39be96b15d7aaaed67382a1d7a39b38bed859210845ad050d5d75276f06bec8e

Analysis

max time kernel
146s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 863KB
Sample260712-msq2zagt8p
SHA256 39be96b15d7aaaed67382a1d7a39b38bed859210845ad050d5d75276f06bec8e
MD5 fbd43007f267c139a64cfab1983777ef
SHA1 5ac045bece3bd358e41a415c9c6762c9244bb970
SHA512 e104b1fd5481fc4113a283a0b5ee875d1451950e9422678e8a6bfade585efedae22101b8c25e4a7850e4f10bba11f65ff57bc9c4015531b97201ef5f9591295f
SSDEEP 24576:bxcVyzUq2SrGxXW5hXSHg/ehHeRqh9zS:yeb2Sr+m3F/el4q
TLSH
T18915021176E1C872F2B319720DF99BA159BC78220C368E6F13D4191E8F71582E63AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
1380	alg.exe
3508	elevation_service.exe
2324	elevation_service.exe
4884	maintenanceservice.exe
2296	OSE.EXE
2752	GameInputSvc.exe
5720	GameInputSvc.exe
4200	msdtc.exe
5368	PerceptionSimulationService.exe
1988	perfhost.exe
3652	ReFsDedupSvc.exe
4552	locator.exe
2464	SensorDataService.exe
5600	snmptrap.exe
3436	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\517c36b8e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5720	GameInputSvc.exe
5720	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5816	2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1380	alg.exe
Token: SeDebugPrivilege	1380	alg.exe
Token: SeTakeOwnershipPrivilege	3508	elevation_service.exe
Token: SeTcbPrivilege	2752	GameInputSvc.exe
Token: SeBackupPrivilege	3652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3652	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5720	2752	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_fbd43007f267c139a64cfab1983777ef_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4200

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2464

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2988

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a738071107605c12e92c9ae62b857f132bd6e7d61a29b3c0feabe2be9efffbab
MD5 e4fd7df998c9a25bb1b23b5b9e3382d2
SHA1 051b3222ce8fd58ab61f20239c6c826c55015cad
SHA512 57d5e368df47fef0c11eb96ea1f6087435d3afbb28f8277e81639003f2ff4ef04e6dd0feb71ec7485dabe3eb5e4098284c421b2a91cccb82c5c384f89f0ef0a5
SSDEEP 49152:0we632BuPkFKRrdE6oh7stBhuXjfS4LWxnz3F/el4q:53q6gjBt5
TLSH
T18DD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 b0856e5d2daa1a34e83a43d77d25e67c5fb883bca9f967a9ba95aa83b1ee4473
MD5 170eb4400b24fbbb2c4e4a961bd35eb0
SHA1 535be7bd96b900bacfd5800b880554e1625730c4
SHA512 7cce425055eac1a9b283ec13207ee05f8db85f877bbae21b9c1c12984fb7df3eb4fef9fe3e285e6fe52aedd5eb6fd562fb8d41bc8f0d4c960120ca8c10abe987
SSDEEP 12288:T1XLsRre0x8VP5m2czA16j2Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODI:JXY9XcczAcjPW5hXSHg/ehHeRqh9zS
TLSH
T19F05022463E448F9ED67927DCDA28901E672785147A4F78F03F4992A0F332C96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 150315c2b5891e0e36ff289b6de9a20d8f285cd1d35450de09b8e238f0a358a5
MD5 820bdfef175e747fe9d2cb28d9a1cf30
SHA1 d37803f3eaad10756d91c061e6b093896511a760
SHA512 8414dc11e4b4143019c30fa94c8f099f88a4059d03a746c9b166b00145caadc1f8607b3002e94eb7515a6ad92091e0227d04edb9e7b48ca351d9bd0742972a64
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CliZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6Ok:QwuuOWAW5hXSHg/ehHeRqh9zS
TLSH
T1C405F18573E44CF9E56296398697C536F7F2B8022A25DB1F0360C65B5F33252BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e2fad49a1c78168bcbd086e9648e59c37ad453b8b2a5a59d5c25b42b01846ad3
MD5 a28424ea49964fa9844996604f358a9a
SHA1 ebaa712280b7d5fe69b3e4fd576436da928bc76e
SHA512 c990693c72bc7051742ba6150688562cd709ae02db4814222ec8728a653081d2a213c98ee36ead525bcc4ca8e63330a51e7045f2fe486a789bec837738518679
SSDEEP 49152:kr+taZ3usBWOBr4tEGp0bqx0z+n217aau1glY3F/el4q:Mu6JmTxd2d/5
TLSH
T145D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 0bd8dab19ef4dcd7377f045eda7a08b08638be77374b365af32611a95ee7dd49
MD5 41d6fafb7cbc3f27efabd309ddefafe2
SHA1 6bfec4ca7c329af4cf3296e01cf16b8a8def3245
SHA512 e34dcf623591a2ae01d0a4a3b8114d13adc4dd422a6739b6bc7e90cbf8c6bba9f6158954376cbf2fa288b60915fc9fa202fa45433cf51c7e3e2ecaa211dc1b6c
SSDEEP 12288:Rg7LZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:68W5hXSHg/ehHeRqh9zS
TLSH
T195D423C08398CC1AF260BEF14ABB8F14B51C74512FADA9CF132EA45A0A735C7BE5556C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 51f78daabc29097dee15771b0887131328150b5b5f28748cb9de7e4dd372941b
MD5 196d3f835f995d67ced3ac2e9c83b648
SHA1 521f7919a3da721de0c7640299e2a79fba9bb292
SHA512 0c8d4889bad8ba6c4f00c71aec8873a0249df27e5c061c10f6057809e0836c7e8e7682190f38d49fda1d1839ca318d13e105421f7191833265a99c00b291d50d
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYeW5hXSHg/ehHeRqh9zS:ygb4mBIBhGFq3F/el4q
TLSH
T19465AE1E22EC02F5E1F5E2B8CDAA4417D6B278161732D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 f944b4f236369f420fab91a3f4686ab0ea28bdbc2efa8cfdec75c624ba7edf50
MD5 97b1b302a4fa8a47c49e42a95ef69d3e
SHA1 f3c5eb9841d9ee2e6d9388fee984655fec73407f
SHA512 88ecb6dc2e1f40c3694b0adafe8feb450d61984c26f9d0acb05af410be2ecb95642012d3d1bcb6e630aa8ce959469e8d630f5b4fb395e4347f1616da8225bcba
SSDEEP 12288:XBGmZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:xGfW5hXSHg/ehHeRqh9zS
TLSH
T1FFE4239463E5D464D131EBB58AB38E46F4B430502F2D29EF02E9E43A4F725C3B639D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 1cfafc1621c0680c6d64e7ae16bd7f3ba4d725e0f4a5fbfcc6d0363919b34f77
MD5 d083c27262bb60c940e46e53870a6351
SHA1 c75ff3fe5797db6d0bd8ad816c5a6c5d27bf5835
SHA512 a2fab8cf82fafb5555aac572453f61cad88af95a70359db90bd5e292e9ae074dc33481976ed997966531724db6993c4806c53b5eb307ed0a2dbe5ca42ba20e21
SSDEEP 12288:TgZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:TJW5hXSHg/ehHeRqh9zS
TLSH
T1AFD423C08395CC16E250BEF54AB38F45B54874412FBE2ACF136EA41A0BB71C7BA755A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 be4ef3df2275fa0df3aee2e39adca16a0999667005a846f0151595b8935cd088
MD5 d4ab84299a17e284f7c4c9e8ab013204
SHA1 c8ab6d8e0c6e74bff72f15094461ab1f7b809497
SHA512 64fa86bcadcb3902da999a8fcc4dc21c19f0785ff62f6a48a23aba835bdc7b070aebe6385517eb444ca4be94ff132b7237eafda54f70820037159c13ba43aa0f
SSDEEP 24576:dOK8E8FpJqH1wQria7/mmFW5hXSHg/ehHeRqh9zS:Q5LFPqVoa7/Q3F/el4q
TLSH
T11B35F16167E101F1D077E1388A834A63F6B1B4251364EFDF07AC8A561F23AD65B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 767d0b4017e51543d830a24f1b38ca007527ef3934a83800ff55d4f2c469e9ed
MD5 439c2494dd202f49783902f99c2aba4d
SHA1 3e8b7e1cd13173969d4232a887b9b9934763ab2c
SHA512 a3477f73902e93f04d250f1d76313f78e08f30750da43277dfead6e1ddd92ce3a370588970b6dd34f95ca49cb02f78e9b5e08b7f6f626f9c4bbff794cbce3921
SSDEEP 12288:gHvUrBFrEjwaQPZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:gPUr+NQAW5hXSHg/ehHeRqh9zS
TLSH
T14B05F15E62E80CE5E676F17D8A828709F7717462171296CF02E1817E0F63AD9BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 95b84798a8c80ccb3c86258655245ea51edfac10af8ef51df51399987cb6582d
MD5 7eb8d5d8d19287839a02a0a6695520a1
SHA1 c3258b777f2414801e5d888bb2919e7518296606
SHA512 0e997f0ef278f470d897751192b9c4f2d5e306cfb51aa010201ca2b2947854b12ba51b25c10febc221d63f598c252066acaf6cbecfe3676ef57c5b49606ccf33
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJ3F/el4q:5G05lO43bx5
TLSH
T10CD5C06A62EC01F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF5A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2bf98e31307b68c767450e1a4ac67ffdaa7776f7607486e16122803a6b3adac6
MD5 04004773bc2137e3263b3dd23d5cd71b
SHA1 f002c7bdc8e700d5fbca707604fd8dcfa15489f6
SHA512 745b7868836094e9616591f2d71ef82736ba5a7f1a7cb5f3b43540cbbb4383961c231adc010a0cb1af32158563bd17f665781869e97bbce68015ad7e2b224e71
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FksqW5hXSHg/ehHeRqh9zS:INc/zEOVHFF3F/el4q
TLSH
T1E2858C1623E901E4F1BBE1BE89779946FA71786517348ACF0291811F1E73BE46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 c99e6b8a19ccdc56afd18734436e07cd846da04bea124037e00dcc20876c7e65
MD5 7f0edd572ace0f5995f55b8a4c96c1ba
SHA1 b86fcfe9cf7c0b402fed6f2f0c0b5cbc0f10c5da
SHA512 d951dc4eb09488be2546fb8d3a003674698d907b090f86e862a80241f3b0a67f3c7bf157377cf0846ee9e7185ea067ed12cf9d77d5869582be675ca21bc2d768
SSDEEP 12288:2QHPJnJP6szeCs6Rl28d7Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNl8:BJnJPbzB4SMW5hXSHg/ehHeRqh9zS
TLSH
T1DA15E06CD2A810E8E4B3D2B4815A1B5AFF31346D2F2669CB15B4D4353F12ED0BA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4a303fac67577bb6d163fc64fcadd07abc4b4d35f6cd138996ccff93489f406e
MD5 a38bd200598baf4c52e26ddb63bdd45d
SHA1 ffcf1d1095b280f5ec99bd49ef781eb97085f8e0
SHA512 d543cdd2f178f39cf72ba0d46914b2af7cbae962c4983b591228a80afec85e8266d59ad993c0c887456a4ff2973b69371426413de20a6a2dd26aaff4b6248563
SSDEEP 24576:hCLHGL0MoeVtFumTijCmlKQWDkjW5hXSHg/ehHeRqh9zS:hCLHGeeV5ijCmlDWDky3F/el4q
TLSH
T1E0A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 b507c9bfeaeedabd407be0d43a1bcbc9811d7d16ba1db20084010ab63712d380
MD5 cc737288bc656055881b3d03a5b8efa4
SHA1 2af1d0479eaf74f7894563e3ffe525c76372cad7
SHA512 b4687ef413b51ff5034ead3b9671e42e5719ddeb4006c5731f8058fc8707bfd079c4468199fe32a772ab21dff47e0679d24f6afc006695f01080e4ace559009f
SSDEEP 12288:XxHEk/j5ZI7kZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:b/DIJW5hXSHg/ehHeRqh9zS
TLSH
T12705015C637A40F9D167E07E86930502E2B1B0719B665ADF07A8C47E4FA3EC9B93CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 0b9f2e5a0ec09c360916f92c52d6d35038a7bcd57d06be1792fd62780ce86768
MD5 1a3531c1821548de9aeecdf46a78d728
SHA1 090ac6daa6a477e89a37ebbdfc43e41e6fdbe397
SHA512 ed52fb18e1db8f500e9b2aaa2e9e61ce9e1da64b5828e717ca05eaf9cc9a43169ca40475e31002ad1706e164561f6d5245e7e502f8f15c5fc5c9304c15db12de
SSDEEP 12288:NG6kyZnZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0tyZYW5hXSHg/ehHeRqh9zS
TLSH
T124F412405394D495F2706AB88AB38694EA38BC206F6667CF12A5E53F1F377C6BD30B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 525b1c1e51ca79db273cc6b9b56aa3e9351c3b3dd4d1a9f71a53e6bb10744947
MD5 7b9e54d8afeb89c650c148eeb61adc5c
SHA1 9bd591f67619c774ac459789829cb6b07c751b9d
SHA512 a2eafc3ea5fa0bee3231b392558935bf933f406a2bbde77b6cc39a2ad43b16666fa95f1b17d2eb30a7a38230458611bfb25cd07192ddea60e5df979086b4645d
SSDEEP 12288:duJZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0CW5hXSHg/ehHeRqh9zS
TLSH
T186D423C093A5C825E110BEF546A34F45E16870612FAF29DF13ADE83A4FB70C3BA75958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 412f0ecfad1eeb17b3b0bcffb48fe35bb77801044ba7903ad5de0cb8538ad70c
MD5 da8ca0d47fa9572697c55a866a06201a
SHA1 e85b039869aa5e007967fe5811e1c56e09ee2a21
SHA512 eb52e6d3dcc2147f1d4a3e560795f111ccc597d06784e29f64bcb1234ec53eb2583a67862d344ad84622d1975ce1a53711a9cd1d5d251f71e261a8cf6bd42636
SSDEEP 12288:nlgl/ZyFDK3tT5Tr7aVLIH9lH3cnlZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDuL:nlglsoTfaidZxW5hXSHg/ehHeRqh9zS
TLSH
T1DC558C1D63EA09CAE2B2D675D9721493D633B4311772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-64-0x00007FF7E0F90000-0x00007FF7E10B3000-memory.dmp

Download

memory/1380-18-0x000001FAE2250000-0x000001FAE22B6000-memory.dmp

Download

memory/1380-15-0x00007FF7E0F90000-0x00007FF7E10B3000-memory.dmp

Download

memory/1380-17-0x000001FAE2250000-0x000001FAE22B6000-memory.dmp

Download

memory/1380-16-0x000001FAE2250000-0x000001FAE22B6000-memory.dmp

Download

memory/1988-279-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/1988-274-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/1988-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1988-352-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2296-59-0x00000252E8440000-0x00000252E84A6000-memory.dmp

Download

memory/2296-58-0x00000252E8510000-0x00000252E8658000-memory.dmp

Download

memory/2296-60-0x00000252E8440000-0x00000252E84A6000-memory.dmp

Download

memory/2324-40-0x000002053E6F0000-0x000002053E756000-memory.dmp

Download

memory/2324-38-0x000002053E6F0000-0x000002053E756000-memory.dmp

Download

memory/2324-37-0x000002053E480000-0x000002053E5C8000-memory.dmp

Download

memory/2324-39-0x000002053E6F0000-0x000002053E756000-memory.dmp

Download

memory/2464-304-0x0000024DB8730000-0x0000024DB8796000-memory.dmp

Download

memory/2464-302-0x00007FF6B1150000-0x00007FF6B1567000-memory.dmp

Download

memory/2464-303-0x0000024DB8730000-0x0000024DB8796000-memory.dmp

Download

memory/2752-237-0x000002358B6F0000-0x000002358B756000-memory.dmp

Download

memory/2752-311-0x00007FF65B2D0000-0x00007FF65B399000-memory.dmp

Download

memory/2752-236-0x000002358B6F0000-0x000002358B756000-memory.dmp

Download

memory/2752-235-0x00007FF65B2D0000-0x00007FF65B399000-memory.dmp

Download

memory/2988-343-0x00007FF7E3710000-0x00007FF7E3A31000-memory.dmp

Download

memory/2988-349-0x00007FF7E3710000-0x00007FF7E3A31000-memory.dmp

Download

memory/2988-342-0x0000022BCA040000-0x0000022BCA0A6000-memory.dmp

Download

memory/2988-341-0x0000022BCA040000-0x0000022BCA0A6000-memory.dmp

Download

memory/2988-347-0x0000022BCA040000-0x0000022BCA0A6000-memory.dmp

Download

memory/3244-363-0x00007FF624A20000-0x00007FF624EF1000-memory.dmp

Download

memory/3244-362-0x00000225DBE50000-0x00000225DBEB6000-memory.dmp

Download

memory/3244-364-0x00000225DBE50000-0x00000225DBEB6000-memory.dmp

Download

memory/3436-325-0x00000249FA840000-0x00000249FA8A6000-memory.dmp

Download

memory/3436-324-0x00000249FA840000-0x00000249FA8A6000-memory.dmp

Download

memory/3436-323-0x00007FF787E10000-0x00007FF7880B3000-memory.dmp

Download

memory/3508-30-0x0000028D3A5C0000-0x0000028D3A626000-memory.dmp

Download

memory/3508-31-0x0000028D3A5C0000-0x0000028D3A626000-memory.dmp

Download

memory/3508-28-0x0000028D3A470000-0x0000028D3A5B8000-memory.dmp

Download

memory/3508-29-0x0000028D3A5C0000-0x0000028D3A626000-memory.dmp

Download

memory/3652-286-0x000002D409970000-0x000002D4099D6000-memory.dmp

Download

memory/3652-361-0x00007FF750B50000-0x00007FF751294000-memory.dmp

Download

memory/3652-285-0x000002D409970000-0x000002D4099D6000-memory.dmp

Download

memory/3652-294-0x00007FF750B50000-0x00007FF751294000-memory.dmp

Download

memory/4200-254-0x00000277DBE80000-0x00000277DBEE6000-memory.dmp

Download

memory/4200-252-0x00007FF63C980000-0x00007FF63CA9A000-memory.dmp

Download

memory/4200-253-0x00000277DBE80000-0x00000277DBEE6000-memory.dmp

Download

memory/4200-331-0x00007FF63C980000-0x00007FF63CA9A000-memory.dmp

Download

memory/4324-332-0x00007FF6F8100000-0x00007FF6F8295000-memory.dmp

Download

memory/4324-334-0x000001539F260000-0x000001539F2C6000-memory.dmp

Download

memory/4324-333-0x000001539F260000-0x000001539F2C6000-memory.dmp

Download

memory/4428-354-0x000001F9305B0000-0x000001F930616000-memory.dmp

Download

memory/4428-353-0x00007FF6D6500000-0x00007FF6D678B000-memory.dmp

Download

memory/4428-355-0x000001F9305B0000-0x000001F930616000-memory.dmp

Download

memory/4552-292-0x0000026947740000-0x00000269477A6000-memory.dmp

Download

memory/4552-293-0x0000026947740000-0x00000269477A6000-memory.dmp

Download

memory/4552-295-0x00007FF7D1AB0000-0x00007FF7D1B5E000-memory.dmp

Download

memory/4884-47-0x0000022BB0520000-0x0000022BB0586000-memory.dmp

Download

memory/4884-55-0x00007FF79ECF0000-0x00007FF79EE58000-memory.dmp

Download

memory/4884-53-0x0000022BB0520000-0x0000022BB0586000-memory.dmp

Download

memory/4884-48-0x0000022BB0520000-0x0000022BB0586000-memory.dmp

Download

memory/4884-46-0x00007FF79ECF0000-0x00007FF79EE58000-memory.dmp

Download

memory/5368-267-0x0000028AF9F00000-0x0000028AF9F66000-memory.dmp

Download

memory/5368-340-0x00007FF6762A0000-0x00007FF6763EA000-memory.dmp

Download

memory/5368-266-0x0000028AF9F00000-0x0000028AF9F66000-memory.dmp

Download

memory/5368-264-0x00007FF6762A0000-0x00007FF6763EA000-memory.dmp

Download

memory/5600-313-0x0000023311D10000-0x0000023311D76000-memory.dmp

Download

memory/5600-312-0x00007FF6B06F0000-0x00007FF6B07A4000-memory.dmp

Download

memory/5600-314-0x0000023311D10000-0x0000023311D76000-memory.dmp

Download

memory/5720-245-0x0000011E7FC40000-0x0000011E7FCA6000-memory.dmp

Download

memory/5720-246-0x0000011E7FC40000-0x0000011E7FCA6000-memory.dmp

Download

memory/5720-244-0x00007FF65B2D0000-0x00007FF65B399000-memory.dmp

Download

memory/5720-322-0x00007FF65B2D0000-0x00007FF65B399000-memory.dmp

Download

memory/5816-0-0x0000000002660000-0x000000000273F000-memory.dmp

Download

memory/5816-2-0x0000000002840000-0x00000000028A9000-memory.dmp

Download

memory/5816-7-0x0000000002840000-0x00000000028A9000-memory.dmp

Download

memory/5816-6-0x0000000002840000-0x00000000028A9000-memory.dmp

Download