5d01557a4d340b9a0ed6c7bb9c4d2d299280edca1e6b92fbafb249c24492a683

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 744KB
Sample260803-c6aa9sbj31
SHA256 5d01557a4d340b9a0ed6c7bb9c4d2d299280edca1e6b92fbafb249c24492a683
MD5 573026b6d3e840b91c8aee1a580e27c7
SHA1 b67eb2a477c9d79dc7ae48f70bbd5b7b40b59a87
SHA512 b1cac19835504beadbd39e3bd28b4523cf1d16dc033127df558bf5a2548b4cdedc7bfe086e3c5a2aaa252ab65a43fabfd1737d9321453152941d47622602767c
SSDEEP 12288:P9CG6vHzOASubviBNDYa3iVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTC:PoGGTWBZyVeEGRBOZRTnE7/N+x6diMg7
TLSH
T180F41211B2C0C0B3FAB3193446B4EA705A7DFD305F658AAB7785275E4E706D29A38363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
124	alg.exe
4248	GameInputSvc.exe
5544	GameInputSvc.exe
3260	elevation_service.exe
4224	elevation_service.exe
4696	maintenanceservice.exe
1100	msdtc.exe
5592	OSE.EXE
2776	PerceptionSimulationService.exe
1544	perfhost.exe
4840	ReFsDedupSvc.exe
3476	locator.exe
4704	SensorDataService.exe
2432	snmptrap.exe
5772	ssh-agent.exe
4328	TieringEngineService.exe
1780	AgentService.exe
4520	vds.exe
5628	vssvc.exe
3060	wbengine.exe
4260	WmiApSrv.exe
4656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\444b315b238bf42.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058b7049af122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093a83d9cf122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092947d99f122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000028a37c9bf122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c638398f122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b46e31d8f122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba48b59ef122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba20789bf122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5544	GameInputSvc.exe
5544	GameInputSvc.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	4248	GameInputSvc.exe
Token: SeBackupPrivilege	4840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4328	TieringEngineService.exe
Token: SeManageVolumePrivilege	4328	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1780	AgentService.exe
Token: SeBackupPrivilege	5628	vssvc.exe
Token: SeRestorePrivilege	5628	vssvc.exe
Token: SeAuditPrivilege	5628	vssvc.exe
Token: SeBackupPrivilege	3060	wbengine.exe
Token: SeRestorePrivilege	3060	wbengine.exe
Token: SeSecurityPrivilege	3060	wbengine.exe
Token: 33	4656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeDebugPrivilege	2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2360	2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 5544	4248	GameInputSvc.exe	91
PID 4656 wrote to memory of 5388	4656	SearchIndexer.exe	112
PID 4656 wrote to memory of 3952	4656	SearchIndexer.exe	113
PID 4656 wrote to memory of 1808	4656	SearchIndexer.exe	115
PID 4656 wrote to memory of 736	4656	SearchIndexer.exe	116
PID 4656 wrote to memory of 5472	4656	SearchIndexer.exe	117
PID 4656 wrote to memory of 5684	4656	SearchIndexer.exe	118
PID 4656 wrote to memory of 3056	4656	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:124

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4224

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3476

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4704

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2844 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2896 2892 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2844 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2896 2892 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 190804ffa7d5427aa1537cf1d7ebbfffaefa7c2177339978167b8cd9ceb42325
MD5 6b4e04f3ecd14bcc9f8e551a32fff63a
SHA1 e02a9adc300ae6885ca5df619aead60e67ca0ac9
SHA512 4146efbd216844d0c4fdf4ef609e53a3fc8ffae39b51d13e02b66c9e2b1511f22d4ffab56582575958ca589cef497ba097ce4f84a6586885a6314d671b4340bc
SSDEEP 49152:xb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnheBRUZRbgW5pQXe9:33q6gjBIwXM
TLSH
T136D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 c5e7e3d231e942dc7e994a837f7e23bb45166f73fdbc1fa7261db843203f74e7
MD5 a743dd75f8d7ea29276c557d5a4fe79d
SHA1 86d8318536bedfde70531477234d0c9c55476af8
SHA512 e43551320096935659f6ba952dc82feec5db574462f6811c7d5a4f6d1d2f423070fa781d23ac07e90f3ce4a4175164269c1255b339e7e5afcfee2245fffaa704
SSDEEP 24576:vXYettczAiVeEGRBOZRTnE7/N+x6diMgQXe9:rtczeBRUZRbgW5pQXe9
TLSH
T142050128B3D408F9FDAB817CC9B2C505E67378548760E79B03E49A660F236D85E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 e1e8b3bfd293aa4fe18ca0d63638b33005ced512d9fe5a25e73645dc5725390f
MD5 092aa4d918377ad8e1e62162922e3583
SHA1 53fa97dd0920f8a50e0a7a9902342d8bafb6af01
SHA512 759994f6cb1851660968a52e392630a57d3710faadc84e797e1bb121ca6d318dc8f991e1b3b35f1c03086b28c5f4b4e4ecdd76458d0593d7e12b09c9651d91f5
SSDEEP 24576:Uwu8OWTVeEGRBOZRTnE7/N+x6diMgQXe:UwvOweBRUZRbgW5pQXe
TLSH
T16805F14672D80CF9FAA79138C697C536F7F2B8112A25CB2B1760C64B5F37261AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 67c0cbf5587469371fbd86d258748f43a885ae0bc1223ae5dc953b617eb4d7dc
MD5 fc45687a1a748bf49be6e466eb625b84
SHA1 ba8332d54c4ef1034422fc913f05683d1eb565ca
SHA512 69190b750c5eff8d1fc1b33cb96cb1f6e7bb6bb970b6543b243cd679fe574f5736575cb26bcc4eaf951bacd1566f8aad85e8f8d99aae95c80679ad3f5eeda9c9
SSDEEP 49152:yB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glVeBRUZRbgW5pQXe9:Au6JmTxd2dVwXM
TLSH
T1BDD5AD13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 b312cc36382d642e73e3fbdaec54388486b8a7edfde6d981e197874d695956bc
MD5 105b8ee8b997bb4838ef82d4ab3dfce7
SHA1 3a4011d47df81e7173f47f9f8a723bf01a771cb1
SHA512 2b52f51b48e129a67b99f00dd8f73310a05ad3fa2336be39aa9b2adb8b45bec1d4f4d3460aa199aede650330c0b762288d0db1d0f29db2a6d9150459548e8a14
SSDEEP 12288:6F7JVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:6JVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T17ED42352C2CC484AFEFDA4B882F9EB08919D7578CF0585B3BE4672894876CD8E635317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 22110204c9c9ef9e7085e2ddf590233e780d3e2d07005d4f6df6631f18f961ce
MD5 7ac7a6b6a8c43e5d3212dad2b512d603
SHA1 a60f3d47b356768fdf818e63b0ca6fdd3436ce44
SHA512 9bdb7e312f805d8762010ee1b75ca2faac1733de3cd67a298cd1f834f6abf129a7d2d854887001af892b14bb1b96c4c7e5bb10e2447d88b46f68e8ef8a0591f0
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYOVeEGRBOZRTnE7/N+x6diMgQXe9:rgb4mBIBhGFReBRUZRbgW5pQXe9
TLSH
T1AD65AF1E22EC01F5E1F9E2B8CDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 f60d76dabb6115a1e8de029be44d13e07cc6b2e54e7cdcf03aaddfd3ab8d6822
MD5 f2e5b1c2ad03d166e9487aaa7cff4ae3
SHA1 fcecd33b2d993746524c6b29a64b7c583e21eab5
SHA512 2977a1477799081ac58d5ebba169f4ce82fd18d575cead1b9b4a4982cffa3d0ac3f1e13c36e6a0cdc9cbfebbe91c3a4c5ec85e268a551510c40ebd1fc2efe375
SSDEEP 12288:HLGzVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:rGzVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T16AE42329A1D92099FEBDC57DC5B5EA06B4F13070CB0556FF0ED1A1798F268E4B238B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 ea1f12bf6deb58f5a6da745bba9c2dfb7663d4b159997d2b8d4b5a9916ead9e4
MD5 fc28c8fe41e695a7ca7d5339be7f3c32
SHA1 dc8af3efd2088324af6711c064fd46d55266ffa0
SHA512 ade4b4c432bea68f2c4b3610f8c8200637ab8ee81e792f7cc00067f2e42a87540f1cabfb0857c1ce7e334ea903eed0f42029a37e4b5ac89e6d9ead6b94d71306
SSDEEP 12288:uIVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:uIVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T1EED42351D1C8448AFFF9E4BDC2F5EB0891983438CF4A46F36E867186496B8E9E234353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 60b676eb5e1af5e1c7fda94fdc0f6ecc695633f629a57d03e69ef1f70a0dcab8
MD5 d4da1c23afe13cd5391457bc7fec1069
SHA1 d9d8fd3f22949ec2ff15a94a7e48a82e3ba30aed
SHA512 670662ee19ea7c30f93a186655013914a36e3f60727901ecacfaaffc152f3a891badc38314261a207ebf78ddd35d5f322d291d61ff0010c6cb47d0fde06fcce2
SSDEEP 24576:Y3G8t8FpJqH1rzria7/m8VeEGRBOZRTnE7/N+x6diMgQXe9:yF+FPqVua7/HeBRUZRbgW5pQXe9
TLSH
T16335F265B2D101F1E47BD138CA968653F6B1B4250364EFEF0BA88B451F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 b7f34be4e1e51e611f04f0ae83fcc8425529911be1876336d1ab795c57b01a4e
MD5 89616d3d492655ab41037c3ee216dcf7
SHA1 7a0a5493c39b89a7ad7788a171483362ba4dcff2
SHA512 f8003efbfd1b1017c707bd846c45466637da69d98bcea8e3becdb6672a2dcef36da7015d9988f103e2a582bb429c760dea0e889959e8d17658824f8167438c9f
SSDEEP 24576:IPUr+NQeVeEGRBOZRTnE7/N+x6diMgQXe9:IJQEeBRUZRbgW5pQXe9
TLSH
T19405F12F62DC18E5FABAE17DC6828709E7717462071292DF02E1816E4E27DE8BD3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b8e11a6bd39563b0b324b5a136ca95287d7fc5ce350b8cfbf86608d29c081799
MD5 a314a1d85124199a184d59aeee1c3e70
SHA1 39a0db2526b26f42802d29c07f6556606761d9b3
SHA512 c365920c447221bae36b379bbcf1e7b6727b18603f3b6e56a8a6cdadbb70e219661f36c624b453317d94aa07773f8a635a0be5c3dd5abf67cd99a262c3fd623f
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjceBRUZRbgW5pQXe9:kG05lO43bvwXM
TLSH
T1FBD5C06E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF4953E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9840b03911ef79c97bc0bec867daf28ce52aa3a081024ac5d9bd5a27111350c8
MD5 e912c5012d43aec82abe89f8df9f1624
SHA1 b5f768ac740308234ccdcf1fc8f5ef2543bfc156
SHA512 d34006ac77a6b5e29d87aaea55785fc6a55bb19e753abf3d59e6c0bd6d32e896cf6a0f9257d875704c94253fc345c3b0030e95561d5746f53026700ea913b86b
SSDEEP 24576:gya5POZ3dpbWVM50JicR2hG0lasx2+47eidnNVeEGRBOZRTnE7/N+x6diMgQXe9:Ra5POZ3wJt2pasx2+mZeBRUZRbgW5pQc
TLSH
T19665BF5EA2FC00D5E5B9D17DC583861AF5B1342553329BCB122182BE3F27EE89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 24ffdf0fb07c53b47e5468bcc09a5d3c77a121b78e798ea939f1d9fed33cb52c
MD5 c27ed3d85cf221a4a855679dddcff548
SHA1 b673378baae242b61ebad9c28c14614d845d5cdb
SHA512 27a3264b747aa281f544a6cbebf4fe30e18d8f633c4c6f5ea9889db4c2b248862a59aeb979cb94965d67e7455799b68963d096e1c2efad1b60cb2b04cd33cb36
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FksVeEGRBOZRTnE7/N+x6diMgQXe9:HNc/zEOVHFfeBRUZRbgW5pQXe9
TLSH
T135858B1623E901E4F5BBE1BE89779546FAB1786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 84868ce6da70790026fd740560b30819643e149aa356d4c47b6082dd278e4b6e
MD5 1c028a278781b4b5c49e09ccde234b47
SHA1 b8adf6cc2c6e98c2289ecf770990218291534409
SHA512 5fb79db6c25d67035254f65dd2b35c552d5376852d526c0605a121486dfcc3730d26226fe787278160eee281da5c3b35accd2d236d34ebd5d3a05159b769ef6d
SSDEEP 24576:cJnJPbzB4S9VeEGRBOZRTnE7/N+x6diMgQXe9:cJnJv6SveBRUZRbgW5pQXe9
TLSH
T14115E03DD29810E8E8B7C2B4815A5B59FE71347C2F2269D719B4D4343F12EE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 70da2dcfa41e7f0b92f8b88f2cfd430d802ee962a8de9b922426a3b43c4bd019
MD5 23b4872b4d0da2187defec0ba17a1bfe
SHA1 b1d944ff40ee1cda3d2f22b3727f4a09debb2c8f
SHA512 bd5ae187de520be94e517fcbcd4d73fbafafc607507bca52add8c44cfa1ad1e38fc387b27da184a3fac89756fdd396f5237847a4e078cb3115da57829758bb29
SSDEEP 49152:oCLHGeeV5ijCmlDWDk0eBRUZRbgW5pQXe9:TWwXM
TLSH
T1F1A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 28f96f0b379c8ba3d208efb2b69e3dd8b72407236955c262492597dbe5900dde
MD5 d3e5c7bd987ede408fbb16f82d7d15f7
SHA1 5c72f87ff75cb630d2b9481f8674fc30dedfb4ba
SHA512 3b8adc037fb22249f6d6a40ebbd6a086f35a3796f073c3de447a4e29bef18f63249bcb905c7ad71b82ff6238600c33cf074bcbbd0775a11b295215da45355e88
SSDEEP 12288:D1Hck6j5ZI7/VedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:36DIDVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T168F4F15D63AA10FAE1BBD03DC6934501D2B2B070C7165AEF0BD4D5BA4EA3DD8B538B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 4b4dfc7018033b3db8c19100503611b2c4a012652e85b555a60e5bdd1796416b
MD5 d8c6fd3a9cd4d04728cb79b8521dcbb8
SHA1 f27874d921918cdb99b9bf3891e47c4193b3a867
SHA512 8b2313c5e5647eb1ecf54883c4ec96bed0340958571027e0e6f4b0cf2b05d9f95e4ba9cfb2495a668afbd9c1431e695e730f2eec094fc3bb82ef2519129bbac0
SSDEEP 12288:rG6kyHVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:KtyHVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T174F4120193C850D9FEF9557CCAB2C2449A79BC309F1287EB6AD1B61E0E36AD4E530713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 646f3a379e4249f3bd22dc7a600231e3ae2b7276ed6b307794ba212762b4e768
MD5 ddf8a3b6885478798330d710425d828e
SHA1 d7ba8dfc792f4a3ef31bed79358ea276a75bacde
SHA512 8f0e488903593013622ee7b7a48618149c3069e472463fca0e957e70542fb8d58410ac8bed82fa0eed5604ccaba0ce25b1ab3b4ee1cf6282dd201693babd0fbd
SSDEEP 12288:CI1VedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:91VeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T18CD42365D1C9548AFEF8E4BDC2B5EB0591A930388F0656F37DC2B1858A7B8D9E235303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 9a46c42319fe64ae504a61bd55234f028bbbdedd0f520a58a48084d965e6988b
MD5 ba093654759bfb4c1024153df3ffcca1
SHA1 a6c0c16fdd06876f0961df839341e20537cde60d
SHA512 9d9fd575ae7a8e691b75894aefe984f4b6b8cc5922ea156f64e8a473e37793b12c5d19f46e234d487a3421b37079f186b3b33ec528ac0e7a9a3f9884161c290b
SSDEEP 24576:C/gyLoTfaidZDVeEGRBOZRTnE7/N+x6diMgQXe9:IgRTrZheBRUZRbgW5pQXe9
TLSH
T15E559D1DA3EA05CAE2B2D279D9725483D633B4315772C6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 25051d50ebfbf1ffbe11182fc1af2692cc29e3e944fa2ddaa5b1c689a08e7e0c
MD5 4c2fabcef19ab43a919741271246b932
SHA1 ecac6cc814c6ee3fea4819033961ae572733247c
SHA512 20d7e8ed70962839f5f45344366853ecf1a7b2ba22fa671d1f796b45fee88c30b380ef29238d63d9a58464a6d36408e257bf3efac36ab77257a1fc78da6fa38c
SSDEEP 12288:WpJcm8CNUMVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:WrcmRFVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T10C05015EB2AE00E6E6BBC13CC9818605E2B37030571257EB06A1C77E4E679EDBD34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 47cd8cff1ae19ab416ba6762b8de22f713b76236e2541863e39598e5fd6f3d88
MD5 a3f202ca0663ccbcf38be6c83233c670
SHA1 61e1e7d3388734d06c1214022cfcbde43f2a0efd
SHA512 408e8c4aeb286bb67edc35ca0d793881822d73891a86f09384923284c1eac77134c8502d8f5fc7a91df430404eee01b2a35490d8b9e701e71c90a46fecb3cc60
SSDEEP 49152:+DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3DeBRUZRbgW5pQXe9:f3Upow8sBMwXM
TLSH
T100A58C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BDF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-15-0x00007FF742620000-0x00007FF742741000-memory.dmp

Download

memory/124-51-0x00007FF742620000-0x00007FF742741000-memory.dmp

Download

memory/124-18-0x00000254E4120000-0x00000254E4186000-memory.dmp

Download

memory/124-17-0x00000254E4120000-0x00000254E4186000-memory.dmp

Download

memory/124-16-0x00000254E4120000-0x00000254E4186000-memory.dmp

Download

memory/1100-76-0x0000027740230000-0x0000027740296000-memory.dmp

Download

memory/1100-77-0x0000027740230000-0x0000027740296000-memory.dmp

Download

memory/1100-75-0x00007FF7635C0000-0x00007FF7636D8000-memory.dmp

Download

memory/1100-134-0x00007FF7635C0000-0x00007FF7636D8000-memory.dmp

Download

memory/1544-154-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1544-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1544-106-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/1544-111-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/1780-178-0x000002033F760000-0x000002033F7C6000-memory.dmp

Download

memory/1780-180-0x00007FF730650000-0x00007FF73096F000-memory.dmp

Download

memory/1780-172-0x00007FF730650000-0x00007FF73096F000-memory.dmp

Download

memory/1780-174-0x000002033F760000-0x000002033F7C6000-memory.dmp

Download

memory/1780-173-0x000002033F760000-0x000002033F7C6000-memory.dmp

Download

memory/2360-0-0x0000000000770000-0x0000000000886000-memory.dmp

Download

memory/2360-1-0x0000000002620000-0x0000000002689000-memory.dmp

Download

memory/2360-6-0x0000000002620000-0x0000000002689000-memory.dmp

Download

memory/2360-7-0x0000000002620000-0x0000000002689000-memory.dmp

Download

memory/2360-37-0x0000000000770000-0x0000000000886000-memory.dmp

Download

memory/2432-148-0x00000261ABB20000-0x00000261ABB86000-memory.dmp

Download

memory/2432-211-0x00007FF6767F0000-0x00007FF6768A2000-memory.dmp

Download

memory/2432-146-0x00007FF6767F0000-0x00007FF6768A2000-memory.dmp

Download

memory/2432-147-0x00000261ABB20000-0x00000261ABB86000-memory.dmp

Download

memory/2776-96-0x00007FF6758C0000-0x00007FF675A08000-memory.dmp

Download

memory/2776-98-0x0000025BC2D80000-0x0000025BC2DE6000-memory.dmp

Download

memory/2776-99-0x0000025BC2D80000-0x0000025BC2DE6000-memory.dmp

Download

memory/2776-145-0x00007FF6758C0000-0x00007FF675A08000-memory.dmp

Download

memory/3060-247-0x00007FF7C1470000-0x00007FF7C1975000-memory.dmp

Download

memory/3060-203-0x000002BA56FC0000-0x000002BA57026000-memory.dmp

Download

memory/3060-204-0x000002BA56FC0000-0x000002BA57026000-memory.dmp

Download

memory/3060-202-0x00007FF7C1470000-0x00007FF7C1975000-memory.dmp

Download

memory/3260-45-0x0000026A5C270000-0x0000026A5C37E000-memory.dmp

Download

memory/3260-46-0x0000026A5C450000-0x0000026A5C4B6000-memory.dmp

Download

memory/3260-47-0x0000026A5C450000-0x0000026A5C4B6000-memory.dmp

Download

memory/3476-190-0x00007FF79CAF0000-0x00007FF79CB9C000-memory.dmp

Download

memory/3476-127-0x00000288E5840000-0x00000288E58A6000-memory.dmp

Download

memory/3476-126-0x00000288E5840000-0x00000288E58A6000-memory.dmp

Download

memory/3476-125-0x00007FF79CAF0000-0x00007FF79CB9C000-memory.dmp

Download

memory/4224-54-0x0000020DC3720000-0x0000020DC382E000-memory.dmp

Download

memory/4224-56-0x0000020DC3950000-0x0000020DC39B6000-memory.dmp

Download

memory/4224-55-0x0000020DC3950000-0x0000020DC39B6000-memory.dmp

Download

memory/4248-62-0x00007FF7F6FB0000-0x00007FF7F7077000-memory.dmp

Download

memory/4248-27-0x00000153CE1F0000-0x00000153CE256000-memory.dmp

Download

memory/4248-28-0x00000153CE1F0000-0x00000153CE256000-memory.dmp

Download

memory/4248-29-0x00000153CE1F0000-0x00000153CE256000-memory.dmp

Download

memory/4248-26-0x00007FF7F6FB0000-0x00007FF7F7077000-memory.dmp

Download

memory/4260-214-0x00000191EB970000-0x00000191EB9D6000-memory.dmp

Download

memory/4260-212-0x00007FF7290C0000-0x00007FF7291ED000-memory.dmp

Download

memory/4260-250-0x00007FF7290C0000-0x00007FF7291ED000-memory.dmp

Download

memory/4260-213-0x00000191EB970000-0x00000191EB9D6000-memory.dmp

Download

memory/4328-236-0x00007FF7F3A00000-0x00007FF7F3B93000-memory.dmp

Download

memory/4328-166-0x0000022506E20000-0x0000022506E86000-memory.dmp

Download

memory/4328-165-0x00007FF7F3A00000-0x00007FF7F3B93000-memory.dmp

Download

memory/4328-164-0x0000022506E20000-0x0000022506E86000-memory.dmp

Download

memory/4520-243-0x00007FF6BAE90000-0x00007FF6BB119000-memory.dmp

Download

memory/4520-184-0x00007FF6BAE90000-0x00007FF6BB119000-memory.dmp

Download

memory/4520-186-0x0000016544570000-0x00000165445D6000-memory.dmp

Download

memory/4520-185-0x0000016544570000-0x00000165445D6000-memory.dmp

Download

memory/4656-223-0x0000023FE1DB0000-0x0000023FE1E16000-memory.dmp

Download

memory/4656-222-0x0000023FE1DB0000-0x0000023FE1E16000-memory.dmp

Download

memory/4656-224-0x00007FF610FB0000-0x00007FF6112ED000-memory.dmp

Download

memory/4656-251-0x00007FF610FB0000-0x00007FF6112ED000-memory.dmp

Download

memory/4696-63-0x00007FF67BF10000-0x00007FF67C077000-memory.dmp

Download

memory/4696-64-0x00000266B9B10000-0x00000266B9B76000-memory.dmp

Download

memory/4696-72-0x00007FF67BF10000-0x00007FF67C077000-memory.dmp

Download

memory/4696-70-0x00000266B9B10000-0x00000266B9B76000-memory.dmp

Download

memory/4696-65-0x00000266B9B10000-0x00000266B9B76000-memory.dmp

Download

memory/4704-137-0x000001A5A6D40000-0x000001A5A6DA6000-memory.dmp

Download

memory/4704-237-0x000001A5A6D40000-0x000001A5A6DA6000-memory.dmp

Download

memory/4704-135-0x00007FF65D6E0000-0x00007FF65DAF5000-memory.dmp

Download

memory/4704-239-0x00007FF65D6E0000-0x00007FF65DAF5000-memory.dmp

Download

memory/4704-201-0x00007FF65D6E0000-0x00007FF65DAF5000-memory.dmp

Download

memory/4704-136-0x000001A5A6D40000-0x000001A5A6DA6000-memory.dmp

Download

memory/4840-118-0x000001E27A5A0000-0x000001E27A606000-memory.dmp

Download

memory/4840-119-0x000001E27A5A0000-0x000001E27A606000-memory.dmp

Download

memory/4840-255-0x00007FF6C1720000-0x00007FF6C1E62000-memory.dmp

Download

memory/4840-253-0x000001E27A5A0000-0x000001E27A606000-memory.dmp

Download

memory/4840-183-0x00007FF6C1720000-0x00007FF6C1E62000-memory.dmp

Download

memory/4840-117-0x00007FF6C1720000-0x00007FF6C1E62000-memory.dmp

Download

memory/5544-36-0x0000025E103A0000-0x0000025E10406000-memory.dmp

Download

memory/5544-35-0x00007FF7F6FB0000-0x00007FF7F7077000-memory.dmp

Download

memory/5544-38-0x0000025E103A0000-0x0000025E10406000-memory.dmp

Download

memory/5544-86-0x00007FF7F6FB0000-0x00007FF7F7077000-memory.dmp

Download

memory/5544-39-0x0000025E103A0000-0x0000025E10406000-memory.dmp

Download

memory/5592-88-0x0000023BC6190000-0x0000023BC629E000-memory.dmp

Download

memory/5592-90-0x0000023BC6370000-0x0000023BC63D6000-memory.dmp

Download

memory/5592-89-0x0000023BC6370000-0x0000023BC63D6000-memory.dmp

Download

memory/5628-194-0x00007FF7DE7D0000-0x00007FF7DEC9F000-memory.dmp

Download

memory/5628-246-0x00007FF7DE7D0000-0x00007FF7DEC9F000-memory.dmp

Download

memory/5628-195-0x000001C71A160000-0x000001C71A1C6000-memory.dmp

Download

memory/5628-193-0x000001C71A160000-0x000001C71A1C6000-memory.dmp

Download

memory/5772-221-0x00007FF603A40000-0x00007FF603CE2000-memory.dmp

Download

memory/5772-158-0x000001535C660000-0x000001535C6C6000-memory.dmp

Download

memory/5772-157-0x000001535C660000-0x000001535C6C6000-memory.dmp

Download

memory/5772-155-0x00007FF603A40000-0x00007FF603CE2000-memory.dmp

Download