5f7af5cb29119b4f7a10870b0d515d063685389352375bb1f6de4b158ea3a536

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 749KB
Sample260702-ne4xcagy6v
SHA256 5f7af5cb29119b4f7a10870b0d515d063685389352375bb1f6de4b158ea3a536
MD5 8d1775f7859bfbd8f25132a2207aca17
SHA1 853463c571f2278c1be140f1cc78b046e781136d
SHA512 6b0431ab2021072b300a46c82efb7f3fe250cd12c9cda8a335c5b6905f4e80f2eb3f7da67aa938237e2654d423e9ad8726fc6e22611e2b43b7271a8707857986
SSDEEP 12288:393G6vH9/AHubviBNDYa3uKNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9X:3VGGdWBZ+KlnOHKVnrsaGBgW59tET9sw
TLSH
T165F4021132C080B6EDB3153459718AB1957DFE301F62499F73D8272A6DB47C28E3A76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4676	alg.exe
1036	GameInputSvc.exe
5352	GameInputSvc.exe
2396	elevation_service.exe
4432	elevation_service.exe
4808	maintenanceservice.exe
5340	msdtc.exe
2112	OSE.EXE
3008	PerceptionSimulationService.exe
4768	perfhost.exe
5432	ReFsDedupSvc.exe
3312	locator.exe
4968	SensorDataService.exe
5388	snmptrap.exe
1144	ssh-agent.exe
2796	TieringEngineService.exe
2680	AgentService.exe
668	vds.exe
4904	vssvc.exe
3932	wbengine.exe
4464	WmiApSrv.exe
596	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d238b12e43a2495a.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\javaw.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\java.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009dbeaecd140add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000552630cc140add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0203fcf140add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5352	GameInputSvc.exe
5352	GameInputSvc.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	1036	GameInputSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2796	TieringEngineService.exe
Token: SeManageVolumePrivilege	2796	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2680	AgentService.exe
Token: SeBackupPrivilege	4904	vssvc.exe
Token: SeRestorePrivilege	4904	vssvc.exe
Token: SeAuditPrivilege	4904	vssvc.exe
Token: SeBackupPrivilege	3932	wbengine.exe
Token: SeRestorePrivilege	3932	wbengine.exe
Token: SeSecurityPrivilege	3932	wbengine.exe
Token: 33	596	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	596	SearchIndexer.exe
Token: SeDebugPrivilege	5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5924	2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 5352	1036	GameInputSvc.exe	90
PID 596 wrote to memory of 2360	596	SearchIndexer.exe	112
PID 596 wrote to memory of 6120	596	SearchIndexer.exe	113
PID 596 wrote to memory of 5836	596	SearchIndexer.exe	114
PID 596 wrote to memory of 3452	596	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4676

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4432

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4808

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5340

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4968

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5388

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1688 2512 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 724 2352 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 713cfb426e667be3b2f0e8c3654e3226153f0474affa86a34da8f6f37b01523f
MD5 e33c78294d7f79462b53143cbd69ba5b
SHA1 20e9cdf32df465b71ef6e98390610e4a3c4de7cf
SHA512 cb95d6194dbc5009603bd778fb7db184d66d10f77d2a5e415891369f5b756b26e8870b46757a0a1f332619bce7f7a9e3e58cf235086256f77a6c8d425be25321
SSDEEP 49152:Hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnN5OHK9rshP9t49AmT:13q6gjBi5o2sqv
TLSH
T1C0D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ee55df761e48dd9b3d6e6d1f8424a8bc3426b8c0f54ddc2135d2b173ff0eac82
MD5 544ea69cd696fa6176a6fcea60346983
SHA1 f62043fbaf86469e113b8b1996d36cfe1bb4a99e
SHA512 d555a6f4759c0c1d1b413d5cd133e10336c118e51665f6698206e4c0c55a282ffd6b5b1de75011805896bc7f7c99e435e70dec517975387e7bf834b0750c0ca7
SSDEEP 24576:WXY8DZczAAlnOHKVnrsaGBgW59tET9sq8mAw:QZcHOHK9rshP9t49AmT
TLSH
T182050129639409FCED6B823DCCA28516E67378514760E78B03E899361F337C89E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 6dcd64a3f4bc8a26d3cc6a83d20eb8a8adbbfd52c9d26ee45a9f74d18aa7d323
MD5 fce764671236efd31a460048950d412c
SHA1 3e23dc9602576c79944bddd80a9778749c876cd6
SHA512 e187cea59ad6586da7135049f16af03f52df2ce361b831ae8ba11707b2cbe23fef82c483ebe6a4eb8c4947587b66fca13606d343bf1eded2073906a08aa7433b
SSDEEP 24576:uwuuOWdlnOHKVnrsaGBgW59tET9sq8mAw:uwVOgOHK9rshP9t49AmT
TLSH
T1E905F14A72A40CF8E9A79139C5538536F7F2B8112A22CB1F17A0C65B6F77351AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 91056c95a377752c4599f5bb88ef5169e6a872ea4a9a0dd6a3f73602f4422c56
MD5 c4282f4673cf16575193782724814650
SHA1 906fcec0f2fde6cda1f1df5cd4c9a812fbafac9e
SHA512 58a78e2e80499cca945d20b5b9707cc537f13e98d2d5b3e73613de51c8338f1ff94b7e0a2e3aad84438bac66b01fd6ad8281691c025706bfe3e39bc06a81c52c
SSDEEP 49152:KP+taZ3usBWOBr4tEGp0bqx0z+n217aau1glaXOHK9rshP9t49AmT:qu6JmTxd2dIo2sqv
TLSH
T185D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f639214127dc4e6fb662c83e275d1581e8457d87b253b904e6444e142f126c5d
MD5 e359b70b18f3cb362a516a1b22009296
SHA1 0a34777fc611cbb715fd1c6b7410fb8042769480
SHA512 ab9980de8643ff7f059f7a9a5036a24ab42ba4d9c318fdcb2977db81de3269a047b516b861541278928e9e1c5d942329b0b53b6e69f8d8a20bd742a06035978a
SSDEEP 12288:R77YNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:VYlnOHKVnrsaGBgW59tET9sq8mAw
TLSH
T15FD4234B420846ACFEBF6135B52341AAA01137746F1304DB7A98B52638B8FC6DEF725D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd921b14c51a15e55853acaeb20f7f4e4b7520af57d836fe7b76eb5ff0a172c2
MD5 4b75c62e7b8143d74dddc2576444b32f
SHA1 fa3114648550e53fb332ca23405a3743810a0baa
SHA512 1dcc690ba45008ed2d29dbacfda00475602c98285b40cdab22e305063062319912e3ba32abe53664b24c40627bcd207912a071a358264128e2668abeab2a8129
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYcwlnOHKVnrsaGBgW59tET9sq8mAw:egb4mBIBhGFbeOHK9rshP9t49AmT
TLSH
T1BF65AE1E22EC02F5E4FAD2B8DDA64417D6B278161732D2DF1250422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 c634a6300edc654c3db9e5e685a765e1f51d262442dd551a86bc81910e83655e
MD5 14a7ba48e431d0196d65b3e77ad616d4
SHA1 abd2e3479ce6564f73a067af3bba431a8e394177
SHA512 4e40802d5ec4fc57d32506fb62a8634ab3ee8e24b658d0c0b2972bdd515813bc1cd9a89d992db7f40ac322e0e69a230155177408d3dbe30933cf4822ee78849b
SSDEEP 12288:WpGhNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:yGhlnOHKVnrsaGBgW59tET9sq8mAw
TLSH
T1AAE4235E216421ECDD7F8239E83245A7F4B132706B1205FF09D4F4365EB8AC1AABAD5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 dbd03fae6c776f8fd27040757e8dff546cec8df26c0c0b6e302214d4ebe310ec
MD5 7e75ee4d4be23b38c56fc7b408e967de
SHA1 b13d61f005607f40b0d787d57e16f498b83afa72
SHA512 9be9f3737da8d692703534245100d8f9c06cb858740e9aef3148aae048a77018de16597b46b5af97816dda57146a2ecd9e681d9cc0725a00aab699a60bce9e7f
SSDEEP 12288:2wNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:2wlnOHKVnrsaGBgW59tET9sq8mAw
TLSH
T160D4234E410842ECEEAB553AB423469AA15137606F1305DB2AD8B42724FDFC7DEFB16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 40e7462036ebbe4e6b1c17f8c13a401aa59d9033c4eadfd82321879484546f37
MD5 e08cfea79380f35d469d1cf49604a377
SHA1 1fa1b561e5cc68f6eb410ce70cd58030adf05724
SHA512 d17180c543174666a556447bd406a175b51bb33dd893e9f4e3967a3d7a929f52b3881e876855c6a39aa55ad6566387bf938d521775e4bd89b09c23aedd05d043
SSDEEP 24576:IAf8E8KpJqH1tEria7/mmlnOHKVnrsaGBgW59tET9sq8mAw:ZULKPqVva7/XOHK9rshP9t49AmT
TLSH
T13E35F16566E002F4D87BD138894246A3F6B2B4251321EFDF07AC8A561F23BD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 5ec4559ab40bf9c585c7a68ce0d2b39a72f154794c6fbf515157530fb86b7c5e
MD5 50b5bd91862244623d4036c4ace416b0
SHA1 212778163e90f10ef983c436b29e38d8cb7e2fa1
SHA512 1fcc4fcbe4af33d3ad678980f108ab478eae43fb29d5febd89c924681e791fb1a155ae80b8160e32a4d49c5ef9c2021217e5d1412ae81eaa079fa3cdc227b00b
SSDEEP 24576:0PUr+NQMlnOHKVnrsaGBgW59tET9sq8mAw:0JQyOHK9rshP9t49AmT
TLSH
T18E05E11F22AC18E8EA7BE17D99424719F7717462171292CF02E0817E1E67ED8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8afa1b6209bda6a99fea9125d18bc3e67993bd8938491179d3647f03cfb3a633
MD5 29e64f3c9dcfd190d3b57e6af4ed23ea
SHA1 4da0e6dc5a78e853fa3a4d6644fb9bb9ef95bc67
SHA512 b0477c7d0464577c23edde9e1ad7828b5d04496d1a2f684ff8fa5a3f475ee1e0654d3a27cb9f81c4ea77492ea0eface755e5397e4fb0a6d7853b3cb4a1e3076b
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAOHK9rshP9t49AmT:eG05lO43bFo2sqv
TLSH
T109D5CF6E62EC11F8D1BBD17CDA86460BEBB23425033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 0f44b220e4d5fa3cfd3589ac1e767edd587eada37c769ed28a00ced7fb3d8e2f
MD5 bfa05acef9695b9263f38b88b8e90f9a
SHA1 e5e7ad639ddad6b93113c8bbf73b01fdcc5403c9
SHA512 21ffb7cc8022b6f9a6ea2f318e2cb067cb30f5c79404c5fee1433beaa479f0b1204e448566edde8705b68dbc30550cb0f9b012cbffc20cc93b096e857aa632f6
SSDEEP 24576:Vfa5POZ3dpbWVM50JicR2hG0lasx2+47eidnrhlnOHKVnrsaGBgW59tET9sq8mAw:Ra5POZ3wJt2pasx2+mpOHK9rshP9t49p
TLSH
T15B65AF5EA2FC01D5E5B9D17DC583461AE5B1342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1518d5842c21522b32d6f07b409d0b2d9d292c08aa365fa92ce16cb25905626b
MD5 d66d64d1f08d15b18720b0ad59925aab
SHA1 389af84e860798a68e8d2b6323b82113a023f910
SHA512 b80d3aa43b5882996459f1fba8105673134fd62cde7756f5b75f7ce90c33c3386db98790d96aaf3fcce6112836a02bda3234f738841050655460b7cebab567e6
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkOlnOHKVnrsaGBgW59tET9sq8mAw:lNc/zEOVHF3OHK9rshP9t49AmT
TLSH
T1B6858B1623E901E4F5BBE1BE89779546FAB1786517308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 3134b27ff242fb3d0e7090e08f40cd1bd9fb9eacdecd24f99ee42dbe3059dd6d
MD5 14a949775b1a2a34801c36b51529d431
SHA1 8dbb27eb4993594a4970ea30cea721f7a099afb6
SHA512 3c879c809573251a19b9a2a6ed9fe263b88df0e651cfd02fe6bccbbf526f38edb7339d208f8a2542428056e9074755d618152682cf9140cd943399e4af46f1ba
SSDEEP 24576:lJnJPbzB4SIlnOHKVnrsaGBgW59tET9sq8mAw:lJnJv6S2OHK9rshP9t49AmT
TLSH
T18F15D02DD2A810E8E8B7C274811A175AFE71387C2F2269C719B4D5353F52FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 374ff8377f0afb613c9347382cc58da4669034e3645abed13a341367caa7e26e
MD5 c05006a55f909bb632ccbac213736851
SHA1 776d3f5a194c72473dbc67f045e6d6908460b900
SHA512 34630455e5e187de7e97f6f1e077d8c79264f87e95d600d101c573be204440abe9a24fd5d1edaf15640f61046d3db81db645f0e2781bd51540f92d7d05c64a07
SSDEEP 49152:hCLHGeeV5ijCmlDWDkFOHK9rshP9t49AmT:Y3o2sqv
TLSH
T185A56B05A7EA5184F8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 e959f0cc76b94dc7f7349125d7d5112fa958c472077b2f9c911490e7a3172cb3
MD5 a660aa6838c8c489a61a0d3c3601bf8f
SHA1 4f266e986a102c0d996a1f94c180348458ef21ef
SHA512 46b748c87212296dd8545c5165a52aa8691ee38e7c21e1afc0e7db2f01b83c4003f401db90188f8531e5b17b8d5d25b765af19095392ea1c901ad03681889510
SSDEEP 12288:hwHrkUj5ZI7IINv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8Kdi:NUDIblnOHKVnrsaGBgW59tET9sq8mAw
TLSH
T1B405014D233A10F9D5ABD03ED5930142E2B2B17097231ADF0BD8D57A5EA3EC9B93DA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 9e1e812a24e8cbd8c8c9fcea00cd386435fe5af4694f793f33449ad369a51c1e
MD5 6fc8b787dce64d9b6a9d081cf054e398
SHA1 9a51e8fc3d085a466dd06e5c0b942864cfb6416e
SHA512 88451025f1125a8136f5f9b7a42f413d79c4bf56a4237cc81973b62bbf93c52d276152febd2bda175262213e4bfba7ade9e992cac2f81f38bd697f64eda7d78d
SSDEEP 12288:9G6kyiNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:EtyilnOHKVnrsaGBgW59tET9sq8mAw
TLSH
T15AF41209535851D8EEBB1238E93341A59A317C206F2202DF26D0F63F2E7ABC5ED76719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 ee4b6fb8d5b8f639de765ce3da6d6bef4098f897af6667b57721d91c30e1c6d3
MD5 e2c28ff32503614c28620049f9b0cd5c
SHA1 66b0d490fffc89a01ac0dff112a9f29bd6e2c4b3
SHA512 9385f02aaba7795bc9aa4d2e5d4abaad70da4792a7da2c23b9164b123980b225f857aaeae1d84dfc896a12949d3f600e04d43d03addd9faba6ebad2a0c592d46
SSDEEP 12288:Yr7Nv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:g7lnOHKVnrsaGBgW59tET9sq8mAw
TLSH
T15ED4234E520452ECEEAB5239B423469AD06132702F1305EF2AD8F43629F9BC6DEF755C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 294467dd36b7eeb96b822555186ac92206055946f7742fc7ed4504839f90862d
MD5 3441b4899c2a02446e490f7587867196
SHA1 61e9bda24639101d7d6fdc641b121affe793f84f
SHA512 f06f25b3a2a78be57270e477d7584eed9d4432c93f046f1207602b60f30d7c101759594e4eb1f01e7b93bff7250539bb6fad2586cdc0a9bfc099e95d92a2e98e
SSDEEP 24576:BGgNuoTfaidZZlnOHKVnrsaGBgW59tET9sq8mAw:og9TrZPOHK9rshP9t49AmT
TLSH
T1F9558C1D63EA05DAE2B2D239D8721493D633B4315772C6DF2448C03A4DABED8AE75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 f10817676d4926b2ba78cbe6ac22b4d80c27eea086059f41d64dc2ae7638a207
MD5 042fe9c26c07598ed5ead31931c2da9f
SHA1 a53acad15494f6d96fa9636a7dfe05591b1dc410
SHA512 133ab55dd395dda91cc57da2ebe7be0699ff8ac108ae2927b163fac31a275840733c2b07b941230572f3e317c74f4edec5fc44ce0c95e01dae88ecc5c807489e
SSDEEP 24576:sUrcmR/lnOHKVnrsaGBgW59tET9sq8mAw:zcmRVOHK9rshP9t49AmT
TLSH
T18A05F14EB26E00E9E5BB813CC8424556F6B37030671217DF06A0C77E5E67ADABE39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ef55529c942ba23228188ba821df97569b80be667d55cde67d982fecccc9e197
MD5 34cf4860eb2efe55ec94bc9e1e39eedb
SHA1 51fd1a78c308ddc948dfb5b4dbcc5a9d440ee1bc
SHA512 50c1018f4027ad3701320f1082317b02f7db693b7e830ba2e56ccee5573c16353fdbf10ad352c1c89f3c557d82d3159d7d4f9f16e269ee1db97f2b08fdc7aab0
SSDEEP 49152:sDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3dOHK9rshP9t49AmT:p3Upow8sB4o2sqv
TLSH
T11EA58C3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-228-0x00007FF61CCF0000-0x00007FF61D02F000-memory.dmp

Download

memory/596-229-0x0000024E1F8A0000-0x0000024E1F906000-memory.dmp

Download

memory/596-230-0x0000024E1F8A0000-0x0000024E1F906000-memory.dmp

Download

memory/596-249-0x00007FF61CCF0000-0x00007FF61D02F000-memory.dmp

Download

memory/668-185-0x00007FF7130C0000-0x00007FF71334B000-memory.dmp

Download

memory/668-186-0x0000020671790000-0x00000206717F6000-memory.dmp

Download

memory/668-187-0x0000020671790000-0x00000206717F6000-memory.dmp

Download

memory/668-217-0x00007FF7130C0000-0x00007FF71334B000-memory.dmp

Download

memory/1036-27-0x000002450E810000-0x000002450E876000-memory.dmp

Download

memory/1036-62-0x00007FF732C90000-0x00007FF732D59000-memory.dmp

Download

memory/1036-26-0x00007FF732C90000-0x00007FF732D59000-memory.dmp

Download

memory/1036-28-0x000002450E810000-0x000002450E876000-memory.dmp

Download

memory/1036-29-0x000002450E810000-0x000002450E876000-memory.dmp

Download

memory/1144-203-0x00007FF7AB5A0000-0x00007FF7AB843000-memory.dmp

Download

memory/1144-156-0x000002B8C6700000-0x000002B8C6766000-memory.dmp

Download

memory/1144-157-0x000002B8C6700000-0x000002B8C6766000-memory.dmp

Download

memory/1144-158-0x00007FF7AB5A0000-0x00007FF7AB843000-memory.dmp

Download

memory/2112-87-0x0000018734750000-0x00000187348BB000-memory.dmp

Download

memory/2112-88-0x0000018734A20000-0x0000018734A86000-memory.dmp

Download

memory/2112-89-0x0000018734A20000-0x0000018734A86000-memory.dmp

Download

memory/2396-47-0x0000026883400000-0x0000026883466000-memory.dmp

Download

memory/2396-46-0x0000026883400000-0x0000026883466000-memory.dmp

Download

memory/2396-45-0x0000026883130000-0x000002688329B000-memory.dmp

Download

memory/2680-181-0x00007FF7493C0000-0x00007FF7496E1000-memory.dmp

Download

memory/2680-179-0x0000027D24960000-0x0000027D249C6000-memory.dmp

Download

memory/2680-175-0x00007FF7493C0000-0x00007FF7496E1000-memory.dmp

Download

memory/2680-173-0x0000027D24960000-0x0000027D249C6000-memory.dmp

Download

memory/2680-174-0x0000027D24960000-0x0000027D249C6000-memory.dmp

Download

memory/2796-166-0x000002A5E0AC0000-0x000002A5E0B26000-memory.dmp

Download

memory/2796-213-0x00007FF7A5D40000-0x00007FF7A5ED5000-memory.dmp

Download

memory/2796-164-0x00007FF7A5D40000-0x00007FF7A5ED5000-memory.dmp

Download

memory/2796-165-0x000002A5E0AC0000-0x000002A5E0B26000-memory.dmp

Download

memory/3008-99-0x00000255BACF0000-0x00000255BAD56000-memory.dmp

Download

memory/3008-98-0x00000255BACF0000-0x00000255BAD56000-memory.dmp

Download

memory/3008-145-0x00007FF75C000000-0x00007FF75C14A000-memory.dmp

Download

memory/3008-96-0x00007FF75C000000-0x00007FF75C14A000-memory.dmp

Download

memory/3312-127-0x000001615B280000-0x000001615B2E6000-memory.dmp

Download

memory/3312-126-0x000001615B280000-0x000001615B2E6000-memory.dmp

Download

memory/3312-125-0x00007FF6E6970000-0x00007FF6E6A1E000-memory.dmp

Download

memory/3312-182-0x00007FF6E6970000-0x00007FF6E6A1E000-memory.dmp

Download

memory/3452-286-0x0000028F6EFE0000-0x0000028F6F26B000-memory.dmp

Download

memory/3932-204-0x00007FF7952C0000-0x00007FF7957C7000-memory.dmp

Download

memory/3932-205-0x000001DC94230000-0x000001DC94296000-memory.dmp

Download

memory/3932-240-0x00007FF7952C0000-0x00007FF7957C7000-memory.dmp

Download

memory/3932-206-0x000001DC94230000-0x000001DC94296000-memory.dmp

Download

memory/4432-54-0x0000026A41C50000-0x0000026A41DBB000-memory.dmp

Download

memory/4432-55-0x0000026A41EE0000-0x0000026A41F46000-memory.dmp

Download

memory/4432-56-0x0000026A41EE0000-0x0000026A41F46000-memory.dmp

Download

memory/4464-246-0x00007FF7A6310000-0x00007FF7A643F000-memory.dmp

Download

memory/4464-220-0x0000021771AE0000-0x0000021771B46000-memory.dmp

Download

memory/4464-219-0x0000021771AE0000-0x0000021771B46000-memory.dmp

Download

memory/4464-218-0x00007FF7A6310000-0x00007FF7A643F000-memory.dmp

Download

memory/4676-17-0x000001FDB84B0000-0x000001FDB8516000-memory.dmp

Download

memory/4676-18-0x000001FDB84B0000-0x000001FDB8516000-memory.dmp

Download

memory/4676-16-0x000001FDB84B0000-0x000001FDB8516000-memory.dmp

Download

memory/4676-15-0x00007FF7FB7D0000-0x00007FF7FB8F3000-memory.dmp

Download

memory/4676-51-0x00007FF7FB7D0000-0x00007FF7FB8F3000-memory.dmp

Download

memory/4768-155-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4768-111-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/4768-106-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/4768-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4808-64-0x00000293BEEA0000-0x00000293BEF06000-memory.dmp

Download

memory/4808-72-0x00007FF68ECF0000-0x00007FF68EE58000-memory.dmp

Download

memory/4808-63-0x00007FF68ECF0000-0x00007FF68EE58000-memory.dmp

Download

memory/4808-65-0x00000293BEEA0000-0x00000293BEF06000-memory.dmp

Download

memory/4808-70-0x00000293BEEA0000-0x00000293BEF06000-memory.dmp

Download

memory/4904-193-0x00000274D6F70000-0x00000274D6FD6000-memory.dmp

Download

memory/4904-225-0x00007FF702D70000-0x00007FF703241000-memory.dmp

Download

memory/4904-196-0x00007FF702D70000-0x00007FF703241000-memory.dmp

Download

memory/4904-195-0x00000274D6F70000-0x00000274D6FD6000-memory.dmp

Download

memory/4968-211-0x0000021C17140000-0x0000021C171A6000-memory.dmp

Download

memory/4968-135-0x0000021C17140000-0x0000021C171A6000-memory.dmp

Download

memory/4968-194-0x00007FF6EE2A0000-0x00007FF6EE6B7000-memory.dmp

Download

memory/4968-140-0x00007FF6EE2A0000-0x00007FF6EE6B7000-memory.dmp

Download

memory/4968-212-0x00007FF6EE2A0000-0x00007FF6EE6B7000-memory.dmp

Download

memory/4968-136-0x0000021C17140000-0x0000021C171A6000-memory.dmp

Download

memory/5340-76-0x00000250AA9F0000-0x00000250AAA56000-memory.dmp

Download

memory/5340-77-0x00000250AA9F0000-0x00000250AAA56000-memory.dmp

Download

memory/5340-75-0x00007FF7FAB40000-0x00007FF7FAC5A000-memory.dmp

Download

memory/5340-134-0x00007FF7FAB40000-0x00007FF7FAC5A000-memory.dmp

Download

memory/5352-38-0x000002192AF50000-0x000002192AFB6000-memory.dmp

Download

memory/5352-93-0x00007FF732C90000-0x00007FF732D59000-memory.dmp

Download

memory/5352-36-0x000002192AF50000-0x000002192AFB6000-memory.dmp

Download

memory/5352-35-0x00007FF732C90000-0x00007FF732D59000-memory.dmp

Download

memory/5352-39-0x000002192AF50000-0x000002192AFB6000-memory.dmp

Download

memory/5388-200-0x00007FF79AF20000-0x00007FF79AFD4000-memory.dmp

Download

memory/5388-148-0x00000247ECED0000-0x00000247ECF36000-memory.dmp

Download

memory/5388-146-0x00007FF79AF20000-0x00007FF79AFD4000-memory.dmp

Download

memory/5388-147-0x00000247ECED0000-0x00000247ECF36000-memory.dmp

Download

memory/5432-120-0x00000171F5640000-0x00000171F56A6000-memory.dmp

Download

memory/5432-118-0x00000171F5640000-0x00000171F56A6000-memory.dmp

Download

memory/5432-117-0x00007FF7979F0000-0x00007FF798134000-memory.dmp

Download

memory/5432-172-0x00007FF7979F0000-0x00007FF798134000-memory.dmp

Download

memory/5432-250-0x00000171F5640000-0x00000171F56A6000-memory.dmp

Download

memory/5432-252-0x00007FF7979F0000-0x00007FF798134000-memory.dmp

Download

memory/5924-0-0x0000000000270000-0x0000000000387000-memory.dmp

Download

memory/5924-37-0x0000000000270000-0x0000000000387000-memory.dmp

Download

memory/5924-7-0x0000000003170000-0x00000000031D9000-memory.dmp

Download

memory/5924-1-0x0000000003170000-0x00000000031D9000-memory.dmp

Download