933a3c3edec8bd6885281fb2f71531535c10dbbc3e1c2a4a0ddb3b7a6e242786

Analysis

max time kernel
145s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 859KB
Sample260804-hs8jsseh22
SHA256 933a3c3edec8bd6885281fb2f71531535c10dbbc3e1c2a4a0ddb3b7a6e242786
MD5 6518c549e5dfe54f37cf3458c25aef1d
SHA1 600e2592639a77f5f4f53d08331ccdd8580939ec
SHA512 4175b17f0e3acf8e090890bae5631fd61376a71b793e7d9f773cc0180c593ad7f4c97483712a9b65aab78b24395a32a86b36189e8a436e0cfe50b20664c94575
SSDEEP 24576:LxcVyzEd2SrGxcT7Jckdwi6i9bNrqq4E41WFpW3oRos:Ceg2Sr+O7Jckdwi3N7+WTW3
TLSH
T1FB15020175E58877E2B305324DB8AAB19AFD7D221831DE2F13D41A5D9E35680D63AF33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3948	alg.exe
1928	elevation_service.exe
3708	elevation_service.exe
4668	maintenanceservice.exe
1532	OSE.EXE
3088	GameInputSvc.exe
2080	GameInputSvc.exe
4508	msdtc.exe
4612	PerceptionSimulationService.exe
2972	perfhost.exe
1464	ReFsDedupSvc.exe
4512	locator.exe
720	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3967ad3e05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	GameInputSvc.exe
2080	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2944	2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3948	alg.exe
Token: SeDebugPrivilege	3948	alg.exe
Token: SeTakeOwnershipPrivilege	1928	elevation_service.exe
Token: SeTcbPrivilege	3088	GameInputSvc.exe
Token: SeBackupPrivilege	1464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1464	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2080	3088	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6518c549e5dfe54f37cf3458c25aef1d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2080

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1680

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4932

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3492

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9223a5bff089108db3c3ae3dbe105fbcfd0c08b8998b344c76a9e2fd1ce97b1b
MD5 a5f17a3190f4f61caf9524a09ba1513a
SHA1 2855d42eb51d3ac5aec02025eb7c0f6cb05e8f79
SHA512 df3b32c1e912f9e3f65f359f3dc115afea7a64e598627112b5ca14f7d8fa28f43e27f0c13fdc96369d613a3e79deb13d2b7d1eccf274bd778d71de8af12256f2
SSDEEP 49152:cOJ632BuPkFKRrdE6oh7stBhuXjfS4LWxn37Jckdwi3N7+WTW3:63q6gjBWPdwi3Q
TLSH
T1B8D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 35f79205cf642af8d17682637a1de27e35056cfb5a3097cd1841ae234bdfdf47
MD5 5e0bddc8666b17308997f95d77762ecb
SHA1 b6d531a7720555237345a5005229cf9d21b5054c
SHA512 0e0dc8541de405de2f54b6eba70e3114e68a689f2a7ccbc8b9a4f2f46e542f59d200ab77afec8fc52ea9a7e31f4189a92e83c1792d61f5dfb824da3ea2a0145f
SSDEEP 24576:hXYRDPczAkT7Jckdwi6i9bNrqq4E41WFpW3oRos:+Pcf7Jckdwi3N7+WTW3
TLSH
T13F050128A3E409F9ED678239C9B2C511EB7278514760FB8B03E496651F233D46E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 434db9c48a7b23cabf9ba4b5ebb443a687586a0bd789ee8ad86de43e11d83919
MD5 e151acd932443501d2f1874747ab17c7
SHA1 faa5e8634df931509bc18ac43f7d53cb4672241a
SHA512 4ed2fdaf589f4a303cf3654ec148acdb800c894d524fbd66f03535d8b1447b0e08ac3e0c320d998abac4295460cd8fd3ba2c2cabe27d135ec2290f9358e0b54f
SSDEEP 24576:Owu+OWBT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlO+7Jckdwi3N7+WTW3
TLSH
T11A05F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 60ad7802ce3a426908f775b9f29f860baf67f59a3da1c2a9ed79f1fad51e9989
MD5 638753d77be4c64ee7e69b73da297e97
SHA1 b86e5dea3e5b5a1930e0660d8001340ee8e37aca
SHA512 254342b19bbe58ff95b5982edc7d7f483bc69bd8154eced797b0efe892e1eb0ed556cf1ee9f1225f04253aade63ebc2e1c402d29a7c1a147d3e19d60aa645794
SSDEEP 49152:1x+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl37Jckdwi3N7+WTW3:Du6JmTxd2dNPdwi3Q
TLSH
T1E1D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 75685682ec326fc93f66ed83982c10a2d189a31aae9d33eaca4d732d45fe2514
MD5 e36b8d44eabcd6962b1633d092d0ac59
SHA1 5837a5129749944541b610e933547d8883b67124
SHA512 61518214d8529ccdc57f33b617e3c3b5e70528572e82af09583dae4eed7d7cd699a3590c9bba7e7ac3956fb04b75284f94b67d3be1a92d627162458c13ca8def
SSDEEP 12288:cK7aT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:7aT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T17CD42308C35D5A5BE277E231823DD264F66C3F523F54FA87974462A064293807FABF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d7d0e805f815c3308bc5e19813f27dccc0d4baab88a7e18d36089f496626136
MD5 2e3116d87c6b566abd674006b61c6956
SHA1 4a21d51f884323193ea2118cf2a79f932f60a92b
SHA512 e1321ca1da9681cd5fd64d09c1aa02a8422165c64be04fca4fcd1ada7e17aae86a41612879fac6a84a8916dba13051bd0529c1dae563f9b92b425818afc98b86
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYjDT7Jckdwi6i9bNrqq4E41WFpW3oRos:6gb4mBIBhGFuf7Jckdwi3N7+WTW3
TLSH
T1EC65AE1E22EC02F5E0FAE2B8CDAA4417D6B278161731D2DF1251426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 726d039b7caf37ffe790639461f994c4d94d60008ac76291a8abad2c2df199f7
MD5 c78a4a3c78ca385c9998cbd90bae5ee3
SHA1 b1d6f9c4914337e6bedecb2b57ea05509243f9cc
SHA512 21b56dd943f9966e96beab34e3f71e9d6bfa83184d58adea63decd4ceac95114c4dce40944c434e0b455fbe360c5013fde60b342c182fc6627f56518059b9de5
SSDEEP 12288:z+GIT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:qGIT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T11EE4230C62A635E9C637D231C53DE5A5F9B43A513B147AEF06D0A2749B293D0733EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 c68a0cb474a0a0bc7ece63fe8cf7577303a3e062b450c6135d72c864e690c5b3
MD5 c29d896189dd29758f8e9e0dda0c814c
SHA1 2fc3fb21e7d2cc4325d17dd15a8883d3f37f152e
SHA512 408fabc28eb8a63b3464dcf7c0796a6ce1af7b99ea89e40dd95148cb567edbe0ab32122bfeb4e1c61492adb61175c4aef2bd67584f365f9c8f920887fc4fff24
SSDEEP 12288:vZT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:vZT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T148D4234C825956ABD363E231833EE694FAA82B033B55BBC3469462A0515D3C077BFF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a3746f8d6bffc213637e73517fa43192cc6ccd5881b3a8e827376758fba91e40
MD5 d9338707e3e256f1f3e68e73f5e6bdea
SHA1 d09248590977ffc7276ea6bc575ae8cf9e98a5b5
SHA512 5d7d83490d707126ed80df904468d4678f05d458530644d7b3dfbcd2021528442e3bd9976be034305582b9c13ccdbed0fa65e5a687f395d1164f06a015a74215
SSDEEP 24576:EsM8T8FNJqH1vVria7/mIT7Jckdwi6i9bNrqq4E41WFpW3oRos:hrgFjqVMa7/V7Jckdwi3N7+WTW3
TLSH
T1A935F165A6E102F1D477D1388A9686A3F6B1B8211364FFDF07A88B511F236D01B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 bc248de16da23d26fa1ee2202cc2c39eedc3712ee7e47d04d168582aa9fba9d0
MD5 e40fb63305a5135cfe2375e9c097c8fc
SHA1 cac6b4345141bf253678c5778a95de41a7df33d1
SHA512 33933369f58842a6b68c7f94ae22cd1858860618d0eb6b6d38627a67794fac5cd5d427f3af8b1234be517d0570b8e517d39392ca2d93667cd5cdbb65307984ab
SSDEEP 24576:CPUr+NQGT7Jckdwi6i9bNrqq4E41WFpW3oRos:CJQc7Jckdwi3N7+WTW3
TLSH
T18305F11E62AC18E5E677E13D86968719F77178621712E2CF02E0817D4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a33ef43427f90f77cb967cb73985f9a36fcfa3b220fb78e2528faa88997c248f
MD5 86fbadf0eb1b35cc4b2e4a028f22ec54
SHA1 4d0319902afc9b14d4dcb17e428ff304309e0c67
SHA512 7aee0a1fe719282494f177eae28a4eb5633366c5822b5054ec1859c6e8d0c43de2dc669eb72579e93c685f17a95cfe617474a1117894e50c16380969f28d7908
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW7Jckdwi3N7+WTW3:8G05lO43btPdwi3Q
TLSH
T125D5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5239d5d410864d3f4f499f05d4e7c82835fdc2dab71b84e5f8d578f8cdfef77d
MD5 e9a82980eb7612de4f7a972cc1bc6c73
SHA1 67d35038cd196fede87f3c34b366a874045ec60e
SHA512 bcd8e7204f9525fe9bbd6e8d7e2b89f6fb022e0ee3c4f0a6af94f616e72a21da9c5ee90bcaec7e44046b969b0a040c19ac8cfb1b291d19e314c2e74ba7d77bac
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fky1T7Jckdwi6i9bNrqq4E41WFpW3oRos:wNc/zEOVHFtV7Jckdwi3N7+WTW3
TLSH
T19C858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 c0aa57f5e935d00f6e369f2f7054d364616ce0436fcfb42b5c07590f607ef4b8
MD5 7ef34adefbc19f822d1aadc92ede09f6
SHA1 ab5e0382d47ec0eb3c367b91774264ea75ca9c1a
SHA512 8ba18f18f52534cadd18ec607b73cbe75f3374090ddc46160f307b0d4d5890f10c6a3a2a341375029ce126c966e0387b23849992e3316579cf592420091ba346
SSDEEP 24576:iJnJPbzB4SZT7Jckdwi6i9bNrqq4E41WFpW3oRos:iJnJv6S57Jckdwi3N7+WTW3
TLSH
T17915E02CD2A810E9E4B7C2B4811A1799FF71386D2F2669C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ebec47575fed6409c475887fc66f0e350a186fdfa1257ef7067615a2fef0abf5
MD5 02efb0f77fbc4fedc3c1a40da54c0ce3
SHA1 310971add71d2cec104fe45deba2dc5dba4bf0b1
SHA512 0ca43454ddaa8af8da6da04c6143f229951063c2183eaee031bab27984e383f39a931fe3295e489a880e0e415996d1ad957c099165d4de479b3d168bc2b8e845
SSDEEP 49152:uCLHGeeV5ijCmlDWDkt7Jckdwi3N7+WTW3:FdPdwi3Q
TLSH
T1EFA56B05E7EB5184F8F3CAF5CA2694169A327C509B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 e87edc8039a36181ec1071c26443d6dea060ab7a6b5c505e625e7a3005e85202
MD5 42cdf07ee5d2761d7d8185ea99a8276c
SHA1 c7a7539cc00f3ce17b917a1801cb7f2b0b4478f3
SHA512 6974d1bd9a63210261c924a3f2ea0d7814e1743199838e3ab721a44eeda7dc93312090eb038f3a1536f7dd42ccc476d07f6a66a2cd9612cdc59e0f6d3fcf0845
SSDEEP 24576:D6DIVT7Jckdwi6i9bNrqq4E41WFpW3oRos:D6DI17Jckdwi3N7+WTW3
TLSH
T17FF4014C637A10FAD167D03EC2934551E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 a0a17d66fcf6d94ff7d4b3db8be009182b9db1b2d57718c7cb2df036855a4524
MD5 71cfda061f948cb3293fe37d37ae0f43
SHA1 558eac8c80c130cc9267a0aa7eb10bd99ba1a2cb
SHA512 9f19f703c5752a0e3328d2c55f5131522fd689c2236402681ecc1c8d62220f1da208fbda72713e515e5fbe3df83072490ee710fff49857b02d654ae06f70e1d1
SSDEEP 12288:BG6kyrT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:otyrT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T1DBF41208539861D9E6B69234C63682A4EF747C116B21A7CF46D0E33D2F3A7C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 bb7fe310208fa94ea9e031f1f1f47bf26dffed70051219d241716319ecb3d866
MD5 240fbdc29f750e2f18bdd36cd82a4354
SHA1 6300bad4af67ae0aeb2d6d5bc7b344a3222d939d
SHA512 f38f50282494ccc8cced47da11bda93ffc088036604bef08953e478fd1d1c7fef2a54d9fb634ed0ed11b22fdabc0cdbd4e4b673a43a03f0de8dc76edf6971529
SSDEEP 12288:wIBT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:zBT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1B4D4234C925926ABD653E231823DE7D4F6B43A223F167ADB46D4A2B0851D3C0377BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 6bda76e8bc0bd5934fea7b46eeb583843874d952dac254666e1e8c352a5b0f8a
MD5 caef933389fa86a5fa155436a21d784b
SHA1 39975d8683abb2afd112b7f3c44e1235c238f38a
SHA512 578fcbac168409fd3691fb4726f2684ca40041f489ad63f83296229c9015768d4fd1bf161166703294cf762eb879880414787481a64db665fc553b4c30a16f2d
SSDEEP 24576:mig+LoTfaidZXT7Jckdwi6i9bNrqq4E41WFpW3oRos:ZgdTrZD7Jckdwi3N7+WTW3
TLSH
T154559D1DA3EA05CAE2B2D235D9725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-302-0x00007FF70EB90000-0x00007FF70EFA6000-memory.dmp

Download

memory/720-304-0x0000025AF9060000-0x0000025AF90C6000-memory.dmp

Download

memory/720-303-0x0000025AF9060000-0x0000025AF90C6000-memory.dmp

Download

memory/824-361-0x000001B154610000-0x000001B154676000-memory.dmp

Download

memory/824-362-0x000001B154610000-0x000001B154676000-memory.dmp

Download

memory/824-367-0x00007FF613910000-0x00007FF613DE0000-memory.dmp

Download

memory/1464-287-0x000001687B0F0000-0x000001687B156000-memory.dmp

Download

memory/1464-366-0x00007FF664430000-0x00007FF664B73000-memory.dmp

Download

memory/1464-286-0x00007FF664430000-0x00007FF664B73000-memory.dmp

Download

memory/1464-285-0x000001687B0F0000-0x000001687B156000-memory.dmp

Download

memory/1532-59-0x000001E27EA10000-0x000001E27EB3C000-memory.dmp

Download

memory/1532-61-0x000001E27EC80000-0x000001E27ECE6000-memory.dmp

Download

memory/1532-60-0x000001E27EC80000-0x000001E27ECE6000-memory.dmp

Download

memory/1680-323-0x00007FF659D90000-0x00007FF65A032000-memory.dmp

Download

memory/1680-324-0x0000024927FC0000-0x0000024928026000-memory.dmp

Download

memory/1680-325-0x0000024927FC0000-0x0000024928026000-memory.dmp

Download

memory/1928-29-0x000001434A090000-0x000001434A0F6000-memory.dmp

Download

memory/1928-31-0x000001434A090000-0x000001434A0F6000-memory.dmp

Download

memory/1928-30-0x000001434A090000-0x000001434A0F6000-memory.dmp

Download

memory/1928-28-0x0000014349E90000-0x0000014349FBC000-memory.dmp

Download

memory/2080-245-0x00000255C9A50000-0x00000255C9AB6000-memory.dmp

Download

memory/2080-246-0x00000255C9A50000-0x00000255C9AB6000-memory.dmp

Download

memory/2080-244-0x00007FF62A900000-0x00007FF62A9C8000-memory.dmp

Download

memory/2080-322-0x00007FF62A900000-0x00007FF62A9C8000-memory.dmp

Download

memory/2944-0-0x00000000023B0000-0x00000000024A6000-memory.dmp

Download

memory/2944-6-0x0000000002640000-0x00000000026A9000-memory.dmp

Download

memory/2944-7-0x0000000002640000-0x00000000026A9000-memory.dmp

Download

memory/2944-1-0x0000000002640000-0x00000000026A9000-memory.dmp

Download

memory/2972-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2972-279-0x0000000000800000-0x0000000000869000-memory.dmp

Download

memory/2972-352-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2972-274-0x0000000000800000-0x0000000000869000-memory.dmp

Download

memory/3088-237-0x000002BC25390000-0x000002BC253F6000-memory.dmp

Download

memory/3088-311-0x00007FF62A900000-0x00007FF62A9C8000-memory.dmp

Download

memory/3088-235-0x00007FF62A900000-0x00007FF62A9C8000-memory.dmp

Download

memory/3088-236-0x000002BC25390000-0x000002BC253F6000-memory.dmp

Download

memory/3100-313-0x0000016521E40000-0x0000016521EA6000-memory.dmp

Download

memory/3100-314-0x0000016521E40000-0x0000016521EA6000-memory.dmp

Download

memory/3100-312-0x00007FF7D6E00000-0x00007FF7D6EB3000-memory.dmp

Download

memory/3492-343-0x00000219D2200000-0x00000219D2266000-memory.dmp

Download

memory/3492-349-0x00007FF7AC8E0000-0x00007FF7ACC00000-memory.dmp

Download

memory/3492-347-0x00000219D2200000-0x00000219D2266000-memory.dmp

Download

memory/3492-342-0x00000219D2200000-0x00000219D2266000-memory.dmp

Download

memory/3492-341-0x00007FF7AC8E0000-0x00007FF7ACC00000-memory.dmp

Download

memory/3708-39-0x0000019546C70000-0x0000019546CD6000-memory.dmp

Download

memory/3708-38-0x0000019546C70000-0x0000019546CD6000-memory.dmp

Download

memory/3708-37-0x0000019546A20000-0x0000019546B4C000-memory.dmp

Download

memory/3708-40-0x0000019546C70000-0x0000019546CD6000-memory.dmp

Download

memory/3948-18-0x000001C9D7860000-0x000001C9D78C6000-memory.dmp

Download

memory/3948-16-0x000001C9D7860000-0x000001C9D78C6000-memory.dmp

Download

memory/3948-17-0x000001C9D7860000-0x000001C9D78C6000-memory.dmp

Download

memory/3948-46-0x00007FF6110B0000-0x00007FF6111D2000-memory.dmp

Download

memory/3948-15-0x00007FF6110B0000-0x00007FF6111D2000-memory.dmp

Download

memory/4508-331-0x00007FF6974B0000-0x00007FF6975C9000-memory.dmp

Download

memory/4508-253-0x00000196171E0000-0x0000019617246000-memory.dmp

Download

memory/4508-254-0x00000196171E0000-0x0000019617246000-memory.dmp

Download

memory/4508-252-0x00007FF6974B0000-0x00007FF6975C9000-memory.dmp

Download

memory/4512-294-0x000002743A3A0000-0x000002743A406000-memory.dmp

Download

memory/4512-293-0x000002743A3A0000-0x000002743A406000-memory.dmp

Download

memory/4512-298-0x00007FF7B7F30000-0x00007FF7B7FDD000-memory.dmp

Download

memory/4612-264-0x00007FF6DA320000-0x00007FF6DA469000-memory.dmp

Download

memory/4612-266-0x000001A911920000-0x000001A911986000-memory.dmp

Download

memory/4612-340-0x00007FF6DA320000-0x00007FF6DA469000-memory.dmp

Download

memory/4612-267-0x000001A911920000-0x000001A911986000-memory.dmp

Download

memory/4668-54-0x0000027CD0490000-0x0000027CD04F6000-memory.dmp

Download

memory/4668-47-0x00007FF7E7600000-0x00007FF7E7767000-memory.dmp

Download

memory/4668-48-0x0000027CD0490000-0x0000027CD04F6000-memory.dmp

Download

memory/4668-49-0x0000027CD0490000-0x0000027CD04F6000-memory.dmp

Download

memory/4668-56-0x00007FF7E7600000-0x00007FF7E7767000-memory.dmp

Download

memory/4932-334-0x0000021641E40000-0x0000021641EA6000-memory.dmp

Download

memory/4932-333-0x0000021641E40000-0x0000021641EA6000-memory.dmp

Download

memory/4932-332-0x00007FF742380000-0x00007FF742514000-memory.dmp

Download

memory/5800-353-0x00007FF6109A0000-0x00007FF610C2A000-memory.dmp

Download

memory/5800-354-0x0000024AC2600000-0x0000024AC2666000-memory.dmp

Download

memory/5800-355-0x0000024AC2600000-0x0000024AC2666000-memory.dmp

Download