acade1d81de
SSDEEP 12288:6ouXBchr2oNdz7pklKWrYdrVPQeuZK0jggL30xPyaAIBVy3f3a:6lchr2eB7pszrYnQeqK0sgoAP3f3
TLSH
T16BD42325616481C3F96CD63B001F8200F96BBD2793765EEB7B9B7812E6057C7E6B4831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 31ea9a3b862174bcb442854c966d845036035dd918817c53f960f0746c53ebfe
MD5 0ac88a44b5bb6b94059f456891b3f4fe
SHA1 858b5fda1d162c7583648d0dac08446ace4f12e7
SHA512 507b8c0158a298b40462155f4686fd6aaa91b0e839aab5da72ffc9eccb3d7f8990f084c9d7715d07518be3c3719e885acb7c037324ffb2845ede148f7606b37e
SSDEEP 24576:sjy8u8FpJqH1hzria7/mgchr2eB7pszrYnQeqK0sgoAP3f3:2BZFPqVoa7/o2g7pszrYQf2g93
TLSH
T18E35F16576E001F1D47BD13889864663F6B2B8260374EFDF07A88A521F23BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 e6b4f2f7377096a66f473aa8ef973a4ba94dbe68bf477958161bb04f6277d73a
MD5 0a3e9711b2c8816fdc39156ce0980cb6
SHA1 98878534d8d3f7ea28ac4041f714ee236635fafc
SHA512 2fc3def4ffc49765341caefb8422fd14e89b24093594cae65f743bd2e02e05b5b1e29d819dcc2109f9ce1e4ffdb0ba463bccd40c8e40169af56589d43f910f00
SSDEEP 24576:CPUr+NQWchr2eB7pszrYnQeqK0sgoAP3f3:CJQt2g7pszrYQf2g93
TLSH
T16D05E12F62A818D5E67AE13D85468709F772B8631322D6DF02D1813E5F13AD9BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3e535507aa462966f2fb3778c4bf98d9d8ac1fea363b108902492a1cb128d29c
MD5 812eeeeac10d939649b07f6c83dbed96
SHA1 623d3d2d76f674df010660a08b77997afeab7fdf
SHA512 222bc8211ad00312c975684684267647180da9feb2a1c6e46144df1500892c523f529463751b5775d79092a7b2cf7a99ad3664b608fa2fba16761a2015da7c51
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjM2g7pszrYQf2g93:TG05lO43bdVErYK2G3
TLSH
T194D5CF6A62EC11F9D1BBD17CC9C6860BEBB23825033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 054371a2c031c1b252e031fb2def75993f354f42252b7bb52ebd6bffd90e93a4
MD5 6a1337dc84b932340667357f9728f2ff
SHA1 f8b055311d67f84fecd26d6103bf695ba20546cc
SHA512 0641920947649449c2aeb31b711d85993ecd54db024f24f91810d1d428f403dea4896280a7f88e2298afd9f5ca08f6e3e1afd6a83ae5f4c1282569ac37ddfae9
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fkhchr2eB7pszrYnQeqK0sgoAP3f3:lNc/zEOVHFZ2g7pszrYQf2g93
TLSH
T1F5858C2623E901E4F5BBE1BE897B9546FA71786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 1fbc91e404bb44a7dd4b79b95e8a9bb8099d4ec1a8e1eacab00eab73d3238ebf
MD5 207314bbf18ac09006888237e881f3ae
SHA1 187e181a5a73f4d24facb43d4e15c6cc20dfb596
SHA512 baf29784c4b87394e5266994da26182e4be34a47f9830f3e14d55bcc873d3cb6a40b1e6427844942fa1715b9b17d041e729a18048d4bfc968938f8b4ac497a82
SSDEEP 24576:uJnJPbzB4SJchr2eB7pszrYnQeqK0sgoAP3f3:uJnJv6SS2g7pszrYQf2g93
TLSH
T10215D03DD2A810E8E4B7C274811A1759FE31387D2B2669CB29B4D4353F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b32ab6f8bb15c9d68b3494b4e26c1f654066b68297dc3e509da65342b3549943
MD5 14a373dba3a0a378855c092c5d5f18e9
SHA1 d7dba6be35cad8b3194a5eba2d032e41ed9371e2
SHA512 ca7c77d95a434936948aa011605777cf9d88b51e4d264e585c35d73c485b0fbf126e3fd3695821ec679871c2d6abd17101dedd6125de950996d4ebecf45c11a5
SSDEEP 49152:YCLHGeeV5ijCmlDWDkv2g7pszrYQf2g93:jVVErYK2G3
TLSH
T168A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 5b869611014ad553f3b11f1b6e80c08836740b40a42d5a67e83f4f849e9e115f
MD5 5ebef6d83e3a6357aa891357af847112
SHA1 2b65ce98eb4757c8e442b6fb6c21962bae908fd7
SHA512 4fd2b510db6db389318e1887975291465f4024653c6a23d2737c2b05aa4f0b5cabb212f830cb66c473f1ef12110e5d7160a60a034c2764f5cfcd338d0a5f6b94
SSDEEP 12288:F1Hck6j5ZI7UuXBchr2oNdz7pklKWrYdrVPQeuZK0jggL30xPyaAIBVy3f3a:16DIdchr2eB7pszrYnQeqK0sgoAP3f3
TLSH
T19A05011D237A10F6D16BD03E85834101E6B2B87283225ADF1BD9D47A9F63FC9B938E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 c217219e30aa140fe6035be176a48b60d1f74e342de40529cee448f765006d4f
MD5 86ab7e2cb54680b8845070b2539102a5
SHA1 73c9d9e6c69bdd7a308872794e0e43154a3fab53
SHA512 ec8016b135d5d9932625400b2ed756db472ec798952296649f7c8f782020d9205c6d8325d66d91c8da429e8ad01540155259ca4b3353f80f6db8ccd009d3f81c
SSDEEP 12288:UG6ky+uXBchr2oNdz7pklKWrYdrVPQeuZK0jggL30xPyaAIBVy3f3a:Ftybchr2eB7pszrYnQeqK0sgoAP3f3
TLSH
T1D8F4120463A450C5F9BD823989678250EE36BC22973157EF26D2F93EAF317C6E970B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 57fad651b3463d192c2e2bbb4f02192b5b748c129357070f03cffd215ec84421
MD5 a9aa51c06c3d87d984507c19fb3012a0
SHA1 e650490789fd5bed457599f73d643f999d0b4169
SHA512 02aa246454ed33d5dfd15aefc6f9af3d501e3094fbc6219b708bbb7e4d8526fb21ad33e28ff6e85e47d492fc6053684e368418ba3e6b69473deb3476434aa71b
SSDEEP 12288:BxsuXBchr2oNdz7pklKWrYdrVPQeuZK0jggL30xPyaAIBVy3f3a:vpchr2eB7pszrYnQeqK0sgoAP3f3
TLSH
T153D42329626490C2E96CD63B001B8240F9767D3797365AFF3ADBA822D7153C7E6B4C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7d77b491c0f38e96456b543a19f08d107366b6a545af9998a995a05303c893cf
MD5 90d541bc5fe2888871d1cd331f4ea441
SHA1 2433df0b7d22a4d8a87aa5dcd709431760796c7d
SHA512 1c661212e3f6d46d5c24de59f3972af17805cecf70b804e4b435634d25b20aa7507ef6eb7ccc2403d9621dc62c0810bc5c1c074766760f8e5e5c12e8caa1ca1b
SSDEEP 24576:LbgnLoTfaidZAchr2eB7pszrYnQeqK0sgoAP3f3:XgcTrZT2g7pszrYQf2g93
TLSH
T105558C1D63EA05CAE2B2D239D8725493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-349-0x00007FF795F50000-0x00007FF796271000-memory.dmp

Download

memory/928-342-0x000001826F000000-0x000001826F066000-memory.dmp

Download

memory/928-341-0x00007FF795F50000-0x00007FF796271000-memory.dmp

Download

memory/928-343-0x000001826F000000-0x000001826F066000-memory.dmp

Download

memory/928-347-0x000001826F000000-0x000001826F066000-memory.dmp

Download

memory/1584-358-0x00007FF74CA40000-0x00007FF74CCCB000-memory.dmp

Download

memory/1584-354-0x000002621B1C0000-0x000002621B226000-memory.dmp

Download

memory/1584-353-0x000002621B1C0000-0x000002621B226000-memory.dmp

Download

memory/3120-367-0x00007FF6C0FD0000-0x00007FF6C14A1000-memory.dmp

Download

memory/3120-362-0x000002A8A1C80000-0x000002A8A1CE6000-memory.dmp

Download

memory/3120-363-0x000002A8A1C80000-0x000002A8A1CE6000-memory.dmp

Download

memory/3372-334-0x0000022888940000-0x00000228889A6000-memory.dmp

Download

memory/3372-333-0x0000022888940000-0x00000228889A6000-memory.dmp

Download

memory/3372-332-0x00007FF7D2EE0000-0x00007FF7D3075000-memory.dmp

Download

memory/3720-314-0x000002984E520000-0x000002984E586000-memory.dmp

Download

memory/3720-312-0x00007FF6DF9B0000-0x00007FF6DFA64000-memory.dmp

Download

memory/3720-313-0x000002984E520000-0x000002984E586000-memory.dmp

Download

memory/3780-1-0x0000000002E60000-0x0000000002EC9000-memory.dmp

Download

memory/3780-7-0x0000000002E60000-0x0000000002EC9000-memory.dmp

Download

memory/3780-6-0x0000000002E60000-0x0000000002EC9000-memory.dmp

Download

memory/3780-0-0x0000000000BD0000-0x0000000000D77000-memory.dmp

Download

memory/3780-26-0x0000000000BD0000-0x0000000000D77000-memory.dmp

Download

memory/4220-49-0x0000023800BD0000-0x0000023800C36000-memory.dmp

Download

memory/4220-47-0x00007FF620280000-0x00007FF6203E8000-memory.dmp

Download

memory/4220-48-0x0000023800BD0000-0x0000023800C36000-memory.dmp

Download

memory/4220-54-0x0000023800BD0000-0x0000023800C36000-memory.dmp

Download

memory/4220-56-0x00007FF620280000-0x00007FF6203E8000-memory.dmp

Download

memory/4220-288-0x00000229A6870000-0x00000229A68D6000-memory.dmp

Download

memory/4220-286-0x00007FF6DC970000-0x00007FF6DD0B4000-memory.dmp

Download

memory/4220-287-0x00000229A6870000-0x00000229A68D6000-memory.dmp

Download

memory/4376-16-0x000001B4EF460000-0x000001B4EF4C6000-memory.dmp

Download

memory/4376-17-0x000001B4EF460000-0x000001B4EF4C6000-memory.dmp

Download

memory/4376-65-0x00007FF676B90000-0x00007FF676CB3000-memory.dmp

Download

memory/4376-18-0x000001B4EF460000-0x000001B4EF4C6000-memory.dmp

Download

memory/4376-15-0x00007FF676B90000-0x00007FF676CB3000-memory.dmp

Download

memory/4396-268-0x000001FB21370000-0x000001FB213D6000-memory.dmp

Download

memory/4396-267-0x000001FB21370000-0x000001FB213D6000-memory.dmp

Download

memory/4396-352-0x00007FF6B30C0000-0x00007FF6B320A000-memory.dmp

Download

memory/4396-265-0x00007FF6B30C0000-0x00007FF6B320A000-memory.dmp

Download

memory/4636-294-0x00007FF738C60000-0x00007FF738D0E000-memory.dmp

Download

memory/4636-296-0x000001DF9E9D0000-0x000001DF9EA36000-memory.dmp

Download

memory/4636-295-0x000001DF9E9D0000-0x000001DF9EA36000-memory.dmp

Download

memory/4672-30-0x000002065A060000-0x000002065A0C6000-memory.dmp

Download

memory/4672-31-0x000002065A060000-0x000002065A0C6000-memory.dmp

Download

memory/4672-29-0x0000020659E10000-0x0000020659ED1000-memory.dmp

Download

memory/4672-32-0x000002065A060000-0x000002065A0C6000-memory.dmp

Download

memory/4676-238-0x000002B8F7540000-0x000002B8F75A6000-memory.dmp

Download

memory/4676-237-0x000002B8F7540000-0x000002B8F75A6000-memory.dmp

Download

memory/4676-322-0x00007FF7F37E0000-0x00007FF7F38A9000-memory.dmp

Download

memory/4676-236-0x00007FF7F37E0000-0x00007FF7F38A9000-memory.dmp

Download

memory/4788-275-0x00000000009F0000-0x0000000000A59000-memory.dmp

Download

memory/4788-280-0x00000000009F0000-0x0000000000A59000-memory.dmp

Download

memory/4788-361-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4788-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4936-59-0x000002197C990000-0x000002197CA51000-memory.dmp

Download

memory/4936-61-0x000002197CB30000-0x000002197CB96000-memory.dmp

Download

memory/4936-60-0x000002197CB30000-0x000002197CB96000-memory.dmp

Download

memory/5156-324-0x000001F9FCCF0000-0x000001F9FCD56000-memory.dmp

Download

memory/5156-325-0x000001F9FCCF0000-0x000001F9FCD56000-memory.dmp

Download

memory/5156-323-0x00007FF74DB60000-0x00007FF74DE03000-memory.dmp

Download

memory/5228-246-0x000002A1C94A0000-0x000002A1C9506000-memory.dmp

Download

memory/5228-245-0x00007FF7F37E0000-0x00007FF7F38A9000-memory.dmp

Download

memory/5228-247-0x000002A1C94A0000-0x000002A1C9506000-memory.dmp

Download

memory/5228-331-0x00007FF7F37E0000-0x00007FF7F38A9000-memory.dmp

Download

memory/5328-305-0x0000015318780000-0x00000153187E6000-memory.dmp

Download

memory/5328-303-0x00007FF7F7190000-0x00007FF7F75A7000-memory.dmp

Download

memory/5328-304-0x0000015318780000-0x00000153187E6000-memory.dmp

Download

memory/5368-253-0x00007FF7BD660000-0x00007FF7BD77A000-memory.dmp

Download

memory/5368-255-0x000002BA18640000-0x000002BA186A6000-memory.dmp

Download

memory/5368-254-0x000002BA18640000-0x000002BA186A6000-memory.dmp

Download

memory/5368-340-0x00007FF7BD660000-0x00007FF7BD77A000-memory.dmp

Download

memory/5596-39-0x0000025EF74A0000-0x0000025EF7506000-memory.dmp

Download

memory/5596-38-0x0000025EF72B0000-0x0000025EF7371000-memory.dmp

Download

memory/5596-41-0x0000025EF74A0000-0x0000025EF7506000-memory.dmp

Download

memory/5596-40-0x0000025EF74A0000-0x0000025EF7506000-memory.dmp

Download