expiro | bbf3885f98f3ce2f7ccc466862d2b35c9cf7eb23dd8dffb77cf85098ca77eea0

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample260903-xp767abc25
SHA256 bbf3885f98f3ce2f7ccc466862d2b35c9cf7eb23dd8dffb77cf85098ca77eea0
MD5 f13b6e3c06bcb39fe8dcb874a9b9b32d
SHA1 e6ff2fa6ece9651340c694e5cb22076cdde112f3
SHA512 50f708816a578a6c5313fe7728b10490d7935f7b767809ab02903aaacca371e287e13c99e0d5a3b074e096d1467e5cf9c9ebdb52b88e5cba9182472f3c0bec89
SSDEEP 24576:QGyWem1gXq5L9uSWidgpm6hbpOSRKQVn6R5zwUqMpcWuh4epMWFJOTVTK:Q1Xq5L9uiibpJKQGcWqnOT
TLSH
T141A56C0DB7A1502CFDF305FA4AFE63ACA82CB9A0076894D352C416DED725AE57C32653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor credential_access defense_evasion discovery expiro spyware stealer trojan

Malware Config

Signatures

Family: Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/memory/1860-4-0x0000000000400000-0x0000000000850000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
defense_evasion

Executes dropped EXE 5 IoCs

pid	Process
3276	elevation_service.exe
1808	elevation_service.exe
4740	maintenanceservice.exe
2964	OSE.EXE
3776	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1738198120-2966725515-3980530802-1000	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1738198120-2966725515-3980530802-1000\EnableNotifications = "0"	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe
File opened (read-only)	\??\K:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\M:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\P:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Y:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\G:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\D:	elevation_service.exe
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\I:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\N:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\H:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\J:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\O:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\H:	elevation_service.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\D:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\S:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\O:	elevation_service.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\locator.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\gameinputsvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\alg.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\gipdefmh.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\heaiaiem.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\refsdedupsvc.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\openssh\njngqigd.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\jgkhjdol.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\locator.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\sgrm\sgrmbroker.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\nghjmmbi.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\qoefaddp.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\gameinputsvc.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\SysWOW64\pedpelde.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrm\sgrmbroker.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\refsdedupsvc.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\odadaonc.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\abgnmddd.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idddgalc.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\edglhgfg.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\dgilkpmn.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ogogbdbj.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fhkccgam.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\finbkiei.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\edbponjd.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\ebbgqipl.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\cpkcoelj.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmdchbdj.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\epgaijka.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\akaajeom.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jqhbfang.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\lojnilhp.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File created	C:\Program Files\Internet Explorer\kfefgkli.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\elmcbqaa.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\gdaoemja.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\edifekgj.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lbkhaemd.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\program files\windows defender\oahcpapl.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\icjaoghm.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	elevation_service.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\jiianoje.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\hpbanfjo.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jbcghalc.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\afaqkaok.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\bhlnifll.tmp	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	elevation_service.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1860	2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	3276	elevation_service.exe

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f13b6e3c06bcb39fe8dcb874a9b9b32d_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 35d5f9b5d9d41e4c110836cb0171c84ec373b27efcce5dc24e7d93748667a1ac
MD5 a3488ee77451badff8ba25781e0974a4
SHA1 0af2d7154774eea5e814be1fe58b1a61aca05e46
SHA512 397104815e554219ab91249914c5f9bb62dd9165c5439f2c8a95d60e934da0d09fe1326a13414a4b453bc188ea98845bbb6eca8372388546e85ed4dafa1bc349
SSDEEP 49152:nb+632BuPkFKRrdE6oh3stBhuXjfS4LWxn5Ac96JXOvG:V3q6wjB9c96J+v
TLSH
T14FD59C07F29910D9D069C275C346A122EAA2BC891B3467EF074473663E3BFD89B3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 818KB
SHA256 b3926b2cc96b9d5097b2f608a91a33dfd7f5ad108eb8b9710d39952edac9c168
MD5 6105b630fe06f431588fbc25491ac9cc
SHA1 b59d7c6a990f7c4b6ce3063b4f225239794e5bc1
SHA512 c4fad20632eaf816dd7ff210ef4603206a1724a57ae2d0d878e8f776c1b406abb1e0da2e401d77f8433bf2c4e1e23a75ad42d20247cc125b45be60551087de54
SSDEEP 12288:e1XLsswWkxy2lRq2czA6RkNEjbJ6v3gCCDEGqeWj5C6blUaHepXXPXT3SA9y:sXYfDtczA5ybVD0j5CwpHGPXT3S2
TLSH
T10E058D0837FB8CEBEDD3D0F1598609A0B124B8664B72BAEAC75C805FCD4B39505A569C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 797KB
SHA256 b412f69ec9d2e7f414cc2f7082ddbe5a64698da312e6c9dabc6ef4aba7acab00
MD5 bc98534e280c977762ecae46dda3c472
SHA1 215bb3c94afe8deec0f5933598c2cfa1573eb809
SHA512 dd0c893f075dcce0232e8daf93e6e7e6ada946744cb93d83409822952c6a90ef5ff92b2ea107785ec604ec353f4fa100dc946eb58fe3355acc09cc3c6924693c
SSDEEP 12288:Cmw5HEjsChNzBFgl0WDm+CYE0l5E8DfhVdOe4/YeLXBL2EuIj2vnX6jNzkfpU/AX:bwueOW/ES5EKcL/vFuIj2wRkCOZpw
TLSH
T175059E2B77C21843EB76C8B98992DDB2A751746C3B2BA5F8B315C3F52F121A24D71B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emdpmifb.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\emdpmifb.tmp
Size 6.6MB
SHA256 06198656a7c41b26c87ea57d770726642af4e4fd34327d6f0503cc426d45e831
MD5 0388b8c962a1f37d04bfffd055f0a334
SHA1 00519eb1685a55680356b963ea3ac7d41a6b0df4
SHA512 1ea38d3305cc790627388a992ccd4bb6794db7be8b47e2fa2b00c41d9ca881cf1556af6d937cb9eabc1c480545cd3edc6b9e9765bf218cc6d98a61156766f0c0
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGenAaLSF259ruMHwpXMi4FqJLd23U8:0QRQyi36YOcPPLvw2gAf+PN37q74wJ
TLSH
T1B7667C03F3A541E8E05ED9B4CF3D52229B357C4A8BF192EF259436E11A729D47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 630eea42f2924ef87e7123bf9b49945ea74bfe038a760284cef4238488b9e2d7
MD5 6d4bdaf3ea986abdc7ac5677acb1a929
SHA1 79cf9cbd15aceeb6265529d7e277d7185736c7fa
SHA512 559f09dfa22578a7cab96316f0aa07754b86386f28bf6be93d85639409302f84a6d1589269c66ee280d2ad9b5779f51e9bbe3333a357e0947b37ba1e943a0cf5
SSDEEP 49152:vB+taZ3usBWOBr4tEGB0bqx0z+n217aau1gl70WQVUqXX:Ru6Jmbxd2dMVFH
TLSH
T1E0D5AE17F29D05D8D06AD078871AA233EA62BC490B30B6DF07A472591E77EE49B3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 64bc61323cdd7d726a55039de0ddc47d9e10037108debcb64df37739e78a9428
MD5 c709ff645c3e4b88f9ccdcc86b2fa637
SHA1 8d6b97e4c75c99a9069810def610f62686669d9f
SHA512 d9f5c8c24f210cebdc10500bd867d69512b03466e76453e25143cd1d7f5e90498f1849077a26644b2e2cce8630d31a4e5991d2ea646db4bccab5ac10a8a2a709
SSDEEP 24576:nG88u8FpJqH1+zria7/muZzBO8OdXP4cF7GOphn9:G7ZFPqV5a7/3xBO8mXP4cF7GO
TLSH
T1B635BEF146B401E4F7628135BB41CBA396D5782883E9E9AF007D89238FB25862F5F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-14-0x0000000140000000-0x00000001404B7000-memory.dmp

Download

memory/1808-99-0x0000000140000000-0x00000001404B7000-memory.dmp

Download

memory/1860-0-0x0000000000400000-0x0000000000850000-memory.dmp

Download

memory/1860-4-0x0000000000400000-0x0000000000850000-memory.dmp

Download

memory/2964-35-0x0000000140000000-0x00000001402B3000-memory.dmp

Download

memory/2964-109-0x0000000140000000-0x00000001402B3000-memory.dmp

Download

memory/3276-92-0x0000000140000000-0x00000001404CD000-memory.dmp

Download

memory/3276-9-0x0000000140000000-0x00000001404CD000-memory.dmp

Download

memory/3776-46-0x0000000140000000-0x0000000140322000-memory.dmp

Download

memory/3776-110-0x0000000000B80000-0x0000000000D52000-memory.dmp

Download

memory/3776-111-0x0000000140000000-0x0000000140322000-memory.dmp

Download

memory/3776-113-0x0000000000B80000-0x0000000000D52000-memory.dmp

Download

memory/4740-33-0x0000000140000000-0x00000001402B9000-memory.dmp

Download

memory/4740-19-0x0000000140000000-0x00000001402B9000-memory.dmp

Download