42f8158b4d50887df6b5db821e7ae233337758c4ef622916a23f460660750111

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 748KB
Sample260708-e6jwtabw5q
SHA256 42f8158b4d50887df6b5db821e7ae233337758c4ef622916a23f460660750111
MD5 6bbf77187141b60fd80910950f3e1fc2
SHA1 ecb57af40d59a9c8dd45de2991768f7ade204060
SHA512 1fe5234d0990a76d929c37132fbccbb57ce15b1cb946a9d1622f0dca82e818d5935ae8959a6eba495fcf5d8535917397b0c2c33b8f294e5b9d8dd1e741ed306c
SSDEEP 12288:x93G6vHzOASubviBNDYa3Yp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPI:xVGGTWBZIp8SXdo8ke5i5Xh6wnBLTHTQ
TLSH
T17BF41211B6D0C872E5A3093019B48D617A7EFA304F794B9F23981B6E5E703D64E39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3564	alg.exe
804	GameInputSvc.exe
1736	GameInputSvc.exe
3460	elevation_service.exe
4444	elevation_service.exe
2748	maintenanceservice.exe
3144	msdtc.exe
5916	OSE.EXE
244	PerceptionSimulationService.exe
5528	perfhost.exe
2464	ReFsDedupSvc.exe
3320	locator.exe
2648	SensorDataService.exe
3980	snmptrap.exe
1536	ssh-agent.exe
3556	TieringEngineService.exe
4736	AgentService.exe
2852	vds.exe
5284	vssvc.exe
1592	wbengine.exe
4980	WmiApSrv.exe
5608	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\509c1207f4cf0ea5.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\java.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0ccdcfc920edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031ed38fb920edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d6349fd920edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000910e9f9920edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1736	GameInputSvc.exe
1736	GameInputSvc.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	804	GameInputSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3556	TieringEngineService.exe
Token: SeManageVolumePrivilege	3556	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4736	AgentService.exe
Token: SeBackupPrivilege	5284	vssvc.exe
Token: SeRestorePrivilege	5284	vssvc.exe
Token: SeAuditPrivilege	5284	vssvc.exe
Token: SeBackupPrivilege	1592	wbengine.exe
Token: SeRestorePrivilege	1592	wbengine.exe
Token: SeSecurityPrivilege	1592	wbengine.exe
Token: 33	5608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5608	SearchIndexer.exe
Token: SeDebugPrivilege	5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5868	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1736	804	GameInputSvc.exe	90
PID 5608 wrote to memory of 5044	5608	SearchIndexer.exe	112
PID 5608 wrote to memory of 5160	5608	SearchIndexer.exe	113
PID 5608 wrote to memory of 1196	5608	SearchIndexer.exe	114
PID 5608 wrote to memory of 2388	5608	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3564

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2748

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5284

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2700 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2852 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8e4d9cfd60233cfc6f12c871f4061f7c39173f210c67e8df9c0df12923c486f1
MD5 e45225e74892a0e03e58d4b64fd57d93
SHA1 3e814941cabd02562f8d9d9ea74873cb8d1dede8
SHA512 5b6ec13bf0cf2850a585ebb029e346ff799e89750b8abe361a030257170011ab1a967f56159365606047559f15a36be674fbb6b9908c3e81a269305951b761b8
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxndWS1SZBnHTAsi:/3q6gjBqcNzAz
TLSH
T18ED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ea2b63cba04a26b7de3d724ea492b4c3daa3ede07224127b2f1585761900a2b2
MD5 2b2890cf96f1c5ba5c28cbaac248b8c9
SHA1 7afe4c8b2becf357a56b6b16ca77ce300bb0ef19
SHA512 5fbebe4b91ca20e08272acedf3d25706ccda60f19d28b18b7599e27f7e6b1b8837ed4548dc96534ade9b37725984280bd11a39bea24c7f6c4d37a6f60055a346
SSDEEP 24576:6XYhztczAcp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:LtcdWS1SZBnHTAsi
TLSH
T1DD05F128A7E009F9EC974239D9A18405FB73B8518764E74F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 33781dd83b9226b2ea4baa30845c7a59148918df5a55c5e70630860c98705fad
MD5 b7f6f055bdd5c303d87ed58947d8c4b8
SHA1 a8d16ac3bb450812cf42baa81bb12804b17259e5
SHA512 6ca72823822c7d83981fa90b98316c788abffbd1f3e755c842afbb71ff57fe008770b1f344757a5ff5f6cef6d9d35b9e372c6ac273181cbb46dd33d387f06092
SSDEEP 24576:UwusOWNp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOuWS1SZBnHTAs
TLSH
T11705F14967A40CF9E99642398557C436F7F3B8122A25CB1F0760C75F6F33365AE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 de609550d1276b5ab61aa43a00d6d96ffb3ed8c8fe9d232be31674a39751ffc5
MD5 95e2d4167a9ab591cb45f20e5197b940
SHA1 babac1feddccaeb5a93daae8f4d8697f38444f9f
SHA512 557e4d5ea24e2bac2e55866ce2c780f0abb7a75c008e0132383adc058153cdb085c36059cb198a5e04f5e58f1169a63155f3b28e16236f2befc544c882c37a7d
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1WS1SZBnHTAsi:su6JmTxd2d1cNzAz
TLSH
T130D59D13F2DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 8d95cde5ded77ab7b19521f572e85237b7c36eeeb91e6a96fd5cdc7867c61f22
MD5 79c3ca3a6dfea3f836e6381db7c27e39
SHA1 f4a551514b27b2008ac52cc4796acc2cb0c6fa0e
SHA512 8e3950dfc4da962f6b6fab64c07e1cebf33932ba057d92d9a00bbde9cb15801b483554202ee6e4710ba91f3290b0a24c1f19ce8c4a2750a0a32f3e1c05bcc047
SSDEEP 12288:jl7Tp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:JTp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T18CD42319CFA58E24F4880A30357C480CBBBFB371CF29474F6658664E7A726DD5EB1A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f6ed2128e4c2b026f765f6b555655515f8c3f1dc8fd46195d43347345eec7558
MD5 665f68b1776792ed86c9166df7b782bd
SHA1 fcd34e3e0fc28475a47d935d767fbbf3ab4af7ae
SHA512 d4593192fd8d208b4a07d78815054b507d6cc51e1f4d219bac009d528370c5d63376b9aee917b2bf86795494d89cd6f3fc3486e99d7c48f6126556dc1a677c2e
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYpmp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Lgb4mBIBhGFQmWS1SZBnHTAsi
TLSH
T14E65AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 b5d11bd48167fa993e7dab9d05176d5effc24f5029de8f28e6ee4dfeb4ba4024
MD5 59f2eeee5246f44c85ce0cefa4c688c0
SHA1 4dadce8d253d1a94796ea6c8202cb55bb4f5d769
SHA512 c3bce89836dbc903e1d09bf107c8507c825bc5c670d57205ab89b4096480a662ad44f03d2f39594b864ffc812aecaeede4b6f54f11325025c6ff53b8c137beb3
SSDEEP 12288:7ZGXxp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tGhp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1CBE4231C8AF549A4D86847356434480EBAF333718B2917DF0AE4E53EAF626EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1125bed368086044d34c778cde0f7bbc7ed9d12e109670e6a17a71eeb0780b45
MD5 e6b792af348104e42ecd7197e21fb21c
SHA1 3565cf0d4d048ac2cd017c38211a584f3e8471f4
SHA512 e3db5dea90c4248c2a423d705a8bf275d59d9cf4c2d146769fc34a4ab65f2ff344340d465be5793a41c869d71d0507e5deb3bae4ed25e6f24a2c23fabe5b3765
SSDEEP 12288:S5p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:S5p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T195D4230CCE658E64E5C40A3135384C0CBBFB6322CF6E07CF1698A64E66676DD5F75982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bf72212acd20af11be9e816591631cdb603f8c65ba6c55e9e51be4046878b68a
MD5 9402aaf1e88aceb2e1e0eec646eb90b2
SHA1 7dd037945ce95e8ede36e00583f2c5673b564d0c
SHA512 df893dbad0a4792d2578162192c769b8522a06af9e80a9f7521c578010a1d3173378228231067904eba77a3296b5f6ae22d7b1a22fd4a4df13ce9a86e91c2bf6
SSDEEP 24576:dAZ8u8FpJqH14zria7/mxvp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yeZFPqVna7/svWS1SZBnHTAsi
TLSH
T14435F165A7E002F0D47BD1388A464657F6B2B4210364EBDF07AC8B551F23AE90F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 c27470fd1537b8fbdf89aad2c60737ebefc8757bd1e524d4fcfea91e869b7224
MD5 a1706e65dcd5bcf1d22a6bfa2b275d87
SHA1 df4fe515b4f09a68eb871bb45e7433bfc006a654
SHA512 8ee1287036dd9c630784803f3d6ed14117da088a0ce85bee25af49082e3aeab0585a17ede53d756ea0e07bd068b382bd4c4810ccdf01ed9e6203ed572ada87ec
SSDEEP 24576:iPUr+NQ7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQ7WS1SZBnHTAsi
TLSH
T10105F12F66A90CE4E676A13D8955860DF772B462471293CF02E0817E5F63EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 cfab19e174669418aec85d90ebaf6b3df6829cb8e8a61dd1bae96fec019cfe98
MD5 73ce4fc44ce9a53fe34762b2329ed539
SHA1 9ba1dee55fc0769ce02f0962bc2d1373332ad05b
SHA512 5152d24d95408c4e3ab138f8fabaee390cf96b59b12c5b27f80fb31e689c053dbfad4b4ec97d9785d391358b5e06a86e2df87b702da74e9aa3a92e3941fcfad0
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPWS1SZBnHTAsi:OG05lO43b+cNzAz
TLSH
T1B9D5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 780bb974531ff65ba9bbeb419dee8f41d7166f97635812477dca9b6555abcae2
MD5 a9dced3dcec62a3d0da2cdd74a2f4861
SHA1 2268f298638d39bf42468649cd08299dfbcfe2e4
SHA512 944e5021a33b1e43eec3fea1e376da44f08245358f53fab83e150ec0de04ce66807ce0158cd67886378c3072fe7ee1b2fe9d3184baf7c717e24d328baaf41014
SSDEEP 24576:FMa5POZ3dpbWVM50JicR2hG0lasx2+47eidngcp8SXdo8ke5i5Xh6wnBLTHTAcZi:Wa5POZ3wJt2pasx2+mScWS1SZBnHTAsi
TLSH
T1F865AF5EA6F801D5D5B9D17DC583461AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f03af6d640347c4343459ecf811ffa5a3d7045f36967cf693ca78163c83159b4
MD5 dff8fe8a635aa8b0ae49d46404441fb3
SHA1 7206c09f486918edafe3c539d2a538c7ea98a1ec
SHA512 2330016d7971be8ebc3981e480aa4b61ae35335eb4e4902a4d2accf99fa273d8456766520247943fc5286602df4b741a69b2f5cdda0245dec2d2647513d55ab9
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkDp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHFAWS1SZBnHTAsi
TLSH
T195858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 0554a8e3e28dcdd402b77d7de8e4be36840d93b1f1aae0a23feb63ffbbddffc1
MD5 f6a1833f57e3909992256a68da5202c0
SHA1 202e9a2169d14c4e1166d5bfe1ed609b1bc896da
SHA512 d09aa97fa720808f66191cda420d0edec89713b83c15f9229305e6ec3f41e1840ced7b3f4052435afec03a6b8a904dc424e83f87dda06587b375710a05aee82a
SSDEEP 24576:MJnJPbzB4Sq8p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MJnJv6Sq8WS1SZBnHTAsi
TLSH
T1E815E03DC2A800E8E4B7C27481191A5AFF71347D2F2669CB19B4D5353F12EE4AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 911bb646f471bd6d5645494761a23e79e8b642f54512b4545e362f3212361dab
MD5 db52af0971279c0fc1fcfe466a7597b8
SHA1 24c626a7bb62b3332524837f84cc4dbbfb5de033
SHA512 d9427ac7251889b9ca873b4554355f5376cf93aa2cff8ab83fe4d2f111184b0ddd36f1837685fe3325351e8f5cb70f0561375f30ded1fe61c14066c97b0b5dd4
SSDEEP 24576:8CLHGL0MoeVtFumTijCmlKQWDkDap8SXdo8ke5i5Xh6wnBLTHTAcZQ/:8CLHGeeV5ijCmlDWDkDaWS1SZBnHTAsi
TLSH
T1B0A56B05E7EB4184F8F3CAF5CA2694169A327C509B34F7DF4A80CA6A1E32BD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 2ede7310718c186fc5516fc90ab330207a5625bb5263922a10e4643579a0df1f
MD5 64aad81ac6ee1e4a2d5c90bc4506a9b2
SHA1 d39a8affa1aa0b9dae3cd9ee5bdb9507b9bf94dc
SHA512 f6f1afcb1a25600fc1925560b2e813b8bd624bf2c3847998dda2b8d9f7f3515d6398be7f940ed76a60ba506ff21b741d8c85473d004285346785beebcb45daa6
SSDEEP 12288:q1Hck6j5ZI77p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:W6DIvp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T15BF4F15C637A01F5D0AB903A96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBE39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 0555dfc28ddb086825171a90a200a13e93b80a2898fe43e34c7abf96d741b3c0
MD5 27021eaee39ca8570f955f3ff864b299
SHA1 e61f833061ee3d9ca3808097b96d67a101feb96d
SHA512 7f772c133ee40b2682d2f685bd67394ae264904a403de1b9fb4944087e9f51271638d2e134914c83c9bb7cdfbe4dd15b571a3e95719ceaf15e4a5b1e0f76917b
SSDEEP 12288:dG6kyPMp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:ktyPMp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T179F4120887A449A4F9A90634AA754448BF76B9318F2647CF16D0E72F2F327DCAD31F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 6495e33591299c27fd4eb901ab607d6d8a2125b5f5693da4232f9c7aa76b9516
MD5 56ad7e8ee83cf6eac9c24aef4fed8ba3
SHA1 6cd1303044f46235e0acb733e5906df0110630a6
SHA512 27be0b6292b0cfa60e2d4803e11cc47c6239deb03a13528240e96bf141a1f9917d2140394a19d49e57665d6598d2611d5837584aa6793a2d3fb0d04155b327a1
SSDEEP 12288:LIfp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Ufp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T17FD4235CCA658E64E8840A3135384C0DB7BB73728F2A07CF1AD8AA6E5B632DD5F71D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 f0dd95bf90c5124fe36db322c6c985ffbf938783b193ab030bb040a0e8b6566d
MD5 c0254a02d46d2a533f47ef97d877af2d
SHA1 497d7ce7b104dc5cddfb4f251997b406074412f7
SHA512 8709667bf5108a3c364bfefa8b124b41f9a90b44b3a648717a68e0c24e52e510eea1b0cf5bb822c1bd9dbb809fa036838286630983c896b485eb1aa96e6e8296
SSDEEP 24576:tMgdLoTfaidZGNp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:egyTrZGNWS1SZBnHTAsi
TLSH
T14E558C1DA7EA09DAE2B2D635D8621493D633B4315772C6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 c444adac84a0cc8768c308ee7ace24de344cc1d56c6a5cd78239d5183a32b79a
MD5 794882d54161e822a75f0f440ab1cc8b
SHA1 807ab0b925ba2a28092ca4dc5def786613c83127
SHA512 850a06cb79aacb3041594dd3deb1e2bb9c387211957d949529d542f917466cc2e4edeac645099b58b89640cf2cef7a99e841a91fd4b8ee9c9ab9b612711f57cb
SSDEEP 24576:KrcmRjfp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:scmRjfWS1SZBnHTAsi
TLSH
T11805F14EB7AE00A5E1B7823C89544509F6B3B031572227CF02A0C77E5E67AED7E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1bfe53201b387e3256a5ee27be4d0f827f2d338abf30d597fbceab38b45da5d6
MD5 d99617371f12f4a52759209e33694850
SHA1 737b35b4e360e371914600eb0bc4c948ef212b69
SHA512 e0344ba0cd9bd2caabb6d1c6b53ddd468a275e6876e7ef1df44aedb2414dcca0c91e21c90ddf8d0db5490d074355c36888877396d8c5414a1f84a6955155d6b6
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3k5WS1SZBnHTAsi:j3Upow8sBX5cNzAz
TLSH
T15DA57C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-99-0x00000211F3BC0000-0x00000211F3C26000-memory.dmp

Download

memory/244-154-0x00007FF789230000-0x00007FF789379000-memory.dmp

Download

memory/244-97-0x00007FF789230000-0x00007FF789379000-memory.dmp

Download

memory/244-98-0x00000211F3BC0000-0x00000211F3C26000-memory.dmp

Download

memory/804-28-0x00000279918F0000-0x0000027991956000-memory.dmp

Download

memory/804-27-0x00000279918F0000-0x0000027991956000-memory.dmp

Download

memory/804-29-0x00000279918F0000-0x0000027991956000-memory.dmp

Download

memory/804-26-0x00007FF7B7250000-0x00007FF7B7318000-memory.dmp

Download

memory/804-74-0x00007FF7B7250000-0x00007FF7B7318000-memory.dmp

Download

memory/1536-155-0x00007FF78BB60000-0x00007FF78BE03000-memory.dmp

Download

memory/1536-157-0x00000230D8910000-0x00000230D8976000-memory.dmp

Download

memory/1536-212-0x00007FF78BB60000-0x00007FF78BE03000-memory.dmp

Download

memory/1536-156-0x00000230D8910000-0x00000230D8976000-memory.dmp

Download

memory/1592-248-0x00007FF67F190000-0x00007FF67F696000-memory.dmp

Download

memory/1592-202-0x000001F717820000-0x000001F717886000-memory.dmp

Download

memory/1592-203-0x00007FF67F190000-0x00007FF67F696000-memory.dmp

Download

memory/1592-204-0x000001F717820000-0x000001F717886000-memory.dmp

Download

memory/1736-95-0x00007FF7B7250000-0x00007FF7B7318000-memory.dmp

Download

memory/1736-38-0x000001D600E60000-0x000001D600EC6000-memory.dmp

Download

memory/1736-37-0x000001D600E60000-0x000001D600EC6000-memory.dmp

Download

memory/1736-36-0x000001D600E60000-0x000001D600EC6000-memory.dmp

Download

memory/1736-35-0x00007FF7B7250000-0x00007FF7B7318000-memory.dmp

Download

memory/2464-118-0x000001BDF5670000-0x000001BDF56D6000-memory.dmp

Download

memory/2464-183-0x00007FF7BAA90000-0x00007FF7BB1D3000-memory.dmp

Download

memory/2464-119-0x00007FF7BAA90000-0x00007FF7BB1D3000-memory.dmp

Download

memory/2464-117-0x000001BDF5670000-0x000001BDF56D6000-memory.dmp

Download

memory/2464-257-0x00007FF7BAA90000-0x00007FF7BB1D3000-memory.dmp

Download

memory/2464-255-0x000001BDF5670000-0x000001BDF56D6000-memory.dmp

Download

memory/2648-209-0x00000189AAF60000-0x00000189AAFC6000-memory.dmp

Download

memory/2648-135-0x00000189AAF60000-0x00000189AAFC6000-memory.dmp

Download

memory/2648-137-0x00000189AAF60000-0x00000189AAFC6000-memory.dmp

Download

memory/2648-136-0x00007FF72FC30000-0x00007FF730046000-memory.dmp

Download

memory/2648-201-0x00007FF72FC30000-0x00007FF730046000-memory.dmp

Download

memory/2648-211-0x00007FF72FC30000-0x00007FF730046000-memory.dmp

Download

memory/2748-64-0x00000248906F0000-0x0000024890756000-memory.dmp

Download

memory/2748-71-0x00007FF652D90000-0x00007FF652EF8000-memory.dmp

Download

memory/2748-62-0x00007FF652D90000-0x00007FF652EF8000-memory.dmp

Download

memory/2748-63-0x00000248906F0000-0x0000024890756000-memory.dmp

Download

memory/2748-69-0x00000248906F0000-0x0000024890756000-memory.dmp

Download

memory/2852-184-0x000001CFB90E0000-0x000001CFB9146000-memory.dmp

Download

memory/2852-186-0x000001CFB90E0000-0x000001CFB9146000-memory.dmp

Download

memory/2852-240-0x00007FF7E74D0000-0x00007FF7E775A000-memory.dmp

Download

memory/2852-185-0x00007FF7E74D0000-0x00007FF7E775A000-memory.dmp

Download

memory/3144-77-0x00000217F59B0000-0x00000217F5A16000-memory.dmp

Download

memory/3144-134-0x00007FF73CEB0000-0x00007FF73CFC9000-memory.dmp

Download

memory/3144-76-0x00000217F59B0000-0x00000217F5A16000-memory.dmp

Download

memory/3144-75-0x00007FF73CEB0000-0x00007FF73CFC9000-memory.dmp

Download

memory/3320-190-0x00007FF6FD090000-0x00007FF6FD13D000-memory.dmp

Download

memory/3320-126-0x0000024C7E600000-0x0000024C7E666000-memory.dmp

Download

memory/3320-125-0x00007FF6FD090000-0x00007FF6FD13D000-memory.dmp

Download

memory/3320-127-0x0000024C7E600000-0x0000024C7E666000-memory.dmp

Download

memory/3460-47-0x0000018858CA0000-0x0000018858D06000-memory.dmp

Download

memory/3460-46-0x0000018858CA0000-0x0000018858D06000-memory.dmp

Download

memory/3460-45-0x0000018858A70000-0x0000018858B63000-memory.dmp

Download

memory/3556-213-0x00007FF722B10000-0x00007FF722CA4000-memory.dmp

Download

memory/3556-164-0x00000296B2D90000-0x00000296B2DF6000-memory.dmp

Download

memory/3556-166-0x00007FF722B10000-0x00007FF722CA4000-memory.dmp

Download

memory/3556-165-0x00000296B2D90000-0x00000296B2DF6000-memory.dmp

Download

memory/3564-17-0x000002215EB20000-0x000002215EB86000-memory.dmp

Download

memory/3564-51-0x00007FF655B50000-0x00007FF655C72000-memory.dmp

Download

memory/3564-18-0x000002215EB20000-0x000002215EB86000-memory.dmp

Download

memory/3564-16-0x000002215EB20000-0x000002215EB86000-memory.dmp

Download

memory/3564-15-0x00007FF655B50000-0x00007FF655C72000-memory.dmp

Download

memory/3980-208-0x00007FF78CF30000-0x00007FF78CFE3000-memory.dmp

Download

memory/3980-146-0x000001D3CADC0000-0x000001D3CAE26000-memory.dmp

Download

memory/3980-147-0x000001D3CADC0000-0x000001D3CAE26000-memory.dmp

Download

memory/3980-145-0x00007FF78CF30000-0x00007FF78CFE3000-memory.dmp

Download

memory/4444-54-0x0000019A89420000-0x0000019A89513000-memory.dmp

Download

memory/4444-56-0x0000019A89640000-0x0000019A896A6000-memory.dmp

Download

memory/4444-55-0x0000019A89640000-0x0000019A896A6000-memory.dmp

Download

memory/4736-174-0x00007FF6D9000000-0x00007FF6D9320000-memory.dmp

Download

memory/4736-180-0x00007FF6D9000000-0x00007FF6D9320000-memory.dmp

Download

memory/4736-175-0x00000178BDCA0000-0x00000178BDD06000-memory.dmp

Download

memory/4736-178-0x00000178BDCA0000-0x00000178BDD06000-memory.dmp

Download

memory/4736-172-0x00000178BDCA0000-0x00000178BDD06000-memory.dmp

Download

memory/4980-218-0x0000025D81A40000-0x0000025D81AA6000-memory.dmp

Download

memory/4980-219-0x0000025D81A40000-0x0000025D81AA6000-memory.dmp

Download

memory/4980-217-0x00007FF7CB0B0000-0x00007FF7CB1DE000-memory.dmp

Download

memory/4980-251-0x00007FF7CB0B0000-0x00007FF7CB1DE000-memory.dmp

Download

memory/5284-244-0x00007FF73DB80000-0x00007FF73E050000-memory.dmp

Download

memory/5284-247-0x000001C07C730000-0x000001C07C7B1000-memory.dmp

Download

memory/5284-193-0x000001C07BB30000-0x000001C07BB96000-memory.dmp

Download

memory/5284-195-0x000001C07BB30000-0x000001C07BB96000-memory.dmp

Download

memory/5284-194-0x00007FF73DB80000-0x00007FF73E050000-memory.dmp

Download

memory/5528-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5528-106-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/5528-111-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/5528-163-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5608-228-0x0000028921A00000-0x0000028921A66000-memory.dmp

Download

memory/5608-226-0x0000028921A00000-0x0000028921A66000-memory.dmp

Download

memory/5608-227-0x00007FF7A1F10000-0x00007FF7A224E000-memory.dmp

Download

memory/5608-252-0x00007FF7A1F10000-0x00007FF7A224E000-memory.dmp

Download

memory/5868-42-0x00000000002E0000-0x00000000003F7000-memory.dmp

Download

memory/5868-0-0x00000000002E0000-0x00000000003F7000-memory.dmp

Download

memory/5868-7-0x0000000002C70000-0x0000000002CD9000-memory.dmp

Download

memory/5868-1-0x0000000002C70000-0x0000000002CD9000-memory.dmp

Download

memory/5916-88-0x0000021165570000-0x00000211655D6000-memory.dmp

Download

memory/5916-87-0x00000211652E0000-0x00000211653D3000-memory.dmp

Download

memory/5916-89-0x0000021165570000-0x00000211655D6000-memory.dmp

Download