bfcbd5b13ba9d2485456104b0fe1ce253f303735b7258a684b859cfb99fa4d5b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 745KB
Sample260721-dcs2ysc18n
SHA256 bfcbd5b13ba9d2485456104b0fe1ce253f303735b7258a684b859cfb99fa4d5b
MD5 199e5f907699615a3be93ade50759d42
SHA1 1c38c27c73d17220db75c49a4d62005891471b83
SHA512 6a713667124dcc1d4eba3706a7a28c61a6b380b81243f26e158770f08d6cdd428797d7f8461af9ceabaa7f9ec8651830bd21dc80c05191d6f111414de0963043
SSDEEP 12288:E93G6vHzOASubviBNDYa3Wo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN3f:EVGGTWBZGcnUJd/vJ/vA5kwzlUoq
TLSH
T13AF4012172C0D0B7E8731E3058B1AAB4A87DFEB15FB4859F6394076A9E303D149397A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
6100	alg.exe
4500	GameInputSvc.exe
3296	GameInputSvc.exe
5824	elevation_service.exe
4900	elevation_service.exe
3384	maintenanceservice.exe
3604	msdtc.exe
2344	OSE.EXE
2752	PerceptionSimulationService.exe
4488	perfhost.exe
1808	ReFsDedupSvc.exe
5584	locator.exe
5032	SensorDataService.exe
2652	snmptrap.exe
5088	ssh-agent.exe
3432	TieringEngineService.exe
3408	AgentService.exe
2260	vds.exe
2628	vssvc.exe
2756	wbengine.exe
5432	WmiApSrv.exe
5092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2b962bdfe05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7d16312bc18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cb0ff0fbc18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b123a410bc18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087ef1b10bc18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8714f10bc18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3296	GameInputSvc.exe
3296	GameInputSvc.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	4500	GameInputSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3432	TieringEngineService.exe
Token: SeManageVolumePrivilege	3432	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3408	AgentService.exe
Token: SeBackupPrivilege	2628	vssvc.exe
Token: SeRestorePrivilege	2628	vssvc.exe
Token: SeAuditPrivilege	2628	vssvc.exe
Token: SeBackupPrivilege	2756	wbengine.exe
Token: SeRestorePrivilege	2756	wbengine.exe
Token: SeSecurityPrivilege	2756	wbengine.exe
Token: 33	5092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeDebugPrivilege	3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3480	2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3296	4500	GameInputSvc.exe	91
PID 5092 wrote to memory of 5644	5092	SearchIndexer.exe	113
PID 5092 wrote to memory of 1764	5092	SearchIndexer.exe	114
PID 5092 wrote to memory of 2804	5092	SearchIndexer.exe	115
PID 5092 wrote to memory of 4180	5092	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_199e5f907699615a3be93ade50759d42_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6100

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3384

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5032

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5088

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2876 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2944 2940 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79a341269946ddb7e1a8e54c27f8763eda9e35016cb0f3ffad56d1e5008d82a3
MD5 68b0e6a1109d4f5e9da29a09eaaef3af
SHA1 4e5a9e7849edc100932f2993fda43686fa374636
SHA512 de3cbe97604991a4e1b29a870f235c1d5c605b9f241041214bec6fb2084542457d06312cf53a2c212399659ce5ae6fe49ad631931bf1d81fc39f2e2828b65a03
SSDEEP 49152:vb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnUVbh/vAqslUoq:t3q6gjBchlUoq
TLSH
T17FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 400ef132912ed560d9c88c6b338f0874cfbb6bdc3cc53c9f20201824da5e132d
MD5 34928707fb65f6c43ed0c6a849df9c1d
SHA1 7cd4e46bc9ebc3ad53b9fd8b813e505f75d1ce48
SHA512 098bfef19b9de237ec8cf9f0cd4c2f017e29e41d7c678d03684aea729a56ceccaf847d1a207c9f875769e501b959fa6e1b5fc40763d40c56a7ec1788eeb0855f
SSDEEP 12288:k1XLssvWkxy2lRq2czAvo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:iXYADtczAvcnUJd/vJ/vA5kwzlUoq
TLSH
T183050229B3D409FDEC67813CCCA28915EA73789647A0E78B03B489655F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 cb1d9d39ed9e3d360f26472d22af918938ebfa21521754593c6082f1b13e9905
MD5 64aebe8fa99df2caee958c99b5ea5069
SHA1 0099244ef11e7f441b7e17c1f5a00e993af3ba1e
SHA512 098522286a12c5bdbfd40c133c2fb3d515cc54ee458be081da58a9094afaf6e702d44aea55ee9045d1e5afc21ec2d1d2d97db72ae0504e266b62d19e79711eb1
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+Coo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuNP:Owu+OWrcnUJd/vJ/vA5kwzlUoq
TLSH
T19B05F14673A41CF9E96396388997D53AF7F2B8422A24D71F0760C6576F23360AD3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f5a97e9c948fb275e0991f1e3e47386daec647af57de1e65e44c40d2c76dd48f
MD5 7d8f4ab202837ed6f3969031f08f0c0f
SHA1 d9d9c0ef6320eaeea5839a6cb3692b7591971b9e
SHA512 740e7c7d6e468efcd4002a160c68ff651beb4333836000d527179e18472c1158eba56a038116a4e8664bed35a0e84698bcd2a31f740ecb69aa11d61b723fdff7
SSDEEP 49152:jB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6Vbh/vAqslUoq:Vu6JmTxd2dLhlUoq
TLSH
T185D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 c60d005abf151297ff05451fd4b7ab2ef6c6c30932a6d74b7722acc1fde12ab5
MD5 6a601d6d037258d99530ca2dfb830a61
SHA1 bd54ea7cde400d9acf50ab1b11362875e12cfd2b
SHA512 4d039854341f39b48d91cd9daa9ec8753418d9b680366b017cc5ae013267454393acef7bf07497bb883f74f724a3b6d66f61c75fb0d659b20506d6a37841a44f
SSDEEP 12288:Bo7so7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:OscnUJd/vJ/vA5kwzlUoq
TLSH
T1DBD42373F345A64EF831AE306C96AD2CE8ADBFD79EA4D0CB5D150641AD3038448BA35D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f4a6a139e3d9fee2f030733fe61f3a1faccbd0642593767caa1d9eb15cb7fea6
MD5 c002b14410a603b2b61143559cb4d8fd
SHA1 9890f99c06630cac0da92edd05472841646e0feb
SHA512 7294d830cced79a85c95fe80a29add8bad99d91d42a1ee8bdab93d2f7cb0e55098b6ce7623ac6507cb0cafac7324941bb569f45507531ac18877e7a494234584
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYOqq6URGRNpiHstMYtkEPk:Ogb4mBIBhGFBNBRyNksneEPk
TLSH
T17565AE1E22E801F5E0FAD2B8CDAA441BD6B378160731D2DF1251926D2F37EE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 bd462145410371e82720aa3cdcd4591da5f7dd1b62fe0ceb0f21b5c949c6fcd8
MD5 ce8c243a8ae4e9b58fd17f65ebacf401
SHA1 ed6f674885906bf4bbcf9af594898e2f3fe5c2a6
SHA512 73baafa2fd313097d9ff06473ed734dcc806aefc8638a79463bbc1a3b883384b641f139fcd9a83ca3ed966ce6ae7ce31ac5c36fb0fa0f77bb885c6f378de16dd
SSDEEP 12288:wxGqo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:oGqcnUJd/vJ/vA5kwzlUoq
TLSH
T105E4237A72A5718CC835DE345C66AC6EF8F07AE25B64D0EF0DA145319F203E0617EE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f5c57802ceeb05d06d7f480a4a2a841f4a1e3b203f0fca4c13fd3828f6c0e5bb
MD5 76585c571ba01f249b96b7fa976f8952
SHA1 be72d20196b0ae3b8c4850ab0dca0acf023bbdee
SHA512 6540e40a4f2280da661099c01001eebee6957ddca2dba928b8be16f0495c62d758532fde19f14742234ccfa69d8b74fa33b028e189c172cfef9ea39fec019e33
SSDEEP 12288:O4uo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:O4ucnUJd/vJ/vA5kwzlUoq
TLSH
T17ED423A7F305F68EE821AE306C93BD5CE8A8AFD79BE4D1CB5D3505019D103D441BE698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b987816419ba37b41cefffab385d3009fd68d7ed0c0aae2dffd208afcb53386c
MD5 667abe85f84800337f0402d731514c9c
SHA1 aea4258391798a24dab9f9358017efbac8cfdf76
SHA512 4fdd45be1e80676bb38b7e1e16c3c5190063da531e676ecc7227a584c47222db229f416058d318aa1c650d0742e8f5b311da9047d8f0e458a8fb31b2d850220e
SSDEEP 24576:yYn8m8FpJqH1Mzria7/mqcnUJd/vJ/vA5kwzlUoq:r8RFPqVra7/pVbh/vAqslUoq
TLSH
T17335F165B7E101F4D477D13889824A67F6B1B8260364EBDF0BA88B511F237E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 8432c1f109d47befa7da501cdf92cbbc048986150fe83e7684aa9457b4645929
MD5 e3eb32965cfc9b2f564ee26f5064ee8f
SHA1 f663012f1ac99e04fb45c40ae11f32871c1e9d81
SHA512 4e54ef49a22eb6384b508c004e3551344db5bbfaa1a6c8f84a2a11a5b39eb81b9349358d8cfca6e11244e767f17d4d0fcec9040216e29a7df2976cea011f8ac1
SSDEEP 12288:qHvUrBFrEjwaQZo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:qPUr+NQZcnUJd/vJ/vA5kwzlUoq
TLSH
T13105F22F72A918E5E676E53C8982861DF671B4A31751D2CF02E1417E5F23AD8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f265806caa9c341de6f9a81dc3a77d38a944f06e9cee6ce106836602710341cb
MD5 1fb856ad4f8734c943fe2cc29ee0d11f
SHA1 8ace6545a0e40cadfb91b079d23209423faf5e8a
SHA512 5a4aeed93ae1cca26905482f47c65a7534b4242537ebcf571f36bce064dd15105fd887866544d2a5722daff3a87dfe4de9b906696e68dc259b5c04bf53c53180
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjd5Vbh/vAqslUoq:TG05lO43bEuhlUoq
TLSH
T1C5D5CF6A62EC11F9D1BBD17CD9C68A0BEBB23815033556CF02A486A91F23FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 afd48236399b05c52a0c72c85d587c0a6364202e4c8d0c7f2cdf98780df1b488
MD5 f510426aab51698ab799f2a972f05afd
SHA1 000a0c8fb2c97f0138ac75c7d5e8b55e7ef06475
SHA512 7ba5b360894a74583e1e5fedaee80de06767949f5e709927286948d6a7bf80fdea983e4183f3892f8b760dbdb0c46ac18140f6f2604b2d3a3b1bdb036cf892a9
SSDEEP 24576:Uba5POZ3dpbWVM50JicR2hG0lasx2+47eidnGqq6URGRNpiHstMYtkEPk:Ua5POZ3wJt2pasx2+moNBRyNksneEPk
TLSH
T17C65BF5EA6EC00D5D5B9D17DC583461EF5B2346613319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 972a5b7202a80fce941ce7bd34cb6c24311d7931d791f75f8bac1aa01d95fbf7
MD5 fc072c136a44ec1fa73b83a734e79866
SHA1 16c0c1d4d54a199b48f7c65ffb1bbe9a2254f01c
SHA512 f0d76b43a56359465a71349b85f3d08793a68fb96f22499f4a9a3c96233b9de17c252e4cd34fcdcfaab45d95e7cba39524c9ccc0604695502cd1d5590675bc44
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkicnUJd/vJ/vA5kwzlUoq:kNc/zEOVHF5Vbh/vAqslUoq
TLSH
T154858C2623E901E4F5BBE1BE89779946FAB17865533086CF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 0286a28bc1e533e68121d243d630263f1baf820c55963c82b452b893b8624dbf
MD5 51ed65ef2bdcbc95186c1919e55749f8
SHA1 7383526bb91d20ad0a4e42577aaf32a6250be65a
SHA512 52c9aa1ae3f927acda32ccb092e5202d9c8d62df250ebccee575e2177f1b3d9f22fde8ed872eb5fe79795d78d91a5d7b97e40bf5683e23bfb90082f09da7a02e
SSDEEP 12288:hmHPJnJP6szeCs6Rl28dEo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:OJnJPbzB4SEcnUJd/vJ/vA5kwzlUoq
TLSH
T1B815E03DD2A810E8E4B7C274815A1B59FE71386D2F21A9CB19B4D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 49ace065d2059ec9e7a50bfa005c9e4735e0422270e3a10e72c19f1b723e7871
MD5 bcf0142927fe8a1c7211de88815c5030
SHA1 af165b4d78a0116a9b61fb981415e99a64785811
SHA512 658953ca55d1fc2fa8a816a9a3118215e5562192ecffc6b5ad2b819b6af9705fa6e11ff6e4f4d5165039768e0949a010ecd41c8c13bc2650c263655bb1dab764
SSDEEP 24576:WCLHGL0MoeVtFumTijCmlKQWDktqq6URGRNpiHstMYtkEPk:WCLHGeeV5ijCmlDWDktNBRyNksneEPk
TLSH
T13EA56C05E7EB4184E8F3CAF5C926941A9A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 639cf538065336f04736315236aca93ba945ac59329eddf4aa26a0fbe365b917
MD5 5a30be8da6af231d81a0b871d4a317d9
SHA1 0909c0db4a3500c7e3c5a44a3a0d7f9ab6cfbb41
SHA512 35ce2c325aa367d1de89fd107cf225f73a4d916f8461de47df8f1966341b9698fde0987b7bf06bcb6d2a547c99870fcab9bb4161197aad5427983deda75810e0
SSDEEP 12288:m1Hck6j5ZI7No7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:K6DIpcnUJd/vJ/vA5kwzlUoq
TLSH
T1EBF4016D737A10F9D037D03D88830909E1B2B5B2876195DF0BA4857A9FA3ED8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 1870cfd216326afde68bc35077104942a7b2872eb367189dd734d623eff2fbaf
MD5 2fa56784d6afe8af959e88221c34a405
SHA1 07f63ddb66b4d16e3214bf6aea5b21bcc73db880
SHA512 2067f1e609185f0d6f33abdb2a1bd7d75263121feeb04af258a1aa2254347fc6a9cdb8132d2ad8c60d73c8c4f6e8707557a0bddd2f0ec6bfcb64453df9748bc7
SSDEEP 12288:FG6kyio7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:8tyicnUJd/vJ/vA5kwzlUoq
TLSH
T12AF42311B384B1C8E8355E349CA385ACDD78BDA29F70D2DF19A0963E6F303D0A875B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 c182dfb8d23ca1cf2ae9c6c4acc3457ba7c2e7012224413fd5e72276e4b1b81e
MD5 9d04c98839f39cd66cda2625c3962d32
SHA1 8a2e6f3e8fc9a1f82d6a3b6a5fca286eedc04ec7
SHA512 a103b82ec555326c6dd0e0b3741b0f3104bc0317a3bd9cd77f43f5cc80659f13f9f818c8de22fa6550a5c3d532b23d76f0b020d5d132b8b99147d30c6f2a21c0
SSDEEP 12288:ifDo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:aDcnUJd/vJ/vA5kwzlUoq
TLSH
T110D423BAF315B28DE821EE302C966D5CD4B87BE79FA4D0DF1DA50521DE203D041BAB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 6326050feaa2c9c902692ed3120e8e002abc2df36bef7abb74e4f6520e3dbe8b
MD5 de2ec465412698d244f4082b8e975ef1
SHA1 311bce6901f01a33a2394260118f92ca0e3c7f01
SHA512 e65fde0f06f67442fc1d405758e560399019b94f413203d39f21a74791ac3c1314dcaa787fc310c6faf3d2a31ebf9f90cd1ada0c54f6da26e893dc2c9dadaa87
SSDEEP 24576:yggILoTfaidZwqq6URGRNpiHstMYtkEPk:XgHTrZwNBRyNksneEPk
TLSH
T15455AD1DA7EA09CAE2B2D239D8721497D633B4311771D6DF2448C07A4DABED8AE74F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 110d1913c5f2c76166fb648fdce7af2e2f8874cf54cf9439bf90eef100eab805
MD5 522e1a656fdca512aba0385181e8e5d9
SHA1 3f8b0fa3c90fef82bf1c5bd84df18a773f967093
SHA512 d75814898d25dc59bed62503c47ee39fe244aede1720518ad5376c0d0a12a312eb12bf448b4c6d209a46ab6504a207109371f730df6cf4c4f80e0c6a2fca8585
SSDEEP 12288:SpJcm8CNZkHKOpmL/nUCHeD6UTpsywLE6piqluP+zFMHkMlqZyxwyETKhCBZQXSk:SrcmRGqq6URGRNpiHstMYtkEPk
TLSH
T15E05F00FBA6A00ABE0B7813CC985454DF2B37070272167EF02A5E6BD5D63AE97D35B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 7b9ddd91e763602606ed2d2bad36370aadb749e27a222ee83b2cd92f93bcac67
MD5 d847ed701322b36847aeb8048920169a
SHA1 751a603ae4a37cfe30b7de4851be2dbf42d42ef2
SHA512 fa542af7a3ca913454e2fffaabe493a18621d2df8b7affa7bbe40e18d977f218f04cfc50a38353ac14857a8a0e0977a684f4ab4b3c2d4177fb37a9aabf2b44ba
SSDEEP 49152:uDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3pNBRyNksneEPk:v3Upow8sBIHRySsneYk
TLSH
T1BCA58D3DA2E800A9C9AAC379C54213A9EA71742D3F3015DB0174C5B8BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-119-0x000001C5BA170000-0x000001C5BA1D6000-memory.dmp

Download

memory/1808-118-0x000001C5BA170000-0x000001C5BA1D6000-memory.dmp

Download

memory/1808-249-0x000001C5BA170000-0x000001C5BA1D6000-memory.dmp

Download

memory/1808-117-0x00007FF723250000-0x00007FF723993000-memory.dmp

Download

memory/1808-181-0x00007FF723250000-0x00007FF723993000-memory.dmp

Download

memory/1808-251-0x00007FF723250000-0x00007FF723993000-memory.dmp

Download

memory/2260-217-0x00007FF6F9540000-0x00007FF6F97C9000-memory.dmp

Download

memory/2260-187-0x0000020DD1610000-0x0000020DD1676000-memory.dmp

Download

memory/2260-186-0x0000020DD1610000-0x0000020DD1676000-memory.dmp

Download

memory/2260-185-0x00007FF6F9540000-0x00007FF6F97C9000-memory.dmp

Download

memory/2344-87-0x000001F770800000-0x000001F770916000-memory.dmp

Download

memory/2344-89-0x000001F770780000-0x000001F7707E6000-memory.dmp

Download

memory/2344-88-0x000001F770780000-0x000001F7707E6000-memory.dmp

Download

memory/2628-194-0x00007FF787CF0000-0x00007FF7881BF000-memory.dmp

Download

memory/2628-195-0x000001E7DD880000-0x000001E7DD8E6000-memory.dmp

Download

memory/2628-225-0x00007FF787CF0000-0x00007FF7881BF000-memory.dmp

Download

memory/2628-193-0x000001E7DD880000-0x000001E7DD8E6000-memory.dmp

Download

memory/2652-145-0x00007FF6443E0000-0x00007FF644493000-memory.dmp

Download

memory/2652-146-0x000001E1579D0000-0x000001E157A36000-memory.dmp

Download

memory/2652-200-0x00007FF6443E0000-0x00007FF644493000-memory.dmp

Download

memory/2652-147-0x000001E1579D0000-0x000001E157A36000-memory.dmp

Download

memory/2752-96-0x00007FF77EE30000-0x00007FF77EF79000-memory.dmp

Download

memory/2752-98-0x0000029AFB520000-0x0000029AFB586000-memory.dmp

Download

memory/2752-99-0x0000029AFB520000-0x0000029AFB586000-memory.dmp

Download

memory/2752-154-0x00007FF77EE30000-0x00007FF77EF79000-memory.dmp

Download

memory/2756-206-0x0000024951040000-0x00000249510A6000-memory.dmp

Download

memory/2756-241-0x00007FF642970000-0x00007FF642E75000-memory.dmp

Download

memory/2756-205-0x0000024951040000-0x00000249510A6000-memory.dmp

Download

memory/2756-204-0x00007FF642970000-0x00007FF642E75000-memory.dmp

Download

memory/3296-39-0x0000022DFD5F0000-0x0000022DFD656000-memory.dmp

Download

memory/3296-35-0x00007FF649840000-0x00007FF649908000-memory.dmp

Download

memory/3296-36-0x0000022DFD5F0000-0x0000022DFD656000-memory.dmp

Download

memory/3296-93-0x00007FF649840000-0x00007FF649908000-memory.dmp

Download

memory/3384-70-0x000001B2C4890000-0x000001B2C48F6000-memory.dmp

Download

memory/3384-72-0x00007FF656140000-0x00007FF6562A7000-memory.dmp

Download

memory/3384-63-0x00007FF656140000-0x00007FF6562A7000-memory.dmp

Download

memory/3384-65-0x000001B2C4890000-0x000001B2C48F6000-memory.dmp

Download

memory/3384-64-0x000001B2C4890000-0x000001B2C48F6000-memory.dmp

Download

memory/3408-180-0x00007FF767ED0000-0x00007FF7681EF000-memory.dmp

Download

memory/3408-178-0x000001669DB20000-0x000001669DB86000-memory.dmp

Download

memory/3408-174-0x000001669DB20000-0x000001669DB86000-memory.dmp

Download

memory/3408-173-0x000001669DB20000-0x000001669DB86000-memory.dmp

Download

memory/3408-172-0x00007FF767ED0000-0x00007FF7681EF000-memory.dmp

Download

memory/3432-213-0x00007FF62C0B0000-0x00007FF62C244000-memory.dmp

Download

memory/3432-167-0x000001C0A1900000-0x000001C0A1966000-memory.dmp

Download

memory/3432-164-0x000001C0A1900000-0x000001C0A1966000-memory.dmp

Download

memory/3432-166-0x00007FF62C0B0000-0x00007FF62C244000-memory.dmp

Download

memory/3480-38-0x0000000000AA0000-0x0000000000BB6000-memory.dmp

Download

memory/3480-0-0x0000000000AA0000-0x0000000000BB6000-memory.dmp

Download

memory/3480-1-0x00000000027F0000-0x0000000002859000-memory.dmp

Download

memory/3480-7-0x00000000027F0000-0x0000000002859000-memory.dmp

Download

memory/3604-75-0x00007FF78A520000-0x00007FF78A639000-memory.dmp

Download

memory/3604-134-0x00007FF78A520000-0x00007FF78A639000-memory.dmp

Download

memory/3604-77-0x00000188C1B20000-0x00000188C1B86000-memory.dmp

Download

memory/3604-76-0x00000188C1B20000-0x00000188C1B86000-memory.dmp

Download

memory/4488-163-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4488-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4488-106-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/4488-111-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/4500-27-0x000001D11DFA0000-0x000001D11E006000-memory.dmp

Download

memory/4500-26-0x00007FF649840000-0x00007FF649908000-memory.dmp

Download

memory/4500-28-0x000001D11DFA0000-0x000001D11E006000-memory.dmp

Download

memory/4500-62-0x00007FF649840000-0x00007FF649908000-memory.dmp

Download

memory/4500-29-0x000001D11DFA0000-0x000001D11E006000-memory.dmp

Download

memory/4900-55-0x000001881EA10000-0x000001881EA76000-memory.dmp

Download

memory/4900-54-0x000001881E7D0000-0x000001881E8E6000-memory.dmp

Download

memory/4900-56-0x000001881EA10000-0x000001881EA76000-memory.dmp

Download

memory/5032-210-0x00000267A2790000-0x00000267A27F6000-memory.dmp

Download

memory/5032-136-0x00000267A2790000-0x00000267A27F6000-memory.dmp

Download

memory/5032-135-0x00007FF7613C0000-0x00007FF7617D6000-memory.dmp

Download

memory/5032-137-0x00000267A2790000-0x00000267A27F6000-memory.dmp

Download

memory/5032-212-0x00007FF7613C0000-0x00007FF7617D6000-memory.dmp

Download

memory/5032-199-0x00007FF7613C0000-0x00007FF7617D6000-memory.dmp

Download

memory/5088-203-0x00007FF6010E0000-0x00007FF601382000-memory.dmp

Download

memory/5088-157-0x000001DE1C300000-0x000001DE1C366000-memory.dmp

Download

memory/5088-156-0x000001DE1C300000-0x000001DE1C366000-memory.dmp

Download

memory/5088-155-0x00007FF6010E0000-0x00007FF601382000-memory.dmp

Download

memory/5092-248-0x00007FF7FBE60000-0x00007FF7FC19D000-memory.dmp

Download

memory/5092-230-0x000001E72C900000-0x000001E72C966000-memory.dmp

Download

memory/5092-229-0x000001E72C900000-0x000001E72C966000-memory.dmp

Download

memory/5092-228-0x00007FF7FBE60000-0x00007FF7FC19D000-memory.dmp

Download

memory/5432-218-0x00007FF697E20000-0x00007FF697F4D000-memory.dmp

Download

memory/5432-219-0x0000023273710000-0x0000023273776000-memory.dmp

Download

memory/5432-220-0x0000023273710000-0x0000023273776000-memory.dmp

Download

memory/5432-245-0x00007FF697E20000-0x00007FF697F4D000-memory.dmp

Download

memory/5584-125-0x00007FF6C4C80000-0x00007FF6C4D2D000-memory.dmp

Download

memory/5584-127-0x00000180F9080000-0x00000180F90E6000-memory.dmp

Download

memory/5584-126-0x00000180F9080000-0x00000180F90E6000-memory.dmp

Download

memory/5584-184-0x00007FF6C4C80000-0x00007FF6C4D2D000-memory.dmp

Download

memory/5824-46-0x000001FFE2110000-0x000001FFE2176000-memory.dmp

Download

memory/5824-45-0x000001FFE1ED0000-0x000001FFE1FE6000-memory.dmp

Download

memory/5824-47-0x000001FFE2110000-0x000001FFE2176000-memory.dmp

Download

memory/6100-51-0x00007FF7A5760000-0x00007FF7A5882000-memory.dmp

Download

memory/6100-15-0x00007FF7A5760000-0x00007FF7A5882000-memory.dmp

Download

memory/6100-16-0x0000019856CA0000-0x0000019856D06000-memory.dmp

Download

memory/6100-18-0x0000019856CA0000-0x0000019856D06000-memory.dmp

Download

memory/6100-17-0x0000019856CA0000-0x0000019856D06000-memory.dmp

Download