e46d73cf8f31e40ca930345e6d33503cc0a1b471f410dc527ba51221c11e5707

Analysis

max time kernel
146s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 859KB
Sample260806-bxcjlafb49
SHA256 e46d73cf8f31e40ca930345e6d33503cc0a1b471f410dc527ba51221c11e5707
MD5 6fd7c53b22612571744131c3b4ec2d6d
SHA1 ed2a652303234378df38b2b7c8e641182a65b219
SHA512 0e2853a6d923c9bb7ad44e436395e4d9e1716162247efa2361cb92514fa7a0afe8b7c25579a7aef6638346fdbefe44bd9c1d8459e29bc8f603b44562d54a06b3
SSDEEP 24576:LxcVyzMz2SrGxdI8cbWhVS6QFQmM7OlgcVP576z:Cem2Sr+SBAE3MHcVha
TLSH
T18815011276A18873F6B305720DB99AA299BDBD320432CE7F13C00A5D9E35991D639F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
3648	alg.exe
2520	elevation_service.exe
3904	elevation_service.exe
2900	maintenanceservice.exe
2976	OSE.EXE
1956	GameInputSvc.exe
3396	GameInputSvc.exe
464	msdtc.exe
4584	PerceptionSimulationService.exe
4512	perfhost.exe
4336	ReFsDedupSvc.exe
4100	locator.exe
1912	SensorDataService.exe
3756	snmptrap.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b85478d8763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	GameInputSvc.exe
3396	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3648	alg.exe
Token: SeDebugPrivilege	3648	alg.exe
Token: SeTakeOwnershipPrivilege	2520	elevation_service.exe
Token: SeTcbPrivilege	1956	GameInputSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3396	1956	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_6fd7c53b22612571744131c3b4ec2d6d_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4272

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2904

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4688

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b310883205bddec41f9b10c4c4596219e839089fc2dff3b918e39431081dbda2
MD5 0476ee878ee883ca00ac83439ba799a1
SHA1 d8a1711951d6aacb396fc1e5cad5bde91df74362
SHA512 c49b609c68460cdf46553ecb35157c124f89b7b6befa262d4dd293b0373fdcc8b1ba91158b6a8447e7067084b60536bef1f3132f16b4ea35b1fb8065e8805e0d
SSDEEP 49152:Bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnkBAE3MHcVha:H3q6gjBbl3M8Vg
TLSH
T1B1D59D03F29900E9E06AD178D74A9133E9A2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 ebe7f7a968db1818deb54f479955c60fd408ed887190970a856a67caead0e07e
MD5 c4919f29a46676c912d9f24ae3286c7e
SHA1 6664ad4b52464820cebe5b4ace9b2ea11891c892
SHA512 e8867d1618df50b9e6543f2acfc2be816eeaa763e405501f6848f8bb2e210ae60d92f5ba01830dfd795383c2abb525b3bb33aeacb12275799283811e8826919a
SSDEEP 24576:OXYLDtczA8I8cbWhVS6QFQmM7OlgcVP576z:dtcWBAE3MHcVha
TLSH
T16C050229B3A008F9EC57817DCCB68502E673BC564364EB8B03E486695F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 99492332db04e5d8742c2cb903315b0eab8fe24ec92dbf88a799598b57fd99b8
MD5 75ac6fe7c8624fa8d2d02d4093208714
SHA1 89d3bbf87bb7d9f1aa031b93be485f2156b35208
SHA512 5776695edb6d267fa5f028c37ea90374b65247705b1c2593cc423fc22bfc14b528e71a1151625a0f0dae785d0998517941d857beb9ae33881d79a0029ba222e7
SSDEEP 24576:Owu+OW5I8cbWhVS6QFQmM7OlgcVP576z:OwlOJBAE3MHcVha
TLSH
T17805F14673A40CF9E9578139859B8136F7F3BC122A25DB1F07A0C75A6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ceb2453356706af0b59c25d9469a3afc0e1068afd7cb5c317e1eb7c67ef1d62a
MD5 fc33968201b0d4eb92d47ca28ba4d245
SHA1 297edf39f5af1d7530811c51ba1a653889ad1d0a
SHA512 3c664184b7db219ff61101038f2a1554a0f9d89e84ac26a325c8bfe0d78d228f8c84e13ee1ccfc2872990192093e90b5a3a9d1838f89d9c7c16c393a4c761700
SSDEEP 49152:RB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gllBAE3MHcVha:Hu6JmTxd2dll3M8Vg
TLSH
T153D59D13F2DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 415d84a7287f704d88046a20f121be79a102b03f2f89d28beb47aa69bf310dbb
MD5 c203d5c4ec1ed38e4fda0a3b2c4c8cd8
SHA1 6cbb9561e442f3dffbd79eec72a76408a933b8e3
SHA512 4c52d8b90a74d344c7316852dbb4bb6317f8093d161be37d24e864710b7c27744e4f98687b2c0fb343963bfef1f4806b03140f8b258eee661908bcdd854b441a
SSDEEP 12288:cG7UfIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:XsI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1F6D42262C3254972F40A51F5086F4007A07BFEB7471ADE979A8183CCB93ACC5ADB8B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 01de5f54220ae26984a16a07cae400f316fc52135c98bfcf2e4fed69c4788be0
MD5 9a16f83dac3d848f6e4b563287493e68
SHA1 1b82c1c20b164fd4ace2a596172592824c688060
SHA512 709fc1b3f795d3ff0706786bfb063012ef16e0bbd1885dc6c272443bba4ca25957af612966acdbc1e110f3c0c6a7c59c2359a7f40c1976f2ef6d2f4776234a4a
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYbI8cbWhVS6QFQmM7OlgcVP576z:qgb4mBIBhGF3BAE3MHcVha
TLSH
T1C565AF1E22E802F5E0FAD2B8DDAA4417D6B378160332D6DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 e545f196eba109e7f6c27b388dc3e0cd8495e31377efe7300243c96c182c3006
MD5 99634b82cd4fa2203831e36900c073d1
SHA1 d91066b8c07872336aa79bf041c10b2ab1abc8b9
SHA512 c3a2a2ae261c1f5c13cd92e549accf9d6425de1c7b239cc4b512e8b1c0220a7324cc879865446af67f28f7d22d1459c2b9145c53c1c59777dd959966115a7964
SSDEEP 12288:1YGYNIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:CGqI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T156E42369A26521F1D41B82B9447E5047F0B2B9B243166EEF06C1C3BCAF36CE1667CE58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 52cb2d2f281383d9a86648752902123b34a8c20b552a5f871aabe5f912ad2806
MD5 f2bc0a19c49896352f1f5d45b0e993f1
SHA1 46ec9633eb5cdf0483d8dc2d2b5ce082931f85e4
SHA512 8714c7ec366423fd8196d653c27edc2532d26363e346037ac2bfea61b064c64c50d01a26553abd108f2dec6acbe30555033d3de5544961eb371d369fd3440bac
SSDEEP 12288:mGzIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:meI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T163D423A1D31545B2E40A51FA056F0047E066FEB3432B9FD756C183CCB93BCDAA5BCA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8fc286f5e9c83c7bd8c17a044ac5585cbfc0bb2ebeba8f9bc1d961ed37299ffb
MD5 b8abf22a4bdb8e8719f2f76dc9da39c2
SHA1 2e559b39fcd2a3f2c879ad954a6dada3e03f0612
SHA512 643f1a1758fccdb1e84f16b9a093fb636df799fb3f78fcde9dc01dc8adf92b851fa52dd0a4d471bc876b53b5dfb4eb5531d0970e89de9e73062d7dadc804ecaf
SSDEEP 24576:rDe8K8sEJqH1Mzria7/mTI8cbWhVS6QFQmM7OlgcVP576z:3dtscqVra7/LBAE3MHcVha
TLSH
T13235F165B3E101F1D47BD13889864663F6B2B8250324EFDF07A88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6a0cdebc13f36cc11b0885410760e3502193734132650b5787ff0ef244af836b
MD5 91e07090f4a1b07d26f2a2bfec1a72c2
SHA1 75c193f406c5cc7fcb2eab1bed3b757f5c769a68
SHA512 93d6357938af4436b471bf0b54bc2c3eb9deea88450c672f986f207633fc51f4cc4eaad48e8774876f94734b4edca7990ac488cd8fecc8ff39a4a5fa06c573f5
SSDEEP 24576:IPUr+NQaI8cbWhVS6QFQmM7OlgcVP576z:IJQFBAE3MHcVha
TLSH
T1A705F12F62A918F5E676E17D89864609F372B8620312D6CF02D0817E5F27DE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f3acdbed167901c266864e72c92cca0ff15fd23817dde6980b43af3677e96436
MD5 851c3ee169ee812dad8e239d60faa9ce
SHA1 7ae13712b95eeeb99325f601ce212509f1b96a34
SHA512 44a5cad6aa4769f0f4ced08006f80404b26f888821a1717000961281bbe445ba1838baee4465f93d0b6b32ffb18b069698c2c9d01179c0c761eb8fa435f0ff70
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpBAE3MHcVha:wG05lO43bUl3M8Vg
TLSH
T16ED5CF6A62EC11F5D0BBD17CDAC6460BEBB23825033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bd2d2f0e203d367b0122cc630ac92ce1cfc440b7486803e02bd4cb3dc526e87b
MD5 015c276e706c0be8bf5080e4186981c5
SHA1 52035a5ed154a6eeee4224498498ea759b56b936
SHA512 6217367983b3575e977ab842312c4b25e26518de41206e6e7f9e8eb4c152b4d084e40cf761adbd45c043711d68334bb0af70df6768c13a8612f7b5df71b87099
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fk9I8cbWhVS6QFQmM7OlgcVP576z:ENc/zEOVHFFBAE3MHcVha
TLSH
T135857B1623E901E4F5BBE1BE897B9546FAB1786513348ACF0291811E1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 e9ace7f5b220b6571cc0486e8dc964a99bc12b14f4c3733149575ffe0aafb1e2
MD5 b7cf4f7dffe466858a39d6a512acd0a8
SHA1 01a0041544041e340cfd00aff93580c99401aacb
SHA512 53cdea5b05bd5e289cdf0edad56c820b4b47292e634d6ac2530c37a7ca52b31958c0257d42d45a30cb389f533cbbb0a487264b6db6bd19d2c9416aa7e908810e
SSDEEP 24576:9JnJPbzB4SmI8cbWhVS6QFQmM7OlgcVP576z:9JnJv6S5BAE3MHcVha
TLSH
T16D15E03DD2A810E4E4B7C2B4815A175AFE31387D2B266DC719B4D5343F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e04a4017f27e4a165886f16ce4b5c8b633af9ede9a09b1c8b3e38b83af35af82
MD5 d815f66a15b292dea1ad322bd9fcabb5
SHA1 a15e20035b3bd27bf21849de1da6c97b81161330
SHA512 b3ba776aa28f271a2a4425e8e782477d4e8a03ddc1568139d1074bff735e8f484e8776e7a32f5a47a03a2114ed59ece49620550e373098aac31a19220e7427f1
SSDEEP 24576:aCLHGL0MoeVtFumTijCmlKQWDkNI8cbWhVS6QFQmM7OlgcVP576z:aCLHGeeV5ijCmlDWDkCBAE3MHcVha
TLSH
T1DEA56B05E7EB4184E8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 cd7d152194000c34566858c2d86a8c626963e4319a635c69863b459fd8022910
MD5 ead732453215e37becda6dbd8678704b
SHA1 b95fe6084b32cf616bd99e6b8facf4170badbeaf
SHA512 ced54840c7e3f6d8d2a125e600f32a1d7a59e717d603c4f50ac3ff0d24df08e880fcc335c3da274d6e9789eedd2f028a2462ba43fad5e1e95bce51f9c92ef0c9
SSDEEP 12288:01Hck6j5ZI7uIIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb778:c6DISII8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1C3F4F15D633A10F6D05BD07E86970102E1B2B5B183265ADF0BD4C6BD9EA3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 b1261ef88f4a10b9cd91e7d4b3971b0304db8421c1a398b277f7a99b0f2526a6
MD5 21225bf99df0227610d3f0476afcca7a
SHA1 18a53044370af16a027e5278d480a32396ae4e49
SHA512 2c612011378c892d2e6239cbc901288b958c54baac5726f52d49ea2be0b11f0c30183ab7cce6618822cd0dffc421aff29bf6cf62cab95a60bbbd1bfed97ee1ca
SSDEEP 12288:BG6kywRIghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:otyCI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1E2F41205A35420E1F96A02B88A7B4192DA36FC3147229BDF16C0D37D7F36ED4A938F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 3de4fc866ba60ecb2508c1c06234f8fe9e48053ea49d1a6f4cfcf21c72de03f5
MD5 b23a8dc8f138a409837c3686d1ae3cc5
SHA1 6df29232f17aff7bd4707284b3fb319a94e95dda
SHA512 5287f41eb8bd84da99785400a0e8048f36ae8f1c71ae4c00642004a1ebba1855d80d33c28f426eb2f340d1ed165321dd44d68fd785e99e0b81f4a8ed67842503
SSDEEP 12288:ymC+IghFDxBIY0+2NchRvfSYxQtoYwNIlVubDY8FLg/d5wibScVb77F0J+6z:HbI8cbWhVS6QFQmM7OlgcVP576z
TLSH
T1BED423A9D32111B2E40651BA056F0547E076F9B3032B9EEB5AC1C3BCAE3BCD56578F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 eebb81ade5e8e3e3e21a87ef7a7a1a0c28ef2c80ef3a464933b3fa088be4c070
MD5 2fa057d93cdf294e1759256919cf2ecd
SHA1 2bfef972d311b40a1ac2124819f7d3e1db7de6a2
SHA512 a7142fa07fcb67259f072d4c7a626a6d0202e26588459b3661a8ac743bd5ceba65271e5d5f11e5da1e284ec596196efa59444b3463c085cf75acd5f6b091edc2
SSDEEP 24576:k6gPLoTfaidZzI8cbWhVS6QFQmM7OlgcVP576z:LgUTrZ8BAE3MHcVha
TLSH
T1C8559D1DA3EA05DAE2B2D275D8721493D633B4315372D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-253-0x000001FC77310000-0x000001FC77376000-memory.dmp

Download

memory/464-252-0x00007FF689E00000-0x00007FF689F19000-memory.dmp

Download

memory/464-339-0x00007FF689E00000-0x00007FF689F19000-memory.dmp

Download

memory/464-254-0x000001FC77310000-0x000001FC77376000-memory.dmp

Download

memory/1912-307-0x00007FF62E6A0000-0x00007FF62EAB6000-memory.dmp

Download

memory/1912-302-0x000001545D8F0000-0x000001545D956000-memory.dmp

Download

memory/1912-303-0x000001545D8F0000-0x000001545D956000-memory.dmp

Download

memory/1956-237-0x000001BBA4590000-0x000001BBA45F6000-memory.dmp

Download

memory/1956-321-0x00007FF7C8830000-0x00007FF7C88F8000-memory.dmp

Download

memory/1956-235-0x00007FF7C8830000-0x00007FF7C88F8000-memory.dmp

Download

memory/1956-236-0x000001BBA4590000-0x000001BBA45F6000-memory.dmp

Download

memory/2520-28-0x00000257D55E0000-0x00000257D572F000-memory.dmp

Download

memory/2520-31-0x00000257D5850000-0x00000257D58B6000-memory.dmp

Download

memory/2520-30-0x00000257D5850000-0x00000257D58B6000-memory.dmp

Download

memory/2520-29-0x00000257D5850000-0x00000257D58B6000-memory.dmp

Download

memory/2568-352-0x000001A539800000-0x000001A539866000-memory.dmp

Download

memory/2568-353-0x000001A539800000-0x000001A539866000-memory.dmp

Download

memory/2568-351-0x00007FF7BF840000-0x00007FF7BFACA000-memory.dmp

Download

memory/2900-47-0x000001C224B90000-0x000001C224BF6000-memory.dmp

Download

memory/2900-48-0x000001C224B90000-0x000001C224BF6000-memory.dmp

Download

memory/2900-53-0x000001C224B90000-0x000001C224BF6000-memory.dmp

Download

memory/2900-55-0x00007FF6D4490000-0x00007FF6D45F7000-memory.dmp

Download

memory/2900-46-0x00007FF6D4490000-0x00007FF6D45F7000-memory.dmp

Download

memory/2904-341-0x000001716D510000-0x000001716D576000-memory.dmp

Download

memory/2904-347-0x00007FF7C2600000-0x00007FF7C2920000-memory.dmp

Download

memory/2904-345-0x000001716D510000-0x000001716D576000-memory.dmp

Download

memory/2904-340-0x000001716D510000-0x000001716D576000-memory.dmp

Download

memory/2976-58-0x0000013101120000-0x000001310126F000-memory.dmp

Download

memory/2976-59-0x0000013101390000-0x00000131013F6000-memory.dmp

Download

memory/2976-60-0x0000013101390000-0x00000131013F6000-memory.dmp

Download

memory/3112-333-0x0000027299150000-0x00000272991B6000-memory.dmp

Download

memory/3112-332-0x0000027299150000-0x00000272991B6000-memory.dmp

Download

memory/3112-331-0x00007FF7584D0000-0x00007FF758664000-memory.dmp

Download

memory/3396-330-0x00007FF7C8830000-0x00007FF7C88F8000-memory.dmp

Download

memory/3396-245-0x000002940FAD0000-0x000002940FB36000-memory.dmp

Download

memory/3396-244-0x00007FF7C8830000-0x00007FF7C88F8000-memory.dmp

Download

memory/3396-246-0x000002940FAD0000-0x000002940FB36000-memory.dmp

Download

memory/3648-16-0x0000019FCD690000-0x0000019FCD6F6000-memory.dmp

Download

memory/3648-18-0x0000019FCD690000-0x0000019FCD6F6000-memory.dmp

Download

memory/3648-17-0x0000019FCD690000-0x0000019FCD6F6000-memory.dmp

Download

memory/3648-15-0x00007FF652790000-0x00007FF6528B2000-memory.dmp

Download

memory/3648-64-0x00007FF652790000-0x00007FF6528B2000-memory.dmp

Download

memory/3756-312-0x0000022BBA030000-0x0000022BBA096000-memory.dmp

Download

memory/3756-311-0x00007FF6B07E0000-0x00007FF6B0893000-memory.dmp

Download

memory/3756-313-0x0000022BBA030000-0x0000022BBA096000-memory.dmp

Download

memory/3904-38-0x0000016DFDBF0000-0x0000016DFDC56000-memory.dmp

Download

memory/3904-39-0x0000016DFDBF0000-0x0000016DFDC56000-memory.dmp

Download

memory/3904-40-0x0000016DFDBF0000-0x0000016DFDC56000-memory.dmp

Download

memory/3904-37-0x0000016DFD980000-0x0000016DFDACF000-memory.dmp

Download

memory/4100-293-0x00007FF6BA070000-0x00007FF6BA11D000-memory.dmp

Download

memory/4100-294-0x0000023416020000-0x0000023416086000-memory.dmp

Download

memory/4100-295-0x0000023416020000-0x0000023416086000-memory.dmp

Download

memory/4272-322-0x00007FF7FC970000-0x00007FF7FCC12000-memory.dmp

Download

memory/4272-324-0x0000024447F70000-0x0000024447FD6000-memory.dmp

Download

memory/4272-323-0x0000024447F70000-0x0000024447FD6000-memory.dmp

Download

memory/4336-285-0x000001C4572A0000-0x000001C457306000-memory.dmp

Download

memory/4336-286-0x000001C4572A0000-0x000001C457306000-memory.dmp

Download

memory/4336-287-0x00007FF6E3640000-0x00007FF6E3D83000-memory.dmp

Download

memory/4512-1-0x00000000030C0000-0x0000000003129000-memory.dmp

Download

memory/4512-7-0x00000000030C0000-0x0000000003129000-memory.dmp

Download

memory/4512-274-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/4512-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4512-279-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/4512-359-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4512-0-0x0000000002F70000-0x0000000003064000-memory.dmp

Download

memory/4512-6-0x00000000030C0000-0x0000000003129000-memory.dmp

Download

memory/4584-267-0x00000167833E0000-0x0000016783446000-memory.dmp

Download

memory/4584-264-0x00007FF6CE400000-0x00007FF6CE549000-memory.dmp

Download

memory/4584-266-0x00000167833E0000-0x0000016783446000-memory.dmp

Download

memory/4584-350-0x00007FF6CE400000-0x00007FF6CE549000-memory.dmp

Download

memory/4688-360-0x0000025760440000-0x00000257604A6000-memory.dmp

Download

memory/4688-361-0x0000025760440000-0x00000257604A6000-memory.dmp

Download

memory/4688-365-0x00007FF6B01E0000-0x00007FF6B06B0000-memory.dmp

Download