d369bbc5d78c63ac54007623196ef6f1e3fb7fa1563dce3ca9923b3888efdfab

Analysis

max time kernel
143s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 863KB
Sample260913-tr3spsal21
SHA256 d369bbc5d78c63ac54007623196ef6f1e3fb7fa1563dce3ca9923b3888efdfab
MD5 37adb57fbad9dfbf5c29b2a9e86266bf
SHA1 c265fc8fdd8ecf0740fda5249578ab089ac0e0c3
SHA512 023de796e86d524139623d6b1fc60d75ba5890af28839aaccf373c791f262fed3f29cde2bdcb92a2371116314ce26ee0b148fd76df02d074a80a4b4ef5b69206
SSDEEP 24576:bxcVpzvj2SrGxgKsKZJCcTNBUdiPcWmrmtJ:yHr2Sr+4KZJHZyi
TLSH
T14115011276E28C76F2B705314CB8A6A55ABDBD210832CB7F63D40A5D8E74580D63AF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1456	alg.exe
1488	elevation_service.exe
5700	elevation_service.exe
4800	maintenanceservice.exe
4644	OSE.EXE
2296	GameInputSvc.exe
2780	GameInputSvc.exe
3924	msdtc.exe
3548	PerceptionSimulationService.exe
4816	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c034c8fac17a6531.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	GameInputSvc.exe
2780	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3120	2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1456	alg.exe
Token: SeDebugPrivilege	1456	alg.exe
Token: SeTakeOwnershipPrivilege	1488	elevation_service.exe
Token: SeTcbPrivilege	2296	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2780	2296	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_37adb57fbad9dfbf5c29b2a9e86266bf_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:1252

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4132

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5268

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3204

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 12e63d7303172c31c9ecc10ce4993db065a68a9d29265f77a7db71f3939850fe
MD5 0140c14b8763933f29e91e512892b329
SHA1 a62276e871dd459c8e4ad4a9595feb305c437996
SHA512 af89e7ef66307f37b47163b71e42c36689cd5b22d35f14af05d5254192a3815abaebaa8bfbb1f19a95e075aa8b9b2544562860fa0d8a396c7d1788f3c27bd0f8
SSDEEP 49152:Mf6632BuPkFKRrdE6oh7stBhuXjfS4LWxn7KZJHZyi:+3q6gjBZZJ5yi
TLSH
T12AD59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 729496b205ffb39d6beb6712c0942107342d27d1495b957604dbdc79aeecde21
MD5 8dee3b96934d0f55fcbfe335cd4d5c7b
SHA1 48234db50bec53ed5364d4c21df3b33338fd40ca
SHA512 de71347bcc5e38f3bbfe92b1fc502953e366df7a899d03de3ea02cd6d141c636618061f9fcfdb58bac2eee8e1ad513f18282a9a92d0610bd3254751128f0d64f
SSDEEP 12288:q1XLsuSWkxlKJctDczA/U/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFb:gXYTDDczA/KsKZJCcTNBUdiPcWmrmtJ
TLSH
T1CC05F129A7E10CFDEC6B813CCCB28405E733785547A0E79B03A496651F6369C5E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 a1faf393524f56030a355a892209b7b317396219700f1a3b28e107a6e21fef75
MD5 22bda74bd5a89f91dc8dab2296847b88
SHA1 77995abe4ea8aaf67377afff4c8cf75d1fd71885
SHA512 0df931c55dc66b6503ae9f5329b1ebb601562a3649fa268e8c97a2f7e0e5130a2bf0f2dbdd4e86953d6a0e1c8525c1ca9c042bd1ac517079aad71c5886254f7b
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CnU/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnT:QwuuOW6KsKZJCcTNBUdiPcWmrmtJ
TLSH
T14705F14A67A50CFDE9AB8138C567C039F7B2BC112A61D71F5360C35B5F27264AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 94c4d27c7f30607869c9433c7a4d582c996043271b3317ccb568a3ef31864a0c
MD5 ac85d448bb4a6e710ad43ead2b74f3f4
SHA1 baa575c3603c2ba70b3e7b1270b585c4fd948602
SHA512 1e646e64656dc95b456ee9f084a370b884053b574b71ec096d0090d2001d60a758f262a1cc15e0ca31b11b670df860894b1ee6a0683d1b56b5c8205ca06bfac0
SSDEEP 49152:ZD+taZ3usBWOBr4tEGp0bqx0z+n217aau1glvKZJHZyi:Ru6JmTxd2dCZJ5yi
TLSH
T1E2D59D13F1DA01E8D05ED478974A9232FA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 178588f4fa65be98168cce08034bf0a1b9354f6b75c3ba1b0c59505313a366f7
MD5 a0a0a9bf4a8d1638ae8d46fdcfa48414
SHA1 f07531276e1fc860a5ed9e23ad3e7d86e39734f2
SHA512 5a1413c0cb342511cadba114f4a400aebb59f63ebc9ffc37e8f5a5ce34f3a739693815338480cceb91f28896ba4b56677bf6ba77c82dc5237b1823b1d23f3d4e
SSDEEP 12288:Id7+U/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:4+KsKZJCcTNBUdiPcWmrmtJ
TLSH
T113D4236ACB968C4DF4AF1478887A501C673EBA6817D293E3F31492844DD8DCCCDA5787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 940KB
SHA256 ab44d59dce6d19332c3ee98b38d09416e8404301cd17b314868aff5733fa25a8
MD5 776d89ccaee6dbd4643e5f9503d1e6ec
SHA1 562c2af774c8d62fd76714bb63fafd1d3b77e651
SHA512 14d71ef0c8d94ab6b1d83346c5f757385e8531a351f60f187480729d0a5a6cd96eb5ffbb75ec299963ba0e47a5d341a30d7999715a8a7fdaf3e8e0f6f82150f3
SSDEEP 12288:wLIrb698z7emBzvMi49WNNYCXsogVaCHTrSrYg+qv7gIN91GOU/kI+:mgb6bmBIi49WNNFpg1rSvFv7bYOKC
TLSH
T193254C1E22EC02F5E0F6D2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 cff63e7d415e2db227d43946e07a69e800ab462855f93115bc5db591a6e0cee7
MD5 d76b4b56295505aa5b78b83296bce037
SHA1 db4922c3b77827e19487e7e7552b45660d0c57ea
SHA512 ef652e0158fb7b90e3623a92db9f54f85e1b5d1acfb09568fd87688ea011fac14671eccf3195666a7beef50d5b9d27e9a8d59bb8a8c1fd4c9786796184b45923
SSDEEP 12288:jiGLU/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:WGLKsKZJCcTNBUdiPcWmrmtJ
TLSH
T186E4236E57F368CCC47F813888365048B7357564176263FF8264D2758F889ECEA79E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 6eae77977bc8255fa8e93d9cb81b7040ea830bcb77163f3ea30af16bb3438c81
MD5 40e8932cd2bb330efa75a7d3935ed343
SHA1 cc88f82b314bad0fe8547091b2f9cdad18a7a0ec
SHA512 fb40a64edcdd6d7ccbc23e0460440eda91767de5f7462505831b2fbc726eec00d5ff82d23bac71ae898ac791c7b3165a03f26ba50c8fb07402846a0054ecc922
SSDEEP 12288:avU/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:avKsKZJCcTNBUdiPcWmrmtJ
TLSH
T141D4236E8B53CC8DE59F14788436504C6739BA6817E353E3E32892854ECC9DCD9B96C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.0MB
SHA256 5c4c23fd7f575f9763012e3ef984cf6ecb5c2217b3c2a28181cc95b1649d5296
MD5 29f3defa2dcb02657d8b43ecc5c6c674
SHA1 b3ceddea0146531b89446e2d4a7b55f17bde4e81
SHA512 c0c1522ecba8abc47344cc7685e858b16e56db24c56bc0a7ee21143de091fd08ceb97be1c84592d0523c865e28a7a89745dd531ba3b15f12a0ff08cce167ca97
SSDEEP 24576:LBC8u8FpJqH1Lbrva7/mZKsKZJCcTNBUdiPcWmrmtj:txZFPqVja7/cKZJHZyiX
TLSH
T1D3350165A7E101F4D07BD13889964667F6B2B8250364EBDF07AC8B511F23AE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.0MB
SHA256 3de6890eb9e3785887f1ce3c566dee13ad41fa8ce2d84921f1193868335ec4c2
MD5 8c2009e7fe885069947c0996ddb54f7f
SHA1 b302aba4be209844c8f4d164e0efc122fb68061d
SHA512 534bd4de6fe4b2ef4d39f91b045ca1a8a2687d5cc4b9a97f83cfb6f01ac83590eec8b4b653d2d931b76d7d39e908330058d8d55e6d9ce1f1df9b7291993e0241
SSDEEP 24576:LBC8u8FpJqH1Lbrva7/mZKsKZJCcTNBUdiPcWmrm6:txZFPqVja7/cKZJHZyiE
TLSH
T19B35F165A7E101F4D07BD13889964667F7B2B82503A0EBDF07AC8B511F23AD44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 2d7ccc94ea69abfb538ea0a27e2d9dbc4be3a3e0ff14143d32592984a32fc50e
MD5 50182d8b5ed4bd6adc36265e61881fa0
SHA1 618a3c6045917e247fabfa13db92536826ffca1d
SHA512 42592623724d90984c0317b02db0fe4eb20252a1c74a7e6499e45e11e105e19aa9cf00691ae75ec8c72a6100060a5e229d5920a4cf6b28a8c02dcb205ed2fbff
SSDEEP 12288:8HvUrBFrEjwaQsU/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:8PUr+NQsKsKZJCcTNBUdiPcWmrmtJ
TLSH
T19F05F12F66E91CE8E67AA17C8992460CF771B461135293DF02A0817E4F57EDCAC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 dbdd9a168f218ae302c1389f63f01ef40b45b82c8dffaf26e5693e8e39e72131
MD5 5aca33102d4761dfb1e5bee24fed2cf3
SHA1 a91c7ba195b6f50e1f7c0f55000db0290c5720d7
SHA512 b77a3f6d2323e86fe30145c69c7cbbe67ea8485de8589edf69332ff6794945ff0a982db89e9449dd088a88f4dceaa6969cce24585e2ab649d03f06cdb6693762
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvKZJHZyi:LG05lO43bPZJ5yi
TLSH
T149D5CF6E62EC11F9D0BBD17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.1MB
SHA256 c58b5f98188f728d2d3b5300eeff76f00b5d8eac157f2be78c0a7a01f42927c0
MD5 8ef48cff2c63f8fa457833a169c723ea
SHA1 f9ca26362e4fc4077784278c8db21d2333c1ac1c
SHA512 1aa0434c9ece268594ac8d3546bf4ba13048b3774747a6db105eb0be2a1f33c4c1af80426a9996dfa7643edb267c7cb8048117d2cb580a364365254b146b426a
SSDEEP 12288:LFKYGNca1w6n8ejbyQ4nLC18yx/oRvnC3e/EOTHxt0wLAxm7aCHd9W6:sNcwHdjbyQ4nLC18lb/EOjowL7Fk6
TLSH
T1D935272623E901E4F5BBE1BE89679546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 dc464428832c66013885dfe701743c7a1f1a04883fc3999b62de1c86bc34f46a
MD5 9edc1ba66a9129a0c0cbfa59162097bb
SHA1 5b496ed07a5784d930123d83fec32217929c7561
SHA512 f2103cbd7b3071a52b0a2196a2f07fa8d899f3ce4dabcb9e50a4f4704ca282028c0c6f10cc33aa7209263936b7e97fb8e95d8e6504c0c482dfda8eb16eff2ab2
SSDEEP 24576:1gJnJPbzB4SlKsKZJCcTNBUdiPcWmrmtJ:qJnJv6SBKZJHZyi
TLSH
T1B915E03DD2A810E8E4B7C2B4812A1659FF31387C2F2269C759B4D5343F42EE0A979F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 577KB
SHA256 c8a860704e7d5d8fdd1fbd83b9209409262329353af830e93d0649ca91ac99c6
MD5 6409d107ddeb11d34242d15e821df9fe
SHA1 c540ca79eba5d993ec480884178a8ec5dec3d2db
SHA512 4e47e6acb6ce63581efd03d891d3c9a6b65ade117361e8a893ccb9f8a4813c24ed1abff14ba798ac2b7b7593eacca3fd0e1966b97ef0a0ebde2e4a620983fbb3
SSDEEP 12288:WIC0wHGLYRvlWaEU6ohtqzvfm104wKBQwZon:VCLHGL0MoeVD
TLSH
T1C6C4E619E3A291D5CDB5C1B4C60AA527EB31BC18533877EF9FC1CEBA5E21AD1A13C601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 237eda61bade27e7d5dc6676dd82b9fc51d76cf054ea9ca5a3ee57bc5dfb2181
MD5 43498af274e5bb596117e42d315f8777
SHA1 6d0e65c0a7842cecc42769cfa1b96a1df5aa1719
SHA512 6e99aa4d3d0958f78cbdf0cce0857a5470f43c1676d4eb725407a9967dd91dd0a9393ba66fe2f8c782fba1fef15091f7433702c495b9b9517d67bb7a8aad40b1
SSDEEP 12288:B1HJk6j5ZI7DU/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:+6DI3KsKZJCcTNBUdiPcWmrmtJ
TLSH
T1B505F15D637610F9D0AB903DC5930005E2B2B57487625ADF47A8C1B98FA3EDCB93DE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 c98dd15b34230243043627737105cf3388d8c481fc074fb404d2ef28721d3df6
MD5 ddd1a941f7e65a3599a231c89828829e
SHA1 4cde0b63fa7c5a6fe4b670b8939aa73af0f0c1cf
SHA512 04154883e7bc4e145c6541f9cd3a7eccfe397d1c666220ae7cf02f31dcb1ff5409aedbe3917663a2e8c6ff19c412256ba43bbe44117f4cca14b3905c4edfd540
SSDEEP 12288:7G6ky1U/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:6ty1KsKZJCcTNBUdiPcWmrmtJ
TLSH
T199F41209979598CCE5BE0138C97340989B39BC241B6253EFA260E37E1F75BD8EC75B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 ca46fd858f41d4d8835422fb9936885872033fc6ec186e600f04404f8e647ada
MD5 abd9828c7378d13adf031c9a7fb48c14
SHA1 02e0a72c424096267658aa191de7199f079c9326
SHA512 e1dd65da17138297c3cba9590f3ca9f74ed9fde202f09c42a3fcada6d2e9609b885d42e6163da4cf7d9479b6f8faf46ff21ce1c95efde96068865b53e8c5bda1
SSDEEP 12288:CVaU/kI9SoIlKZJ43c9x+fPwNddfUdiPclVCwyafrmnxvFFJL3:MaKsKZJCcTNBUdiPcWmrmtJ
TLSH
T1D4D4236E87A39C8CE45E55788436104CA339767817E353FBE264D2B48FC89DCC9B5E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 741KB
SHA256 ce73abac9b162a2c3010958d88ee15c9a8091bc2bf1dca3122a68a766af99300
MD5 1f81b8a68c8946debe1a7affaa1d6825
SHA1 f826f431290372d93b902626037e6deac579ede1
SHA512 5da0b0d8f78bb2c89185fdcabcaabd489f4632cfa5e9b865f0bba5af97cea6e2439583d5579f8770f72f9f8865a2777d3fb08fa12ab4e722916ea4ee37d4fddf
SSDEEP 12288:QqgZqZyFDK3tT5Tr7aVLIH9lH3cMU/kI6:QqgZ/oTfaidZrKm
TLSH
T12CF4181D67EA05CAE2B2D279D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 480KB
SHA256 2b01091fa52fa895f7f8e1974a0842d72f5b5abca88e39fe15b339346a5547f8
MD5 0c2855237e4318726c1694aa8ad648e6
SHA1 6c208992b11c0434e2fdb2c059b0ac12d6a6e03f
SHA512 3d7af66f21c1924f0a6c887c167fec15e389655f567954fd764dc6c559253ed377d641c07fdb8170ad7514e70c98afbe36936e00939de0c80492b60cce2ca72d
SSDEEP 12288:f6FxLvSZmXSpHrnyi3yHTeqer7q6+qX/TNGzVGyJBvwY8pCY9oecogJ:f6DL0mX9i3eT67q6bkUyJBv02ecogJ
TLSH
T12FA4287DA1E840ACC9AAD379C4422766EE70342E3F2115DB0170D578BF2BEF18639E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-280-0x0000021626440000-0x00000216264A6000-memory.dmp

Download

memory/1252-281-0x0000021626440000-0x00000216264A6000-memory.dmp

Download

memory/1252-286-0x00007FF7C1B30000-0x00007FF7C2274000-memory.dmp

Download

memory/1252-364-0x00007FF7C1B30000-0x00007FF7C2274000-memory.dmp

Download

memory/1456-17-0x000001AE72980000-0x000001AE729E6000-memory.dmp

Download

memory/1456-63-0x00007FF6C41D0000-0x00007FF6C42F3000-memory.dmp

Download

memory/1456-16-0x000001AE72980000-0x000001AE729E6000-memory.dmp

Download

memory/1456-15-0x00007FF6C41D0000-0x00007FF6C42F3000-memory.dmp

Download

memory/1488-27-0x000001F4A6140000-0x000001F4A620E000-memory.dmp

Download

memory/1488-28-0x000001F4A62E0000-0x000001F4A6346000-memory.dmp

Download

memory/1488-29-0x000001F4A62E0000-0x000001F4A6346000-memory.dmp

Download

memory/1488-30-0x000001F4A62E0000-0x000001F4A6346000-memory.dmp

Download

memory/2168-366-0x0000022ABC950000-0x0000022ABC9B6000-memory.dmp

Download

memory/2168-365-0x0000022ABC950000-0x0000022ABC9B6000-memory.dmp

Download

memory/2168-370-0x00007FF795980000-0x00007FF795E87000-memory.dmp

Download

memory/2296-288-0x00007FF7671F0000-0x00007FF7672B9000-memory.dmp

Download

memory/2296-234-0x00007FF7671F0000-0x00007FF7672B9000-memory.dmp

Download

memory/2296-236-0x0000021624150000-0x00000216241B6000-memory.dmp

Download

memory/2296-235-0x0000021624150000-0x00000216241B6000-memory.dmp

Download

memory/2752-330-0x0000021DE45F0000-0x0000021DE4656000-memory.dmp

Download

memory/2752-328-0x00007FF744120000-0x00007FF7442B5000-memory.dmp

Download

memory/2752-329-0x0000021DE45F0000-0x0000021DE4656000-memory.dmp

Download

memory/2780-244-0x0000025D444B0000-0x0000025D44516000-memory.dmp

Download

memory/2780-298-0x00007FF7671F0000-0x00007FF7672B9000-memory.dmp

Download

memory/2780-245-0x0000025D444B0000-0x0000025D44516000-memory.dmp

Download

memory/2780-243-0x00007FF7671F0000-0x00007FF7672B9000-memory.dmp

Download

memory/3120-0-0x0000000002510000-0x00000000026A2000-memory.dmp

Download

memory/3120-1-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3120-6-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3120-7-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3172-291-0x000001D4C8EF0000-0x000001D4C8F56000-memory.dmp

Download

memory/3172-289-0x00007FF60A460000-0x00007FF60A50E000-memory.dmp

Download

memory/3172-290-0x000001D4C8EF0000-0x000001D4C8F56000-memory.dmp

Download

memory/3204-342-0x000001E70D520000-0x000001E70D586000-memory.dmp

Download

memory/3204-338-0x000001E70D520000-0x000001E70D586000-memory.dmp

Download

memory/3204-336-0x00007FF65FE50000-0x00007FF660171000-memory.dmp

Download

memory/3204-344-0x00007FF65FE50000-0x00007FF660171000-memory.dmp

Download

memory/3204-337-0x000001E70D520000-0x000001E70D586000-memory.dmp

Download

memory/3548-319-0x00007FF6093E0000-0x00007FF60952A000-memory.dmp

Download

memory/3548-263-0x00007FF6093E0000-0x00007FF60952A000-memory.dmp

Download

memory/3548-264-0x000001DFC82F0000-0x000001DFC8356000-memory.dmp

Download

memory/3924-251-0x00007FF762490000-0x00007FF7625AA000-memory.dmp

Download

memory/3924-253-0x000001A3584C0000-0x000001A358526000-memory.dmp

Download

memory/3924-308-0x00007FF762490000-0x00007FF7625AA000-memory.dmp

Download

memory/3924-252-0x000001A3584C0000-0x000001A358526000-memory.dmp

Download

memory/4132-299-0x000001DB88E80000-0x000001DB88EE6000-memory.dmp

Download

memory/4132-300-0x00007FF764F00000-0x00007FF765317000-memory.dmp

Download

memory/4132-301-0x000001DB88E80000-0x000001DB88EE6000-memory.dmp

Download

memory/4632-347-0x00007FF7DD080000-0x00007FF7DD30B000-memory.dmp

Download

memory/4632-349-0x0000019DE1770000-0x0000019DE17D6000-memory.dmp

Download

memory/4632-348-0x0000019DE1770000-0x0000019DE17D6000-memory.dmp

Download

memory/4644-57-0x000002213EB60000-0x000002213EC2E000-memory.dmp

Download

memory/4644-59-0x000002213ED70000-0x000002213EDD6000-memory.dmp

Download

memory/4644-58-0x000002213ED70000-0x000002213EDD6000-memory.dmp

Download

memory/4692-311-0x000002B910540000-0x000002B9105A6000-memory.dmp

Download

memory/4692-310-0x000002B910540000-0x000002B9105A6000-memory.dmp

Download

memory/4692-309-0x00007FF640EA0000-0x00007FF640F54000-memory.dmp

Download

memory/4800-47-0x00000270ABA60000-0x00000270ABAC6000-memory.dmp

Download

memory/4800-52-0x00000270ABA60000-0x00000270ABAC6000-memory.dmp

Download

memory/4800-54-0x00007FF7ED720000-0x00007FF7ED888000-memory.dmp

Download

memory/4800-46-0x00000270ABA60000-0x00000270ABAC6000-memory.dmp

Download

memory/4800-45-0x00007FF7ED720000-0x00007FF7ED888000-memory.dmp

Download

memory/4816-355-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/4816-268-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/4816-270-0x0000000000A80000-0x0000000000AE9000-memory.dmp

Download

memory/4816-274-0x0000000000A80000-0x0000000000AE9000-memory.dmp

Download

memory/5268-322-0x000001BAC3F70000-0x000001BAC3FD6000-memory.dmp

Download

memory/5268-321-0x000001BAC3F70000-0x000001BAC3FD6000-memory.dmp

Download

memory/5268-320-0x00007FF7A2620000-0x00007FF7A28C3000-memory.dmp

Download

memory/5700-37-0x000001F7B0AD0000-0x000001F7B0B36000-memory.dmp

Download

memory/5700-38-0x000001F7B0AD0000-0x000001F7B0B36000-memory.dmp

Download

memory/5700-36-0x000001F7B08E0000-0x000001F7B09AE000-memory.dmp

Download

memory/5700-39-0x000001F7B0AD0000-0x000001F7B0B36000-memory.dmp

Download

memory/5968-361-0x00007FF621590000-0x00007FF621A61000-memory.dmp

Download

memory/5968-356-0x0000023276420000-0x0000023276486000-memory.dmp

Download

memory/5968-357-0x0000023276420000-0x0000023276486000-memory.dmp

Download