d947b19ac091a18932ee1682518c7b643ef19bf6546e2ec0d4f2faf10fb748e4

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 745KB
Sample260708-e8wcmaaz5y
SHA256 d947b19ac091a18932ee1682518c7b643ef19bf6546e2ec0d4f2faf10fb748e4
MD5 58343880ca3dd11faf2cd495a65c5bbb
SHA1 065cfa3c294c1a35af55f529fdffff4f7ce44989
SHA512 340479dfb8d7cd5a498c19d97b7b5f61b97f866595fd03b8253f729d4736f72da445b1cecbddd21d392f2ca3b1c3e5d49a0a256c3bca636114f35f5b7b1b36f2
SSDEEP 12288:H93G6vHzOASubviBNDYa3TxgtLvo+j05QjFUY2ehcuU/yOD3/mWPrHSuWYF3QuhI:HVGGTWBZDmtvDj0qZUY/c7ZD3OWPrSQm
TLSH
T122F4121039C0C4B3D6A325305EB49BA255BEFE315F219DAF3398276A5E306D14E387A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4124	alg.exe
5492	GameInputSvc.exe
4088	GameInputSvc.exe
4696	elevation_service.exe
1248	elevation_service.exe
5812	maintenanceservice.exe
5792	msdtc.exe
3140	OSE.EXE
1620	PerceptionSimulationService.exe
2536	perfhost.exe
4704	ReFsDedupSvc.exe
3020	locator.exe
1216	SensorDataService.exe
2412	snmptrap.exe
1492	ssh-agent.exe
4892	TieringEngineService.exe
2216	AgentService.exe
5828	vds.exe
6076	vssvc.exe
5032	wbengine.exe
5560	WmiApSrv.exe
3552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a7a87a5ad8ede1e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007890f791930edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058f60692930edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097ba7b93930edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4088	GameInputSvc.exe
4088	GameInputSvc.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	5492	GameInputSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4892	TieringEngineService.exe
Token: SeManageVolumePrivilege	4892	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2216	AgentService.exe
Token: SeBackupPrivilege	6076	vssvc.exe
Token: SeRestorePrivilege	6076	vssvc.exe
Token: SeAuditPrivilege	6076	vssvc.exe
Token: SeBackupPrivilege	5032	wbengine.exe
Token: SeRestorePrivilege	5032	wbengine.exe
Token: SeSecurityPrivilege	5032	wbengine.exe
Token: 33	3552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3552	SearchIndexer.exe
Token: SeDebugPrivilege	2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2540	2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 4088	5492	GameInputSvc.exe	90
PID 3552 wrote to memory of 1320	3552	SearchIndexer.exe	112
PID 3552 wrote to memory of 5232	3552	SearchIndexer.exe	113
PID 3552 wrote to memory of 3296	3552	SearchIndexer.exe	114
PID 3552 wrote to memory of 3616	3552	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_58343880ca3dd11faf2cd495a65c5bbb_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4124

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2536

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1216

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1672 1668 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1680 1676 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d7fc8708f82836c28aa04025a5681c2dccce07bbafdcefa2b1fbd527f7e56c05
MD5 7f9fff61609d0d5b286c75269e349c04
SHA1 445b25be75a55981b136157f515a4cb57c6b7d4a
SHA512 8ec7ae3c953b1c0c8cb81ae62db22be7ae5e30b07a0635bcc7d2ff0871d7b242e464186e97c1bb00cd57ee3de390d1e41c6e32e79ff6671b0003d2ddd617c006
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxneADmYkZD3ZmQm:Y3q6gjBXPb/m
TLSH
T140D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 685f815427c9a2175aa5bae28ee3eba24b7dcc35725f143c93a9843c62021003
MD5 3af4c36b12bd209924d73b61e8ab2d15
SHA1 c4f773abc49acf5efb2dea2f750a30fa926618b6
SHA512 b38da62178f52e28c3d42608b7f71054bf90fffb8d02a659ba7d3517ef29dec0a9bfd3ec3c4844ebc6a2d787e223207cb1d7bac8e86c2b31395d6a0ed3b4363f
SSDEEP 24576:9XYZDtczAfmtvDj0qZUY/c7ZD3OWPrSQF3Quu:WtcYADmYkZD3ZmQm
TLSH
T17D05022877E408F9ED57923CCDA28602E67378528760FB9B03F495650F237945E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 c5d5311ffbb8e62f93a2cc5b1977341419e5a56924ce8d94987ac24b91c923fe
MD5 f0b54e40f9cef2980c25885d7a0586d3
SHA1 7ba6f0e1f87fbac9e3c0645b6af9d050619593dd
SHA512 4735272089006324d70758dbbd86a38cba73c8b87cdb5fa734550801aca697c9778d5c856da3975c0df4d6c131419ecd401d73eebdfcbd9a1a4decacaf8cef73
SSDEEP 24576:lwuROWNmtvDj0qZUY/c7ZD3OWPrSQF3Quu:lwGOgADmYkZD3ZmQm
TLSH
T16905F14576E80CF9EAA752398A97C637E7F3B8122A21DB1F1760C25B5F332106D2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3ab86ab2083f2a21268df27b3d395bb906af5ab9d84b800022baa76c605a49ac
MD5 0f2d39f4444b2f94343197d63b227f6e
SHA1 36fddf0a7ce48ee63cdc1b98bd94c5be4397ff2a
SHA512 4c6ac4f92b8bf64ef3a01c6a1a1282aa8793405180f0855c2972306e6e879aa0e449d7ed61d0c723cd3c7988c13b449695f8ca1e11059a82fec329977c0a31ac
SSDEEP 49152:sB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gltADmYkZD3ZmQm:mu6JmTxd2ddPb/m
TLSH
T11DD59D13F1DA01E8D05ED078974A9233EA62BC490B35B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 39fe544a868f9f772b89e6f0e588a736fba87c37a0e279602c8dc98560b769ed
MD5 10ba340f35a562b338a5344db917ade5
SHA1 c4d392ab3d2076bcac3d06d95fc0bd22d9c72ad1
SHA512 9521d5942e98513c241889a73f691d45962fbf14a5af51e02e115e86ce66f3f66c2e639d2b5dc555a76c629210137a7dacaf638e87fd8e33d9084b97d81e584a
SSDEEP 48:vxmUREx3h+UKnng0UdZn6lletXyPRvVOzt1sUtIVwXtIVwHIVwRWmUdZn6llV:rgUXg0SZ6llhCR6UtIVEIVEIVmSZ6llV
TLSH
T17572EE02FB54EA11F93750B1CDEAE7D8536AF4851B104703764D2B5E8C1B6039E5F167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 cdd68885ec98bf1e8d6cd12d6e8c971ea4a108438a9f78a59d4c7c9471c28158
MD5 e1c0500790df2bf23531c693a18211b0
SHA1 21c2700377941ad16931e494915a3ae578956988
SHA512 1e007bc2013ac30905cad35b06fc3b7c70753b17a05608c26ec9f693931a8e948549c32636e5d812e2ac94d9cf9daf30c48554e2858c15215753c746c5b4873b
SSDEEP 12288:B+7sFvxgtLvo+j05QjFUY2ehcuU/yOD3/mWPrHSuWYF3QuhQJ:IWvmtvDj0qZUY/c7ZD3OWPrSQF3Quu
TLSH
T1E8D42310ADDD8D71E79832346F99978B50E77963EF01EC97346A32988E21D404EA43EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7fff67c4f9c7967e816a4b84550f39c2fae09e076559d51b1a4b0fcca1302d40
MD5 a0632bfda4b38b8df7179b7a2dc603af
SHA1 bb5ca206139117ea87138e127cc9b0bea9599207
SHA512 c50da0cf6978d422dfd5db82dcadb251c93cb1d3b79013284a48aea61ddbb31ed2130f240934f5ab80225a81237c96e9dcca109f8efbcf3ca5df7457f1c32623
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYnmtvDj0qZUY/c7ZD3OWPrSQF3Quu:Mgb4mBIBhGFWADmYkZD3ZmQm
TLSH
T15265AE1E22EC02F5E1F9E2B89DAA4407D6B378164732D2DF1151422D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 14c86ed0c5b244c67fbcb90f90c0ede7231ecc1995f544d4768dbc18d89ab787
MD5 b463956f2972f2819d31837d33970d4e
SHA1 6ebb04db01df005cf92d2d40befe0a65d95f8ebf
SHA512 dfcaa0bae4d69c01308084c4f33917c24f7e2999de3f03fe84701c045153e75876487b2ffb73549dc04d9f4f4f90f96167e73a8bb535e11149875144213870ec
SSDEEP 12288:T5GFxgtLvo+j05QjFUY2ehcuU/yOD3/mWPrHSuWYF3QuhQJ:1GFmtvDj0qZUY/c7ZD3OWPrSQF3Quu
TLSH
T1CEE4232838EE64B4C77992399E645787B0F33462EB1078FF14E5A1798F11DE01638EDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 e4b2fc66a0881d9a2dcf60f95983eb10546bd636ce5891b4c5e7cbaf44cf6f3c
MD5 bdd057f03a5cb9deed25be4ab81d6060
SHA1 a678481f467ffada77ec6ac615e3c0f62664514e
SHA512 6233a8adc08ca32f9fd4037040b45593847a324d46e7980c7c8e12d3c101e33070cddc9c1899f2842ce04044006adb13dbba759f6025a44e13f6b26ad3ad9bb5
SSDEEP 12288:VMe7xgtLvo+j05QjFUY2ehcuU/yOD3/mWPrHSuWYF3QuhQJ:VMe7mtvDj0qZUY/c7ZD3OWPrSQF3Quu
TLSH
T16AD423447CDDC9B5D78832396F955B8B40E32963EB126CD734AA32598F16CD006B83EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 dba1b10c16594be46ed71c8a6c1d7e5cc99c2eef32cd7344e6ce46abdc7c35c1
MD5 24c3416d706dd5d4e3239cfc3579dd08
SHA1 b16351e4e26c7fd1144194a074f299ced2a2de1a
SHA512 105a41fd172f0c8edec9d204f29059b736fbdb02bc3b8d35d54d309abd815e2b651a6a8ed3763f7c31c00e38638fd5bebb345c892bbc1169a0cc4c046931979a
SSDEEP 24576:I7F8X8FpJqH1Mzria7/mrmtvDj0qZUY/c7ZD3OWPrSQF3Quu:m6sFPqVra7/eADmYkZD3ZmQm
TLSH
T19435F16576E501F0D47BE1388E864693F6B2B4261324EFDF06AC8B551F23AD04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 d43c08a81e720d0dc155853811c531dd3e0bb73fd1d272a0c8aadb317c10c94d
MD5 078961204e76f93f9a285fdafddd6881
SHA1 b1ab6b80c342b3ad00c5a836a59874fd36aa2edf
SHA512 a8243bcb27e86872d9ab1d235e66da93da0c68c784bf6128687d9ca9038bb3da27d6bbd34dfe212c497f7141aa18f0c5aaac712aa75d11bf20161f57703b3198
SSDEEP 24576:aPUr+NQgmtvDj0qZUY/c7ZD3OWPrSQF3Quu:aJQgADmYkZD3ZmQm
TLSH
T10505F12E25EC18F5E67AA13D8A82470AE37274625712E6CF02E1817E4F23DD4AD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 47b5169ac7b2fd4aeaa79458698f3f7b7f37b51bdd1d35e57c1dee878699579b
MD5 dd5cbee70006d3c6be255a16c2fa7590
SHA1 1d3d8963326541c022fa7ba0f66eece05c0d0b64
SHA512 c6b52c38663d591fc62b680773717edfa6bbe4c1902fa8ac72a6d2dd20c5a7ad2f430123417f4eabab78a6d776581bf2bffc725bc16dbc4b61b8ae1f3fd73f1e
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUADmYkZD3ZmQm:kG05lO43bzPb/m
TLSH
T1D4D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23415033556CF02A486A91F27FF0597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 2ba6f05a336ccaf55d73a7f907dfcf40fb6c732edbc7ce076a05ef65ecacd925
MD5 f81b039f50c7cdd243c53c532a087046
SHA1 3e3cb30075335986bf4e79a68760d3836a5cb7bf
SHA512 6fc5a0fdc88f55f51d40f4ec55ea0929d1fadc70270169ae1e1450ec1c0042756610102b5c4b842320d0218e6b6f59ae5b0a96842e0f3ce5ba68371d39f415ac
SSDEEP 24576:Pka5POZ3dpbWVM50JicR2hG0lasx2+47eidnmmtvDj0qZUY/c7ZD3OWPrSQF3Quu:sa5POZ3wJt2pasx2+m0ADmYkZD3ZmQm
TLSH
T16965BF5DA6FC01D5D5B9D17DC583460BF5B2342253329ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f3b8a3f183ce94fad072cfd59909e5a23137f0de1b0d8ecb3a4bb9af1530b9de
MD5 a65643e8c72ff1b4fa35801289f5c1a7
SHA1 be4bab312f60f1d307d9932198aacb37011f116a
SHA512 089a6fe911e193bc2642972d6d6178f5c916834e794a6a27ffc8e24049982053cb2e4a178c2006aecc03a57322f3f007d410bc25ce240368b95261d6a9bca33b
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkumtvDj0qZUY/c7ZD3OWPrSQF3Quu:ENc/zEOVHFLADmYkZD3ZmQm
TLSH
T1F1858C1622E901E4F1BBE1BE89779546FAB1786557308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 dcb661526df1e29780efeb3f2587cf9d33408c6d49f9e0808aaf29964a69bbe3
MD5 4f92ff15f11cf8b98e648e5993633b45
SHA1 2910b383072d8f6880578e759522e42ed8d4c0bd
SHA512 258ab76cdfa5423a47d2c6af7115a464652d55e08bd9a5e39ecf18663e16e0ff91bfa779a84275d6cd7252d762258e9792cbce93e2f918dc647cc85fd8e80173
SSDEEP 24576:lJnJPbzB4SzmtvDj0qZUY/c7ZD3OWPrSQF3Quu:lJnJv6SzADmYkZD3ZmQm
TLSH
T16115E03CD2A810E8D4B7C274815A179AFE71387D2F2269C729B4D5343F12EE0A979F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a18c9c26abbe0cf73c55b1216241b0b215e497cfde7e644256fabddc1945bc33
MD5 efb654f1e1704a99447feb741c5aff3f
SHA1 14cbfee1f2b58a8fe23d30319c7a8b968336ba1c
SHA512 1af438c075d23f05ecc8dee7f396dce27f9cc7ab698bfe3cc44dbffce9dfcd3aef15568541578d79afd22277f613f375d1c4dec00871d618df6dcfc1732869a3
SSDEEP 24576:2CLHGL0MoeVtFumTijCmlKQWDk7mtvDj0qZUY/c7ZD3OWPrSQF3Quu:2CLHGeeV5ijCmlDWDk7ADmYkZD3ZmQm
TLSH
T132A56B05A7EB4184E9F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 fbab6551984eb02349514c73c82453ad59821f021b53b2148f98f84d9a574364
MD5 58db68b46d063745202a971b48b77516
SHA1 d3bd15575ef1794a1b83ba17c8065efaa7f1d578
SHA512 a4a5aa87073a52d90bdd37465e9e4b68cebf94f70ce771e987678d17af426eec96b9eacf9e0bbbc108561d5ab58d46d0a14de5d474804ae2ee6ba90e06028777
SSDEEP 24576:T6DIOmtvDj0qZUY/c7ZD3OWPrSQF3Quu:T6DIOADmYkZD3ZmQm
TLSH
T1D0F4015C37BA10F5D16BD03D8A820642D1F2B471D71269DF16A8D1B98FA3ED8B93CE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 f94331773c5bdac2e43ddfc827530c5182d568380844ace695b2e1fe4cb07d12
MD5 78b11c939e1b335acb6e7abfa235a862
SHA1 9f2e968227fc6925826b97c1d181e9044c57e5ed
SHA512 02080d73a924ce096dfc7b78fd285bf925bae8c4831fd906685539fa0092f4eec7c2a8a1780a9736877a9470171ac347793e12f1236affc1e6a1999fb4fa1e4d
SSDEEP 12288:ZG6kydxgtLvo+j05QjFUY2ehcuU/yOD3/mWPrHSuWYF3QuhQJ:QtydmtvDj0qZUY/c7ZD3OWPrSQF3Quu
TLSH
T170F4220067D894F4E7A912389F6283C68AB27C21DF119ADF34E1B23E5F32BD05970796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 e65d296649b898ab237732afdd1f3c1300b958ff7d545d35565b2e2f34a42769
MD5 305526fb474dd1645666910910ea5e17
SHA1 1bf3644e648fa05771c6e3b808540086a5472210
SHA512 1bec51ebc3fb2035318e0dc8aa0858bc0509d0dc842be46e047da2dc9e652ed4501ed27fc184c1702b3fb07caa98b88acba9811260973cde48e2de8ef057a368
SSDEEP 12288:DqNxgtLvo+j05QjFUY2ehcuU/yOD3/mWPrHSuWYF3QuhQJ:+NmtvDj0qZUY/c7ZD3OWPrSQF3Quu
TLSH
T1C3D423587C9DA9B4CB8872386F544B8780E33573EF126CEB34E962748F169C00674BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 77ac785c20243cb2a12384631f3aaa42605fa3f5079e612aea07d850f68df7e7
MD5 7c93566fb21b6459cc71bf229a6c1b27
SHA1 ad3346f2b029c000fe0caa3f686429814d81c17f
SHA512 89cbd2051d1bd6407de9fa82abc3278a5924c2f86603e76e82c26bbbe3a75fab42dec62cfe1d7df04b11a9d7426391afacc983edbbe5b9177aa3a74a1e2933b1
SSDEEP 24576:OCgILoTfaidZVmtvDj0qZUY/c7ZD3OWPrSQF3Quu:tgHTrZVADmYkZD3ZmQm
TLSH
T153559D1D77EA05DAE2B2D239D9621483D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 4671f5bc21371f8674444d26966ed0b0602c9cbc1692124ca859b9dd36370e76
MD5 bb32ce1ff083be1d678e99c6941a0d92
SHA1 955dcce4274565c171a7b6b2884fd650a4306126
SHA512 4218f0022f3f18834e77cc8b5cd4db76173a268d1b7c5620d021c4b5b4d7cd461fcd6f8334c873147a4946fea3fed7df3d898c1965f099d4da15c3f578da6b28
SSDEEP 24576:IrcmRemtvDj0qZUY/c7ZD3OWPrSQF3Quu:qcmReADmYkZD3ZmQm
TLSH
T1EF05F14EB6AE00F5E2BB913C8D814646E2B3703167126BDF12A1C37D4E179E97D38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b1ef7bb09b66ac04d4b47db931357ba8175fbda4904e6cb2c53e166d3437c89b
MD5 5b84f4b3709ff72a817f961149d121c9
SHA1 bd05c534bbecc5e0bb39b7edc2d2c61f5063aa7c
SHA512 f16307564338b91c34faae2ec6474554244222bc79c5cfd435da678b8a7b396f91f1b202ad8b6eec8ed78d3a3afcc96482cebadc7993bc8dc4c97b9fc987bb9a
SSDEEP 49152:ADL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3nADmYkZD3ZmQm:N3Upow8sBAPb/m
TLSH
T169A58D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C178BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-135-0x00007FF69BAD0000-0x00007FF69BEE6000-memory.dmp

Download

memory/1216-193-0x00007FF69BAD0000-0x00007FF69BEE6000-memory.dmp

Download

memory/1216-212-0x00007FF69BAD0000-0x00007FF69BEE6000-memory.dmp

Download

memory/1216-206-0x000001864FF50000-0x000001864FFB6000-memory.dmp

Download

memory/1216-137-0x000001864FF50000-0x000001864FFB6000-memory.dmp

Download

memory/1216-136-0x000001864FF50000-0x000001864FFB6000-memory.dmp

Download

memory/1248-54-0x000001B8BC300000-0x000001B8BC3DE000-memory.dmp

Download

memory/1248-55-0x000001B8BC500000-0x000001B8BC566000-memory.dmp

Download

memory/1248-56-0x000001B8BC500000-0x000001B8BC566000-memory.dmp

Download

memory/1492-156-0x00007FF6AC4C0000-0x00007FF6AC762000-memory.dmp

Download

memory/1492-158-0x0000024A21470000-0x0000024A214D6000-memory.dmp

Download

memory/1492-157-0x0000024A21470000-0x0000024A214D6000-memory.dmp

Download

memory/1492-203-0x00007FF6AC4C0000-0x00007FF6AC762000-memory.dmp

Download

memory/1620-96-0x00007FF646DB0000-0x00007FF646EF9000-memory.dmp

Download

memory/1620-145-0x00007FF646DB0000-0x00007FF646EF9000-memory.dmp

Download

memory/1620-98-0x0000028850020000-0x0000028850086000-memory.dmp

Download

memory/1620-99-0x0000028850020000-0x0000028850086000-memory.dmp

Download

memory/2216-174-0x00000173B1DA0000-0x00000173B1E06000-memory.dmp

Download

memory/2216-179-0x00000173B1DA0000-0x00000173B1E06000-memory.dmp

Download

memory/2216-181-0x00007FF715F60000-0x00007FF716280000-memory.dmp

Download

memory/2216-173-0x00000173B1DA0000-0x00000173B1E06000-memory.dmp

Download

memory/2216-175-0x00007FF715F60000-0x00007FF716280000-memory.dmp

Download

memory/2412-147-0x000002060FAF0000-0x000002060FB56000-memory.dmp

Download

memory/2412-148-0x000002060FAF0000-0x000002060FB56000-memory.dmp

Download

memory/2412-201-0x00007FF677550000-0x00007FF677603000-memory.dmp

Download

memory/2412-146-0x00007FF677550000-0x00007FF677603000-memory.dmp

Download

memory/2536-155-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2536-106-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/2536-111-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/2536-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2540-0-0x0000000000760000-0x0000000000876000-memory.dmp

Download

memory/2540-7-0x0000000002B60000-0x0000000002BC9000-memory.dmp

Download

memory/2540-2-0x0000000002B60000-0x0000000002BC9000-memory.dmp

Download

memory/2540-37-0x0000000000760000-0x0000000000876000-memory.dmp

Download

memory/3020-182-0x00007FF73F1D0000-0x00007FF73F27D000-memory.dmp

Download

memory/3020-126-0x000001F9F7B20000-0x000001F9F7B86000-memory.dmp

Download

memory/3020-127-0x000001F9F7B20000-0x000001F9F7B86000-memory.dmp

Download

memory/3020-125-0x00007FF73F1D0000-0x00007FF73F27D000-memory.dmp

Download

memory/3140-90-0x00000223A4540000-0x00000223A45A6000-memory.dmp

Download

memory/3140-89-0x00000223A4540000-0x00000223A45A6000-memory.dmp

Download

memory/3140-87-0x00000223A4410000-0x00000223A44EE000-memory.dmp

Download

memory/3552-229-0x00007FF7CA620000-0x00007FF7CA95E000-memory.dmp

Download

memory/3552-230-0x0000019D6EA70000-0x0000019D6EAD6000-memory.dmp

Download

memory/3552-228-0x0000019D6EA70000-0x0000019D6EAD6000-memory.dmp

Download

memory/3552-252-0x00007FF7CA620000-0x00007FF7CA95E000-memory.dmp

Download

memory/4088-36-0x000002405B4D0000-0x000002405B536000-memory.dmp

Download

memory/4088-35-0x00007FF617FA0000-0x00007FF618068000-memory.dmp

Download

memory/4088-88-0x00007FF617FA0000-0x00007FF618068000-memory.dmp

Download

memory/4088-39-0x000002405B4D0000-0x000002405B536000-memory.dmp

Download

memory/4088-38-0x000002405B4D0000-0x000002405B536000-memory.dmp

Download

memory/4124-18-0x000001625AE30000-0x000001625AE96000-memory.dmp

Download

memory/4124-17-0x000001625AE30000-0x000001625AE96000-memory.dmp

Download

memory/4124-16-0x000001625AE30000-0x000001625AE96000-memory.dmp

Download

memory/4124-51-0x00007FF6408B0000-0x00007FF6409D2000-memory.dmp

Download

memory/4124-15-0x00007FF6408B0000-0x00007FF6409D2000-memory.dmp

Download

memory/4696-47-0x00000294EB1A0000-0x00000294EB206000-memory.dmp

Download

memory/4696-46-0x00000294EB1A0000-0x00000294EB206000-memory.dmp

Download

memory/4696-45-0x00000294EAFF0000-0x00000294EB0CE000-memory.dmp

Download

memory/4704-172-0x00007FF79CBF0000-0x00007FF79D333000-memory.dmp

Download

memory/4704-254-0x000001AF25ED0000-0x000001AF25F36000-memory.dmp

Download

memory/4704-119-0x000001AF25ED0000-0x000001AF25F36000-memory.dmp

Download

memory/4704-255-0x00007FF79CBF0000-0x00007FF79D333000-memory.dmp

Download

memory/4704-118-0x000001AF25ED0000-0x000001AF25F36000-memory.dmp

Download

memory/4704-117-0x00007FF79CBF0000-0x00007FF79D333000-memory.dmp

Download

memory/4892-164-0x00007FF78B610000-0x00007FF78B7A4000-memory.dmp

Download

memory/4892-166-0x00000154238A0000-0x0000015423906000-memory.dmp

Download

memory/4892-165-0x00000154238A0000-0x0000015423906000-memory.dmp

Download

memory/4892-213-0x00007FF78B610000-0x00007FF78B7A4000-memory.dmp

Download

memory/5032-208-0x0000029F7E610000-0x0000029F7E676000-memory.dmp

Download

memory/5032-204-0x00007FF7048D0000-0x00007FF704DD6000-memory.dmp

Download

memory/5032-246-0x00007FF7048D0000-0x00007FF704DD6000-memory.dmp

Download

memory/5032-207-0x0000029F7E610000-0x0000029F7E676000-memory.dmp

Download

memory/5492-28-0x00000277A0270000-0x00000277A02D6000-memory.dmp

Download

memory/5492-27-0x00000277A0270000-0x00000277A02D6000-memory.dmp

Download

memory/5492-29-0x00000277A0270000-0x00000277A02D6000-memory.dmp

Download

memory/5492-26-0x00007FF617FA0000-0x00007FF618068000-memory.dmp

Download

memory/5492-62-0x00007FF617FA0000-0x00007FF618068000-memory.dmp

Download

memory/5560-219-0x00000285DEDF0000-0x00000285DEE56000-memory.dmp

Download

memory/5560-251-0x00007FF78B720000-0x00007FF78B84E000-memory.dmp

Download

memory/5560-220-0x00000285DEDF0000-0x00000285DEE56000-memory.dmp

Download

memory/5560-218-0x00007FF78B720000-0x00007FF78B84E000-memory.dmp

Download

memory/5792-75-0x00007FF717A60000-0x00007FF717B79000-memory.dmp

Download

memory/5792-76-0x0000022599AC0000-0x0000022599B26000-memory.dmp

Download

memory/5792-77-0x0000022599AC0000-0x0000022599B26000-memory.dmp

Download

memory/5792-134-0x00007FF717A60000-0x00007FF717B79000-memory.dmp

Download

memory/5812-64-0x0000026BDAA20000-0x0000026BDAA86000-memory.dmp

Download

memory/5812-72-0x00007FF7ABC00000-0x00007FF7ABD67000-memory.dmp

Download

memory/5812-70-0x0000026BDAA20000-0x0000026BDAA86000-memory.dmp

Download

memory/5812-68-0x00007FF7ABC00000-0x00007FF7ABD67000-memory.dmp

Download

memory/5812-63-0x0000026BDAA20000-0x0000026BDAA86000-memory.dmp

Download

memory/5828-217-0x00007FF76F8F0000-0x00007FF76FB7A000-memory.dmp

Download

memory/5828-186-0x00000267F6580000-0x00000267F65E6000-memory.dmp

Download

memory/5828-187-0x00000267F6580000-0x00000267F65E6000-memory.dmp

Download

memory/5828-185-0x00007FF76F8F0000-0x00007FF76FB7A000-memory.dmp

Download

memory/6076-199-0x00007FF7533C0000-0x00007FF753890000-memory.dmp

Download

memory/6076-195-0x00000149B3480000-0x00000149B34E6000-memory.dmp

Download

memory/6076-194-0x00000149B3480000-0x00000149B34E6000-memory.dmp

Download

memory/6076-227-0x00007FF7533C0000-0x00007FF753890000-memory.dmp

Download