b03377e6d23e33e35763075940311a4d24a13c7dc37674f23d7ebf14fced2711

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 1.3MB
Sample260816-efngbazvcv
SHA256 b03377e6d23e33e35763075940311a4d24a13c7dc37674f23d7ebf14fced2711
MD5 b1b4f11d648a8aee44d4a4a1036da8d5
SHA1 59e70920cfa342628bd7593a547745a2b213630d
SHA512 72bade6d51d1aba1931c02c4b1cb80e022edb7928d8c864fd54d15349afefea7e15862e9c4736e58b8f73483dc557a194ec015ad9e700cdbe5e76ea93e4d30bc
SSDEEP 24576:4KTSmcEfMlL/NN0jJgkDQlTEWu0PQWzY0CNv+1RfTaVNScdMFR:7Twv1v0OTEWa/Z+1pTa2cdMFR
TLSH
T19D55DF113DA38073C3A2417075E8AABADD6E7D2C0B2149D76F87766A1D326D12BF1732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4880	alg.exe
2128	GameInputSvc.exe
3420	GameInputSvc.exe
1328	elevation_service.exe
120	elevation_service.exe
2532	maintenanceservice.exe
4452	msdtc.exe
5876	OSE.EXE
3440	PerceptionSimulationService.exe
6108	perfhost.exe
2668	ReFsDedupSvc.exe
3540	locator.exe
5852	SensorDataService.exe
3892	snmptrap.exe
4728	ssh-agent.exe
4556	TieringEngineService.exe
4244	AgentService.exe
1244	vds.exe
5596	vssvc.exe
928	wbengine.exe
6036	WmiApSrv.exe
4668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\153e9d65e05f6396.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a33d5ee0322ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000636593df322ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000274567e0322ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d57f63e1322ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f60a6e4322ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b59053e1322ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3420	GameInputSvc.exe
3420	GameInputSvc.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeTcbPrivilege	2128	GameInputSvc.exe
Token: SeBackupPrivilege	2668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4556	TieringEngineService.exe
Token: SeManageVolumePrivilege	4556	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4244	AgentService.exe
Token: SeBackupPrivilege	5596	vssvc.exe
Token: SeRestorePrivilege	5596	vssvc.exe
Token: SeAuditPrivilege	5596	vssvc.exe
Token: SeBackupPrivilege	928	wbengine.exe
Token: SeRestorePrivilege	928	wbengine.exe
Token: SeSecurityPrivilege	928	wbengine.exe
Token: 33	4668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4668	SearchIndexer.exe
Token: SeDebugPrivilege	2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	2648	2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3420	2128	GameInputSvc.exe	91
PID 4668 wrote to memory of 3856	4668	SearchIndexer.exe	113
PID 4668 wrote to memory of 2060	4668	SearchIndexer.exe	114
PID 4668 wrote to memory of 4500	4668	SearchIndexer.exe	115
PID 4668 wrote to memory of 3588	4668	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_b1b4f11d648a8aee44d4a4a1036da8d5_amadey_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4880

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:120

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2532

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5876

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6108

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5852

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5596

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2884 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2868 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 72c232fa388ab7cadf568669f60ab8b72df570188e4be0c9b074ac91d953c8d6
MD5 71f0c917281d1713cb0822e6c19896d9
SHA1 024c90bf740541b241b45716cebb10edcf86717f
SHA512 d3b686d16b870b4f60d3ec02727f251b1ba5e640e2dc15a9ef84b036b614070898a008bd904830db31ed7d4c38e97e7f1f5c8928d09215340609a3f89de7f01e
SSDEEP 49152:hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnTZ+1pTa2cdMFR:n3q6gjBy4pTa2yQR
TLSH
T131D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 8712dfe005680017bb935f13ba3a0c6791553f762677d4d48fb4e84c63da4ad8
MD5 d9228a7114e3652bb0d72ce9a60a8418
SHA1 da6d3983b40ea448af3e60a843296e6404bbedc7
SHA512 f3f14f87baf80b92d706d2b24b06d82eaed017d62d64f5af5e753aabc568b4d3d0612ddd69e8954373ca9ac71d7c440e25b698c3790b76a23bd8fdc3945faef2
SSDEEP 12288:41XLsCNWkxy2lRq2czACjzFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:+XYcDtczACjzY0CNv+1RfTaVNScdMFR
TLSH
T1FD05016C73E608F8EC6B813CC9619442EB7378964760FAAB03A499655F337C81D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 a62f022da9edb3c05966342d5e226fc5e0757598e4578d2a04cc95863a557167
MD5 f5663218cee8c693fcc53b49498214eb
SHA1 55b20562d59ee246e701207dc62ca8ad5df25b60
SHA512 2d0204a23fedfc82134ddf2326b68f4fcaa95e393184a31b5193ec0caabb1d130778b8ae57700ef0e57805aff56e8c6d2b39c1ca33ba107f899ab6e3f7ae4705
SSDEEP 12288:Smw5HEjsChNYBFgl0W/m+CpzFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:LwuROWozY0CNv+1RfTaVNScdMFR
TLSH
T1DF05F18977E61CF8E967813982539172F7F3B8122A20EB2F0761C65B5F372516D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6cc02752ecdcd9eaccfffaf160be236770003a319d4b2762c6e565c58ebb9ec4
MD5 d5ceaaee1f3d5455e4528b9a9fb42010
SHA1 b2b3df751c4431019aab5af8bb411bafd9314f50
SHA512 4d3d73d6fda9078a74b3d47c2a8fd8b4d63fabe7314871fee7bed709b6ab0b80a47f03938e96c398025e98611a85c286a4ec48e5c43ba38a2ae086b85d39e26e
SSDEEP 49152:tB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glTyZ+1pTa2cdMFR:zu6JmTxd2de4pTa2yQR
TLSH
T197D59D13F1DA01E8D05ED478974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 fc0a446b5557c4a1143729cd6c6b73122fa24814392abb21da3aebab5bb1c5c3
MD5 42b39f9956fd0ba73f0b5cf6cd2df833
SHA1 5bf2215adf8bfbd73a93b79f097c1fa980af7682
SHA512 f0840f03793ee3a78b4612080bf01620d5bec6a4fd68be3aaf9000ef91be7cb756b55641f9983b0ff1ac6bc27a73d43029263e307962fc2323d272ec582accc9
SSDEEP 12288:KY7azFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:vazY0CNv+1RfTaVNScdMFR
TLSH
T18CD422EC67FB5580E4AE8175421074E23B8FB7BB9B20FCF7550B2581D8B9AC454ECA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4303b896dddcb2ab8d78d7eb16c67e6478edd1664b60bd5d8477b0c539377c05
MD5 2baf1477bdf73b04f90fa11f9d489d89
SHA1 803cff179a6dacf4920944576756ab2f2a148d8d
SHA512 5e8226ae4e72a6e9617d453717158c5557e086b0c2e0c20c2f8f583db977cf91463841636382d5b38b3c4fb63eddc499e4388ac4ee4e4ddca001e08479f00b55
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bY6zY0CNv+1RfTaVNScdMFR:Ngb4mBIBhGFeZ+1pTa2cdMFR
TLSH
T16F65AD1E22EC02F5E0FAD2B88DA64417D6B278160731D6DF1251426D2F3BEE89D3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 2a9a44e6200283099a55f124b24ee2cf4370b6638a0105b9827e4864e370298c
MD5 1d5122a88bcdd40a82c0c35ff92ff1a4
SHA1 c5ede2fed4bb13b9a8cf151fba18bc87c9fd1c3b
SHA512 a32fe0f8d27a4f65e3e626eadfd140a90818701d3393e741da782423acc92503e2688e86deae93bd0be4419a3d633e0fddefe8f27b52ebb7c0eeca7da607c1bd
SSDEEP 12288:vZG2zFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:BG2zY0CNv+1RfTaVNScdMFR
TLSH
T142E412EC26FB7190C47AC279811064D33AE636B69720F8FF058B64B5DEB9AD021BCD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 5da032eaeca3dd14b48d36b2e74eb8d389be350937f2e532d6b8f279f4c5e4f4
MD5 682c7f9280fd3dff06cbf9dd275af99f
SHA1 fb8c6540fcb3b81eb81a2ed19f95d49eb241e6bb
SHA512 9863d2719abb1da109c1201ddf315e9aee0f07323e0acbd9f933f3fb7bdbd53042c869c001ef2b7e784e5a774edd0051b95123329cee122165fc51e54839807e
SSDEEP 12288:EVzFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:EVzY0CNv+1RfTaVNScdMFR
TLSH
T1C7D423EC66FB5580D45BC27A421134D23BCA67BB9B70FDF3050B2582D8BAAD510FCA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8fa56bfcb96b69cbe1db55b8c589463553663410c658a48ea15aadacccb78d05
MD5 fd9f43cc080193ade8c100d63ff21b14
SHA1 fef8bd3c0bb0645486e38b64fc815444d732bcb5
SHA512 81e36cfecf8d3ef284f4aea85e9893c7571ab04995512dcde4b5cf8ceffcc260ff2b57ec9ae33d734709551de59a4eb10ae5f236dd221968bd02a33b56b4aeea
SSDEEP 24576:fkB8Y8xdJqH1Mzria7/mWzY0CNv+1RfTaVNScdMFR:smXxzqVra7/CZ+1pTa2cdMFR
TLSH
T10A35F16576E601F0D47BD1388A4246A3F6B2B4261364FFEF069C8A511F33AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 8d10064d3ce358f7e239e10ac897581252e808c8e0f32e2a3cbd2ada06ec451c
MD5 b2266805b3645dea24af260c88dd5a86
SHA1 83d5149a28bb89292dd53213f1c53cc1bd4298ea
SHA512 14be3282ab18919bb861c9228a67d4103344a760f027143e7c3e118ea69656a92cbdc2569da4b321e6e617e596c5befd417294950ad7d4ba8306509e1c62ce18
SSDEEP 12288:9HvUrBFrEjwaQ2zFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:9PUr+NQ2zY0CNv+1RfTaVNScdMFR
TLSH
T15C05F16E22EE18E4E67AE17D86424649F772B4630311E6DF0291817E4E77ED8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e29dff02b251b29d1ef3c715f7862459b2fa69f73260b12326d7dc67eb34e30c
MD5 c6e57c260ec159cd814d8e0e4cc07568
SHA1 5eb6620aedcd86dee393d087d9403ed7d1d7f813
SHA512 d22653f43854b3b49ed947370f7b7606fc443f8fe02c9058cddde58c8147763c5fd3e68df10d7826aafacbc9a70509582b2d18c336301fb52256b9a484a95cea
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjZ+1pTa2cdMFR:YG05lO43bE4pTa2yQR
TLSH
T12CD5CF6E62EC11F9D1BBC17CDA86460BEBB23425033596CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1c490b60cbf84d2b034eaab1538ba48f45e3a3b5938374ee66b814c68f338cfd
MD5 7cc16e18863d3b4778ec0801fab50096
SHA1 409861bf3d74d4072c16999a58c2d9ca0726bd39
SHA512 d3b90fce19b02d5be1ad84d3c228163bbccdc30d4aa43323b6dfc53c3783c01c70f71d8794fb17a1b43eaff42c49d727c71a48f510e39e1eb6873953957ade69
SSDEEP 24576:1ha5POZ3dpbWVM50JicR2hG0lasx2+47eidnezY0CNv+1RfTaVNScdMFR:ja5POZ3wJt2pasx2+mVZ+1pTa2cdMFR
TLSH
T12765BF5EA6FD01D4D1B9D17DC583461AF5B2342653319ACB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e7f00a24935698c80b1cf603bf21977fce8b9e82a8a33744dd03fe166c3bb17a
MD5 4a4abd480134c0c7cc4c3038afaab104
SHA1 c55796d6a334b47e0508760dc63d46646413d317
SHA512 10e70b0793835f6d98e7082695c2e9191dd138cc2f7074f1fa8217ecd71c4484c6dc08141a106fc0d9aa6c1c3ec41f95d8fe74687842979d75eef0e8d338209c
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkgzY0CNv+1RfTaVNScdMFR:uNc/zEOVHFUZ+1pTa2cdMFR
TLSH
T140858C5623E901E4F1BBE1BE89779546FAB1786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 be4a92eeaf0704cbf723ee0ff79d9487f40ed6c923b62eb4b011e1bc9b04f494
MD5 649e2bd80718bdb324844071b9f1d6eb
SHA1 e52833d4b2b4405c05b024436e33d666449ceded
SHA512 f37c287644c3f093938ac10c51fc55a63cc0990109cc43055cee9464a386b13e3cf9f3f7ebf1527864e0b71d4b0eca83743d64854410c5d5dd8727e533595123
SSDEEP 12288:26HPJnJP6szeCs6Rl28d+zFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:fJnJPbzB4S+zY0CNv+1RfTaVNScdMFR
TLSH
T12715E07CD2A910E4D4B7C2B481162696BF72387D2F21A9D719B9D4303F22EE0A97DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 babe35d819a9f67ad6a58ad4b1f3b4086e4140cba82d284f6e4ebb03256a3854
MD5 4e15d7f199c4139cc60eeef988ab413a
SHA1 a6401fbc9770841e6ebb6a1f13191be606907f28
SHA512 6216a7a6185d9b04c235585f6c1a3c189a4c2c876d68ecb19f56cf1eb94a72eac0525e6074210222ebfd17a0678920555bcecf0f12386d82f20577195014e49c
SSDEEP 24576:eCLHGL0MoeVtFumTijCmlKQWDkFzY0CNv+1RfTaVNScdMFR:eCLHGeeV5ijCmlDWDksZ+1pTa2cdMFR
TLSH
T1A1A56B05A7EB5184E8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 fb1d5ac9779a9e886c428daf93845fe8794c3d3314e328ef09df6aa6dafd373f
MD5 16a348c629d219f9e72b51cbc60e8aba
SHA1 b4bdf4f8ab2f69c870e04c72e0b6b66b0d83a0f7
SHA512 114f786680f156ce41856335a3a757c0f714c7aced2b22dace6f41ab667abe46a3124708eea408fe6d169edf780844d08911a89fda68c56e91c1137a6157d13c
SSDEEP 12288:o1Hck6j5ZI7yzFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:o6DImzY0CNv+1RfTaVNScdMFR
TLSH
T1C3F4029C33BB10F5D06BC03D82420542E6F2B5B68721A9EF0699C5B99EB3ED8757CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 4dbf3670259c6125318c21c016bf20ac92024f7238ed9e063f70d95307e0529b
MD5 fe819c0de646e7f7612c333ae1bf1ade
SHA1 e48b556051b3c4285d5a61840ce1ddb8314acdf7
SHA512 e08e8c106d73da1ff59eb837df86d1e35f1f69a919b212ef52b442e37d78b2feaed714f61d7480e3a695825d9e18a5ee64340471c8ec66cd0417a978ee717993
SSDEEP 12288:vG6ky0zFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:ety0zY0CNv+1RfTaVNScdMFR
TLSH
T149F4138C63EB60C0E5BE8238822251D11F767D719B20FAFF0543A56E9E76BC4647CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 98c8c46d2004b0c81cbaabd9cb64f03649abda75da542b2eac28526fc0a009d0
MD5 ceee02e1b312f25beaf83dacee21ff63
SHA1 8d0b85d58e92433caff7de327532fab2e66c65ad
SHA512 2975f27e8c19e3125e52ca2c8bce1b3cf3445bd908bd1941ae21ad9d6e7a457ab4653b32217b23124e98169503c74e7610c2536d61ba09dddaafe98dafe050d2
SSDEEP 12288:IHYzFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:0YzY0CNv+1RfTaVNScdMFR
TLSH
T126D422EC66FB6180D85AC279421035D227DB77BB9B20FCFB054B55A1C9BAAC510FCE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 4ded7e36c8d57a3eaf58d7b40687d5db883ad34ab041d66926c5d9dd59eca46d
MD5 0329826cf20db9182e2bef2f04d71129
SHA1 1b15eb6528a8d64d668425c2d93870f267242b93
SHA512 b4a83fc436712ab51d267ea3ac0b11afaef445823bb313bb98ef4a1527b1baf833ced410161bd7326acfe156b3e4e0f707e68de5807aacc7951b2c3797aa1416
SSDEEP 24576:yHgILoTfaidZTzY0CNv+1RfTaVNScdMFR:kgHTrZuZ+1pTa2cdMFR
TLSH
T14F559D1D73EA05CAE2B2D279D9221493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 1c511a3d664cfdedbc8ca6b356f7090c63ab85dc163ebbf643d3edc3eed94baa
MD5 be027ded0ff3d912c374050c5b93fcb4
SHA1 dd90344376bcefa9349efe245c573cf0eb94c540
SHA512 54b06be43812769da7d4cd454962a589bd9cf6bd454363c351706a3b08401e86658572950af1adbb4901503276f1b7a6add1288e2ee75003f6ab0811dc3900c3
SSDEEP 12288:JpJcm8CNzzFvjaFEwUnVTatNvbq1h7fTa9woNeDPtirdMDpR:JrcmRzzY0CNv+1RfTaVNScdMFR
TLSH
T11205F19EB2AF00E1D1BBC13C89414582F6B370715721A7EF0296877A8E77AD9793CB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8ef6dd0932f63450feb4645f8ec167211b5d9e8c9c4701c192b9374640207a93
MD5 748a0c0dc2f0c93c47ea0a5d56727e1d
SHA1 4f15ff113cda48197d861b444c2ceead34c725a1
SHA512 e4778c8f332b97896f4e9d920211496233505ed463b9e6b18fd579a720ed04335a2dd8c912d486ef9252422b041ff138211fdac4791d0395284b52bd285c5a92
SSDEEP 49152:wDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3RkZ+1pTa2cdMFR:d3Upow8sBUQ4pTa2yQR
TLSH
T13FA58C3DA2E810A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-55-0x0000024EF5ED0000-0x0000024EF5F36000-memory.dmp

Download

memory/120-54-0x0000024EF5ED0000-0x0000024EF5F36000-memory.dmp

Download

memory/120-53-0x0000024EF5CF0000-0x0000024EF5DA3000-memory.dmp

Download

memory/928-203-0x00007FF6A9970000-0x00007FF6A9E76000-memory.dmp

Download

memory/928-204-0x000001C6785A0000-0x000001C678606000-memory.dmp

Download

memory/928-205-0x000001C6785A0000-0x000001C678606000-memory.dmp

Download

memory/928-247-0x00007FF6A9970000-0x00007FF6A9E76000-memory.dmp

Download

memory/1244-184-0x00007FF6D4DB0000-0x00007FF6D503A000-memory.dmp

Download

memory/1244-185-0x0000027ADE1F0000-0x0000027ADE256000-memory.dmp

Download

memory/1244-187-0x0000027ADE1F0000-0x0000027ADE256000-memory.dmp

Download

memory/1244-241-0x00007FF6D4DB0000-0x00007FF6D503A000-memory.dmp

Download

memory/1328-45-0x000001AD84240000-0x000001AD842A6000-memory.dmp

Download

memory/1328-46-0x000001AD84240000-0x000001AD842A6000-memory.dmp

Download

memory/1328-44-0x000001AD840B0000-0x000001AD84163000-memory.dmp

Download

memory/2128-61-0x00007FF67F270000-0x00007FF67F338000-memory.dmp

Download

memory/2128-27-0x00000174AA5B0000-0x00000174AA616000-memory.dmp

Download

memory/2128-29-0x00000174AA5B0000-0x00000174AA616000-memory.dmp

Download

memory/2128-28-0x00000174AA5B0000-0x00000174AA616000-memory.dmp

Download

memory/2128-26-0x00007FF67F270000-0x00007FF67F338000-memory.dmp

Download

memory/2532-64-0x000002674A850000-0x000002674A8B6000-memory.dmp

Download

memory/2532-62-0x00007FF76D310000-0x00007FF76D478000-memory.dmp

Download

memory/2532-69-0x000002674A850000-0x000002674A8B6000-memory.dmp

Download

memory/2532-63-0x000002674A850000-0x000002674A8B6000-memory.dmp

Download

memory/2532-71-0x00007FF76D310000-0x00007FF76D478000-memory.dmp

Download

memory/2648-6-0x0000000001140000-0x00000000011A9000-memory.dmp

Download

memory/2648-0-0x0000000001300000-0x000000000140B000-memory.dmp

Download

memory/2648-7-0x0000000001140000-0x00000000011A9000-memory.dmp

Download

memory/2648-1-0x0000000001140000-0x00000000011A9000-memory.dmp

Download

memory/2668-117-0x000001385E080000-0x000001385E0E6000-memory.dmp

Download

memory/2668-116-0x000001385E080000-0x000001385E0E6000-memory.dmp

Download

memory/2668-257-0x00007FF7AD800000-0x00007FF7ADF43000-memory.dmp

Download

memory/2668-122-0x00007FF7AD800000-0x00007FF7ADF43000-memory.dmp

Download

memory/2668-256-0x000001385E080000-0x000001385E0E6000-memory.dmp

Download

memory/2668-169-0x00007FF7AD800000-0x00007FF7ADF43000-memory.dmp

Download

memory/3420-37-0x000002697E280000-0x000002697E2E6000-memory.dmp

Download

memory/3420-35-0x00007FF67F270000-0x00007FF67F338000-memory.dmp

Download

memory/3420-92-0x00007FF67F270000-0x00007FF67F338000-memory.dmp

Download

memory/3420-36-0x000002697E280000-0x000002697E2E6000-memory.dmp

Download

memory/3420-38-0x000002697E280000-0x000002697E2E6000-memory.dmp

Download

memory/3440-97-0x000001D11D760000-0x000001D11D7C6000-memory.dmp

Download

memory/3440-95-0x00007FF607D30000-0x00007FF607E79000-memory.dmp

Download

memory/3440-144-0x00007FF607D30000-0x00007FF607E79000-memory.dmp

Download

memory/3440-98-0x000001D11D760000-0x000001D11D7C6000-memory.dmp

Download

memory/3540-126-0x000001CFF72F0000-0x000001CFF7356000-memory.dmp

Download

memory/3540-125-0x000001CFF72F0000-0x000001CFF7356000-memory.dmp

Download

memory/3540-124-0x00007FF60B610000-0x00007FF60B6BD000-memory.dmp

Download

memory/3540-172-0x00007FF60B610000-0x00007FF60B6BD000-memory.dmp

Download

memory/3892-193-0x00007FF76B040000-0x00007FF76B0F3000-memory.dmp

Download

memory/3892-147-0x000001C074BD0000-0x000001C074C36000-memory.dmp

Download

memory/3892-146-0x000001C074BD0000-0x000001C074C36000-memory.dmp

Download

memory/3892-145-0x00007FF76B040000-0x00007FF76B0F3000-memory.dmp

Download

memory/4244-181-0x00007FF6BA7B0000-0x00007FF6BAAD0000-memory.dmp

Download

memory/4244-175-0x00000269EDBE0000-0x00000269EDC46000-memory.dmp

Download

memory/4244-174-0x00000269EDBE0000-0x00000269EDC46000-memory.dmp

Download

memory/4244-173-0x00007FF6BA7B0000-0x00007FF6BAAD0000-memory.dmp

Download

memory/4244-179-0x00000269EDBE0000-0x00000269EDC46000-memory.dmp

Download

memory/4452-133-0x00007FF7A3830000-0x00007FF7A3949000-memory.dmp

Download

memory/4452-76-0x000001B7765C0000-0x000001B776626000-memory.dmp

Download

memory/4452-75-0x000001B7765C0000-0x000001B776626000-memory.dmp

Download

memory/4452-74-0x00007FF7A3830000-0x00007FF7A3949000-memory.dmp

Download

memory/4556-165-0x00000216F7240000-0x00000216F72A6000-memory.dmp

Download

memory/4556-164-0x00000216F7240000-0x00000216F72A6000-memory.dmp

Download

memory/4556-163-0x00007FF63A190000-0x00007FF63A324000-memory.dmp

Download

memory/4556-212-0x00007FF63A190000-0x00007FF63A324000-memory.dmp

Download

memory/4668-249-0x00007FF6A2D00000-0x00007FF6A303E000-memory.dmp

Download

memory/4668-227-0x000001CD754E0000-0x000001CD75546000-memory.dmp

Download

memory/4668-226-0x000001CD754E0000-0x000001CD75546000-memory.dmp

Download

memory/4668-225-0x00007FF6A2D00000-0x00007FF6A303E000-memory.dmp

Download

memory/4728-157-0x000001C601FB0000-0x000001C602016000-memory.dmp

Download

memory/4728-202-0x00007FF63B760000-0x00007FF63BA03000-memory.dmp

Download

memory/4728-154-0x00007FF63B760000-0x00007FF63BA03000-memory.dmp

Download

memory/4728-156-0x000001C601FB0000-0x000001C602016000-memory.dmp

Download

memory/4880-18-0x00000197A4820000-0x00000197A4886000-memory.dmp

Download

memory/4880-50-0x00007FF69B260000-0x00007FF69B382000-memory.dmp

Download

memory/4880-16-0x00000197A4820000-0x00000197A4886000-memory.dmp

Download

memory/4880-17-0x00000197A4820000-0x00000197A4886000-memory.dmp

Download

memory/4880-15-0x00007FF69B260000-0x00007FF69B382000-memory.dmp

Download

memory/5596-195-0x000001D78DC40000-0x000001D78DCA6000-memory.dmp

Download

memory/5596-196-0x000001D78DC40000-0x000001D78DCA6000-memory.dmp

Download

memory/5596-194-0x00007FF7EB070000-0x00007FF7EB540000-memory.dmp

Download

memory/5596-246-0x00007FF7EB070000-0x00007FF7EB540000-memory.dmp

Download

memory/5852-134-0x00000181CA0E0000-0x00000181CA146000-memory.dmp

Download

memory/5852-135-0x00007FF6753D0000-0x00007FF6757E6000-memory.dmp

Download

memory/5852-209-0x00000181CA0E0000-0x00000181CA146000-memory.dmp

Download

memory/5852-211-0x00007FF6753D0000-0x00007FF6757E6000-memory.dmp

Download

memory/5852-136-0x00000181CA0E0000-0x00000181CA146000-memory.dmp

Download

memory/5852-190-0x00007FF6753D0000-0x00007FF6757E6000-memory.dmp

Download

memory/5876-86-0x000001B5A4750000-0x000001B5A4803000-memory.dmp

Download

memory/5876-87-0x000001B5A4940000-0x000001B5A49A6000-memory.dmp

Download

memory/5876-88-0x000001B5A4940000-0x000001B5A49A6000-memory.dmp

Download

memory/6036-217-0x00007FF667B90000-0x00007FF667CBE000-memory.dmp

Download

memory/6036-248-0x00007FF667B90000-0x00007FF667CBE000-memory.dmp

Download

memory/6036-218-0x000001D3675B0000-0x000001D367616000-memory.dmp

Download

memory/6036-216-0x000001D3675B0000-0x000001D367616000-memory.dmp

Download

memory/6108-105-0x0000000000790000-0x00000000007F9000-memory.dmp

Download

memory/6108-110-0x0000000000790000-0x00000000007F9000-memory.dmp

Download

memory/6108-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/6108-152-0x0000000000400000-0x00000000004AE000-memory.dmp

Download