eaf65abd482c4ad3f71ddc1b1c80f6c94e6d71433bd35571f01244926a759cf9

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 745KB
Sample260808-ly3ghsdk9w
SHA256 eaf65abd482c4ad3f71ddc1b1c80f6c94e6d71433bd35571f01244926a759cf9
MD5 7003205438d0d3f32645ed74b221d2da
SHA1 0e5fb23836072bcfca2de215b028dba9af042689
SHA512 f7c7ae9c8c391528eda970433d92f6e7cffe81a536289f69d6c9277b1fecda93256ec8b8e5f001c0c26e530e5cc308f7454dbde5845b60ef3c4a7600dc03129b
SSDEEP 12288:j93G6vHzyA7ubviBNDYa36T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJov:jVGGTBBZqT7Jckdwi6i9bNrqq4E41WFJ
TLSH
T161F4120072C080B7D6B3553046B8EAB0AA7DFE312F74AE9B639413695D743D25A39B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1824	alg.exe
3052	GameInputSvc.exe
5160	GameInputSvc.exe
2648	elevation_service.exe
4584	elevation_service.exe
3612	maintenanceservice.exe
3996	msdtc.exe
2788	OSE.EXE
1032	PerceptionSimulationService.exe
1332	perfhost.exe
4524	ReFsDedupSvc.exe
5840	locator.exe
2116	SensorDataService.exe
2600	snmptrap.exe
3448	ssh-agent.exe
4520	TieringEngineService.exe
3244	AgentService.exe
5592	vds.exe
3004	vssvc.exe
3432	wbengine.exe
2828	WmiApSrv.exe
5720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\623fb4aae62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea6c346f1c27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002662b6711c27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033762c6f1c27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5160	GameInputSvc.exe
5160	GameInputSvc.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	3052	GameInputSvc.exe
Token: SeBackupPrivilege	4524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	TieringEngineService.exe
Token: SeManageVolumePrivilege	4520	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3244	AgentService.exe
Token: SeBackupPrivilege	3004	vssvc.exe
Token: SeRestorePrivilege	3004	vssvc.exe
Token: SeAuditPrivilege	3004	vssvc.exe
Token: SeBackupPrivilege	3432	wbengine.exe
Token: SeRestorePrivilege	3432	wbengine.exe
Token: SeSecurityPrivilege	3432	wbengine.exe
Token: 33	5720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeDebugPrivilege	3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3376	2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 5160	3052	GameInputSvc.exe	91
PID 5720 wrote to memory of 3424	5720	SearchIndexer.exe	113
PID 5720 wrote to memory of 5900	5720	SearchIndexer.exe	114
PID 5720 wrote to memory of 1904	5720	SearchIndexer.exe	115
PID 5720 wrote to memory of 5212	5720	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_7003205438d0d3f32645ed74b221d2da_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1824

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4584

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2916 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2932 2920 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 030da25e8a9abc3f9f6c8cdfd51c32320ddee651677111d06147695b1e8b0c5a
MD5 19370241b02049733ab4b2dd4af6b49d
SHA1 434f52ccdf7e8b9194bcf4bea3f6cfee0d19c770
SHA512 88cbfa15fd4fd98d8d4aa47cd10d5206b0c9fc402cad8871728f465c9438f750c45663db73e66531c955321415ba2d3dea7c6f2f39ba7f1e40f09091a352aa2d
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnW7Jckdwi3N7+WTW3:L3q6gjBnPdwi3Q
TLSH
T15BD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 9eb153802c42f9463495dffcc1c05b3a0a462db8bc11f48b3b5e18b341e21901
MD5 5bb92ad4e99cd30329e7ae326dcf9761
SHA1 3b9e07ce767827006053d18cc5f5ba3d4b8c8b13
SHA512 a8f1e098ceb351fa44196dc65cea0eaff0e8f53805be19b81b229fcec3cdc38dd3413afee285b1e6b29c20c61c58c4d4c1706709fed7d748ef710e91a098751d
SSDEEP 24576:TXYHDxczAyT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xcN7Jckdwi3N7+WTW3
TLSH
T19E050128A3E509F9ED678239C9B2C511EB7378514760FB8B03E496651F233846E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 896ca1293103e518689c1a2e878ea6f046002456fbd9a352d5f933e69bb7e33d
MD5 047c9b0d1dada6c3b7d6ce9e1f825dd0
SHA1 3a0af23e595e93aa452b76afeebc831f58e979fc
SHA512 99d7cac90889e8397b924c7df959ec78bebe04845ea81f8247e1cac36b9f4532cb827fd6f2251e81cdcd0aaa950c31584a70f26f75a624527e7771b07f36aa24
SSDEEP 24576:Owu+OWHT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOs7Jckdwi3N7+WTW3
TLSH
T1AD05F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ef0805bc7cd54c04decb338b2195d76eca2d68ab04ca5700f5db9258917f9106
MD5 353da6ef88731cb7dfc9caeb6e12e159
SHA1 98068a1da816672e5545f853b5f39df9fba30f43
SHA512 d054a0806fc2a0d22fcbe3456a5a40cd32c79e2e3f4053afefc63659b7b519e2dc5255b169fc6e660c6e92a4fb2ac37f625b08a854b9f0ef4775316ecce52826
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glH7Jckdwi3N7+WTW3:Hu6JmTxd2ddPdwi3Q
TLSH
T1EBD59D13F1DA01E8D06ED478974AA232FA62BC490B35B6DF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 61543ec76e01b5da8c27ad97db99b350a7fb5cfc21fe193d949862cb146881e5
MD5 754fec43632ac4a6e6efa0878d753736
SHA1 115f8949623a811d62a19ed36bd1e3701ba3c87a
SHA512 abb0ef74aab53da8027c89c5a7cfd1f7d8033bbc01929fc32958a3bdb9a5738938a490a3c9a552efb545de0632838cd21fd1879ee92565a4ae62279c21693526
SSDEEP 12288:cM7L9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hL9T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1CED42308C75D5A5BE277E231823DD264F66C3F522F54FA47974462E064293807FABF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c61006850c846e9e17a2f02f074a3c7440b9716b42722391f5d476a396cd097b
MD5 859608d5cd01188b03282685a11d93b5
SHA1 324184967f9e47b6df2090531742d29bcf150139
SHA512 7b60914e5ad0527960438db4ae9a57c1cad3bb34e1c1bb7cbd738367705c26a1aa24e78fc668e5111d2f646d556787e75ceb33dfa0641eb8afe094f3fb0f58a8
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYfT7Jckdwi6i9bNrqq4E41WFpW3oRos:Dgb4mBIBhGFY7Jckdwi3N7+WTW3
TLSH
T16165AE1E22EC02F5E0FAE2B8CDAA4417D6B278161731D2DF1251426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 88f5c8f49da75f81e0c7c580f513cffb168dfa95233078a18aadd0e84140cd40
MD5 7ba97a78efa9589129c322658067d3d5
SHA1 b52f3d3e5c05f22f7160954fce69ee518f00f083
SHA512 2b30e1cec3690b32b87eb64dc8bbb4d5c5f956fb30cd7fab8f3cc02f9c71ed762d0ada3f1fe30b747170aec1fd680e4b0094dd0216c22a4cbadbe1a1c3254b26
SSDEEP 12288:f9GCDT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GCDT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T17CE4230C61A635E9C677D231C63DE5A5F9F03A512B247AEF06D0A2709B193D0737EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 9088c5fb40fde5b41fd1c6dcb4c917fc80994ea5fe4b436913dcae82ae4234ea
MD5 93368117ad1d19a4721c66a1c39c099e
SHA1 540174a7a12692b464550c04359b0ef8b3cfe954
SHA512 1f305198d1ae45b3d5eb1f544760f880b042bec708c972c3a2c65ca0f87f1cb0a2e3e8c8f075cc162e12b2b4132041ce577d83c5aaf1d87c209407a521abec79
SSDEEP 12288:ZUT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZUT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T19AD4234C8259569BE353E231823DE694FAA82F033B55BBC3469462A0555E3C077BFF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 177f7750a13c0b70bc2a033da2b9ba988de4ad2ac93a9d4767faa378100325a6
MD5 f50d30024e804fe63c563caed577b0f3
SHA1 cc7ad421e96d448fd55a669f52fa87208dd0223d
SHA512 13adeb614b68fd8838686512d6c80208599514f12dd605e2f2150cfa934f0b2bf66ebe29be66a3410033d7f65eb6605bcae36deb45067cbc4fc10e2d12ed3637
SSDEEP 24576:ogi8u8FpJqH1sCrDC7/mdT7Jckdwi6i9bNrqq4E41WFpW3oRos:9RZFPqVbC7/a7Jckdwi3N7+WTW3
TLSH
T16C35F165A6E102F5D477D1388A9686A3F6B1B8211364FFDF07A88B511F236D04B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 7ccf38614279e82a54427a3dd7f3f98441612f11c22f8be645dbde0b494db2a8
MD5 16f4ce53f5d1f08d865f9b1432aa856a
SHA1 349f9a380638aa9d716ddd91e34f95801294de7b
SHA512 5bd962e7c8a0588417a290b8c446341f627899fa190da3a8ce6444402d49d6a9e9f2fd212902155fd56660243d285e7113e06932a191164a9c7b89f6a6c1e289
SSDEEP 24576:vPUr+NQKT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQA7Jckdwi3N7+WTW3
TLSH
T17105F11E62AC18E5E677E13D86568719F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 fe22057d038044a30fe8307b5754154abb9ae53d0738abf591ebb4cc4282a37e
MD5 06addfc92e061cf44d8947b5561d8d08
SHA1 405898b00eda1a00a25452077d0c974cd443a2af
SHA512 e0e98e6116cfc69657f620988a8c2f461b988ef5e16f28f045d3cfc3ef3077769558cb978af7e77d11fde7e6a2b1908c64171555fe6d2cb1ce32f5bb2a96d9ae
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjL7Jckdwi3N7+WTW3:SG05lO43bUPdwi3Q
TLSH
T1A5D5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 3e0164d206303859a33c668adcd42c3cf33ce3897244c43a745de13716f7563f
MD5 fb4b4b72005b359db11b1ca5427569a7
SHA1 5cfc24dc409db7b1225f34fc9593de175d859dd3
SHA512 1d0e596f9789d5e9d0ceeed8fc6841f975d53726aa66001a08e75670a6470823eed544307d24d25c47374c83d001195bcad84ffc6a59cea0ef196f785c644fc3
SSDEEP 24576:Fca5POZ3dpbWVM50JicR2hG0lasx2+47eidnuT7Jckdwi6i9bNrqq4E41WFpW3ov:Ga5POZ3wJt2pasx2+ma7Jckdwi3N7+Wa
TLSH
T15265AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f9d224f835ffb21db3f751192421cb0e09178ac0eb4de8effbdfdbe5c4339db
MD5 5241799c09f49e8830c8aac65ecf10bf
SHA1 0ac38aa925318106e8ce00ed7f4a5ddff02b09f4
SHA512 19332aa887298430a34814d8c5f4e64c7b4ea68dc41fe7f9b5ff960b9e2918ed47057d4f5f01134a25a54f09b9e55d3c5b5bebc702551f163b884d23ccdb17a3
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkpT7Jckdwi6i9bNrqq4E41WFpW3oRos:tNc/zEOVHFW7Jckdwi3N7+WTW3
TLSH
T1A8858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 f193fb430c180b623cd96f7449ac9736a04a7e53c1af86335d60fc3d65012d42
MD5 c3e0132e61c5c7504d999cecaa6f3dba
SHA1 356c85d30671351f150caf5310083ab8a04e909c
SHA512 b94bbb4bd4dc143c34d6986cb259cb3ffd765703f3b145c756ecd68fcffb173d96a6847f6d5758eb45a0969f30e1999c393ef6e38054b040c4d322c530cf7db6
SSDEEP 24576:hJnJPbzB4SbT7Jckdwi6i9bNrqq4E41WFpW3oRos:hJnJv6Sn7Jckdwi3N7+WTW3
TLSH
T18B15E02CD2A810E9E4B7C2B4811A1799FF71386D2F2669C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4ac1d58249da74b7fe4db58198e969c05154c2c1e5c527252e802236e3f7426d
MD5 626abec4af389c8d77095ec5c6e47752
SHA1 a4b27a1a56f6039ece9ee27b5fd3f9ea0c7610e0
SHA512 3fc59f1d52b13d90d55cf260118899f8382afb7cbc8bd2224ed372d479a5c6f2e5235431406ef3d8c1702e08170fdd5c1a6a550a4711a1b42eda642dde38bd74
SSDEEP 49152:nCLHGeeV5ijCmlDWDkl7Jckdwi3N7+WTW3:CdPdwi3Q
TLSH
T18FA56B05E7EB5184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 50fcf921c08cfaed17cf51202d8a2693d2cd5f817a18bcfc37f66548604ee98b
MD5 6b69bd4515d7aeca89b4a240616b32f9
SHA1 3ead4d697c95b21eceb9e0c86905e8be76e0b607
SHA512 e9d75b1c15ce75830d2d3d33adccc6a67d90d99dba6a02965edc1cb7876305b21eeec2d2819653f4fc2db8cb11a1245b01ad9936be7d9ea290836eb0b6e875d5
SSDEEP 24576:gLDIqT7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDIg7Jckdwi3N7+WTW3
TLSH
T11CF4010C637A11FAD167D03EC6934151E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 e413c86cabfc229d78898d01e5f375920770431f233b106ba2923bde6fb9ed14
MD5 0613630de116a3199b0cef748eda275c
SHA1 72429416bc8216be909bc36284408e7d2764dd32
SHA512 3478e8c30cfc431fa8d17836e52af3a946044d0f154ef3c140c533af3abda0d46f4b99bfe38f0e4bea8039dcbff2efe4850409b67896aec061fa1b808b014f87
SSDEEP 12288:CG6kyDT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rtyDT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T1F2F41208539421D9E6B69234CA7682A4EF747C116B21A7CF46D0E33D2F3A7C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 a351f940d5d001089368bf830d08bc04f8996899bea7970a2e6bf820e29d8e68
MD5 c680640f29f3056fb6cd1221bf28edaf
SHA1 c0e83373bdb45579d5892f72ed44d58b450ca232
SHA512 3e5ff80ff47bdb31ddc2ceab5e2d5399ed94b567ffeffe82d305cab8afdc4863afbf4bf04f7e7463ac4560aeba1d0eced897e5982ed24e3f11543ac6a06faf37
SSDEEP 12288:mmgT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:HgT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F3D4234C925926ABD653E231823DD7D4F6B83A623F167ACB46D0A2B0851D3C0777BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 5e13be9a180b9511928636cef9d71fa03d91150fdbb072afb605748e107f7df3
MD5 d04bd0d45a3ebfd0f5fa1caedd6b335f
SHA1 6538fe06eb7a712dccbc0dd6909617166b4cec0d
SHA512 9af97884702cb90127fce26e8c22c99c28cd79ef2c63a9b5e65482969a1eb5592ae8e969fa0612031fbcdd2df061b62679121ce65ff0e1d7f89e0e09ffc29315
SSDEEP 24576:pCgN5oTfaidZYT7Jckdwi6i9bNrqq4E41WFpW3oRos:wgETrZa7Jckdwi3N7+WTW3
TLSH
T171559D1DA3EA05CAE2B2D235D9725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 602cacced2b9b9837dbff06f64d0ddb9dec841a33ce96a38723310f0b7b5bb4e
MD5 2d0ff2eaabcef08277ceb8bc9b061082
SHA1 0bda0058586a8b82fcbdef75570ef8a9af25fe21
SHA512 2722cf9c7fc2c3e07ff4ab7fc8b7238f794ea20551ee3f6f388789fb3ea34fd31182b0ecefaed0e5e3b1a4410a71aa55d723297f4bf09d5e988c6fab6d6ffac8
SSDEEP 24576:hrcmRzT7Jckdwi6i9bNrqq4E41WFpW3oRos:1cmRP7Jckdwi3N7+WTW3
TLSH
T12B05F14EB2AE00E6E1B7D23CC9558655F6B37431271267CF02A0C37D4A676E97E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5502e916f18387744d3dbc0d1d64eb9489c62951e0e8e49995917a4493351ba2
MD5 ed9087c89598c2dba5ce3a842954b289
SHA1 29d2989bc8fa27b44c9bcc9c8eb1a59b28339a44
SHA512 32dae6076cf176ab16e25168dbd137c9dfab6e242efc8b83be8105b23c4deb90550074bf99c25dfe114fa96717f1ba1f66f67596ecae08cfade40814cd66f24e
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS307Jckdwi3N7+WTW3:j3Upow8sBvPdwi3Q
TLSH
T1BDA58C3DA2E810A8D9AAC379C54213A5EA71782E3F3055DB0174C178BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-96-0x00007FF62ED50000-0x00007FF62EE99000-memory.dmp

Download

memory/1032-99-0x0000019F91790000-0x0000019F917F6000-memory.dmp

Download

memory/1032-98-0x0000019F91790000-0x0000019F917F6000-memory.dmp

Download

memory/1032-144-0x00007FF62ED50000-0x00007FF62EE99000-memory.dmp

Download

memory/1332-153-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1332-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1332-106-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1332-111-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1824-15-0x00007FF7316F0000-0x00007FF731812000-memory.dmp

Download

memory/1824-16-0x000001A7ADF80000-0x000001A7ADFE6000-memory.dmp

Download

memory/1824-18-0x000001A7ADF80000-0x000001A7ADFE6000-memory.dmp

Download

memory/1824-17-0x000001A7ADF80000-0x000001A7ADFE6000-memory.dmp

Download

memory/1824-51-0x00007FF7316F0000-0x00007FF731812000-memory.dmp

Download

memory/1904-270-0x0000015CD01D0000-0x0000015CD0418000-memory.dmp

Download

memory/1904-433-0x0000015CD01D0000-0x0000015CD0418000-memory.dmp

Download

memory/2116-240-0x00007FF68F160000-0x00007FF68F576000-memory.dmp

Download

memory/2116-238-0x0000020121E00000-0x0000020121E66000-memory.dmp

Download

memory/2116-207-0x00007FF68F160000-0x00007FF68F576000-memory.dmp

Download

memory/2116-135-0x00007FF68F160000-0x00007FF68F576000-memory.dmp

Download

memory/2116-137-0x0000020121E00000-0x0000020121E66000-memory.dmp

Download

memory/2116-136-0x0000020121E00000-0x0000020121E66000-memory.dmp

Download

memory/2600-208-0x00007FF799660000-0x00007FF799713000-memory.dmp

Download

memory/2600-147-0x0000029A46050000-0x0000029A460B6000-memory.dmp

Download

memory/2600-145-0x0000029A46050000-0x0000029A460B6000-memory.dmp

Download

memory/2600-146-0x00007FF799660000-0x00007FF799713000-memory.dmp

Download

memory/2648-45-0x000001E39B4E0000-0x000001E39B5DB000-memory.dmp

Download

memory/2648-46-0x000001E39B6B0000-0x000001E39B716000-memory.dmp

Download

memory/2648-47-0x000001E39B6B0000-0x000001E39B716000-memory.dmp

Download

memory/2788-89-0x0000011FE1D70000-0x0000011FE1DD6000-memory.dmp

Download

memory/2788-88-0x0000011FE1BA0000-0x0000011FE1C9B000-memory.dmp

Download

memory/2788-90-0x0000011FE1D70000-0x0000011FE1DD6000-memory.dmp

Download

memory/2828-249-0x00007FF6FF030000-0x00007FF6FF15E000-memory.dmp

Download

memory/2828-214-0x0000013FB12E0000-0x0000013FB1346000-memory.dmp

Download

memory/2828-213-0x00007FF6FF030000-0x00007FF6FF15E000-memory.dmp

Download

memory/2828-215-0x0000013FB12E0000-0x0000013FB1346000-memory.dmp

Download

memory/3004-192-0x0000013166A00000-0x0000013166A66000-memory.dmp

Download

memory/3004-244-0x00007FF712B90000-0x00007FF713060000-memory.dmp

Download

memory/3004-197-0x00007FF712B90000-0x00007FF713060000-memory.dmp

Download

memory/3004-193-0x0000013166A00000-0x0000013166A66000-memory.dmp

Download

memory/3052-27-0x000001AE80B30000-0x000001AE80B96000-memory.dmp

Download

memory/3052-61-0x00007FF6D5600000-0x00007FF6D56C8000-memory.dmp

Download

memory/3052-28-0x000001AE80B30000-0x000001AE80B96000-memory.dmp

Download

memory/3052-29-0x000001AE80B30000-0x000001AE80B96000-memory.dmp

Download

memory/3052-26-0x00007FF6D5600000-0x00007FF6D56C8000-memory.dmp

Download

memory/3244-177-0x00007FF644890000-0x00007FF644BB0000-memory.dmp

Download

memory/3244-178-0x00000144C60D0000-0x00000144C6136000-memory.dmp

Download

memory/3244-173-0x00000144C60D0000-0x00000144C6136000-memory.dmp

Download

memory/3244-172-0x00000144C60D0000-0x00000144C6136000-memory.dmp

Download

memory/3244-180-0x00007FF644890000-0x00007FF644BB0000-memory.dmp

Download

memory/3376-37-0x0000000000680000-0x0000000000796000-memory.dmp

Download

memory/3376-0-0x0000000000680000-0x0000000000796000-memory.dmp

Download

memory/3376-1-0x0000000002D80000-0x0000000002DE9000-memory.dmp

Download

memory/3376-6-0x0000000002D80000-0x0000000002DE9000-memory.dmp

Download

memory/3376-7-0x0000000002D80000-0x0000000002DE9000-memory.dmp

Download

memory/3432-247-0x00007FF6D8130000-0x00007FF6D8636000-memory.dmp

Download

memory/3432-202-0x0000020FC1290000-0x0000020FC12F6000-memory.dmp

Download

memory/3432-203-0x0000020FC1290000-0x0000020FC12F6000-memory.dmp

Download

memory/3432-201-0x00007FF6D8130000-0x00007FF6D8636000-memory.dmp

Download

memory/3448-212-0x00007FF60A3F0000-0x00007FF60A692000-memory.dmp

Download

memory/3448-158-0x000001B058890000-0x000001B0588F6000-memory.dmp

Download

memory/3448-157-0x000001B058890000-0x000001B0588F6000-memory.dmp

Download

memory/3448-155-0x00007FF60A3F0000-0x00007FF60A692000-memory.dmp

Download

memory/3612-63-0x00007FF758FC0000-0x00007FF759127000-memory.dmp

Download

memory/3612-64-0x0000018865E20000-0x0000018865E86000-memory.dmp

Download

memory/3612-65-0x0000018865E20000-0x0000018865E86000-memory.dmp

Download

memory/3612-70-0x0000018865E20000-0x0000018865E86000-memory.dmp

Download

memory/3612-72-0x00007FF758FC0000-0x00007FF759127000-memory.dmp

Download

memory/3996-77-0x0000014692A10000-0x0000014692A76000-memory.dmp

Download

memory/3996-133-0x00007FF7FE680000-0x00007FF7FE799000-memory.dmp

Download

memory/3996-76-0x00007FF7FE680000-0x00007FF7FE799000-memory.dmp

Download

memory/3996-78-0x0000014692A10000-0x0000014692A76000-memory.dmp

Download

memory/4520-165-0x00000123B1900000-0x00000123B1966000-memory.dmp

Download

memory/4520-220-0x00007FF7AE1F0000-0x00007FF7AE384000-memory.dmp

Download

memory/4520-164-0x00007FF7AE1F0000-0x00007FF7AE384000-memory.dmp

Download

memory/4520-166-0x00000123B1900000-0x00000123B1966000-memory.dmp

Download

memory/4524-190-0x00007FF6176C0000-0x00007FF617E03000-memory.dmp

Download

memory/4524-254-0x00007FF6176C0000-0x00007FF617E03000-memory.dmp

Download

memory/4524-117-0x00007FF6176C0000-0x00007FF617E03000-memory.dmp

Download

memory/4524-119-0x000001F75D810000-0x000001F75D876000-memory.dmp

Download

memory/4524-118-0x000001F75D810000-0x000001F75D876000-memory.dmp

Download

memory/4524-252-0x000001F75D810000-0x000001F75D876000-memory.dmp

Download

memory/4584-54-0x000001DFC9DD0000-0x000001DFC9ECB000-memory.dmp

Download

memory/4584-56-0x000001DFCB000000-0x000001DFCB066000-memory.dmp

Download

memory/4584-55-0x000001DFCB000000-0x000001DFCB066000-memory.dmp

Download

memory/5160-38-0x000001BF45380000-0x000001BF453E6000-memory.dmp

Download

memory/5160-39-0x000001BF45380000-0x000001BF453E6000-memory.dmp

Download

memory/5160-35-0x00007FF6D5600000-0x00007FF6D56C8000-memory.dmp

Download

memory/5160-36-0x000001BF45380000-0x000001BF453E6000-memory.dmp

Download

memory/5160-75-0x00007FF6D5600000-0x00007FF6D56C8000-memory.dmp

Download

memory/5592-237-0x00007FF7C3140000-0x00007FF7C33CA000-memory.dmp

Download

memory/5592-184-0x0000020A869C0000-0x0000020A86A26000-memory.dmp

Download

memory/5592-185-0x0000020A869C0000-0x0000020A86A26000-memory.dmp

Download

memory/5592-183-0x00007FF7C3140000-0x00007FF7C33CA000-memory.dmp

Download

memory/5720-223-0x00000215E58A0000-0x00000215E5906000-memory.dmp

Download

memory/5720-225-0x00000215E58A0000-0x00000215E5906000-memory.dmp

Download

memory/5720-224-0x00007FF788B90000-0x00007FF788ECE000-memory.dmp

Download

memory/5720-251-0x00007FF788B90000-0x00007FF788ECE000-memory.dmp

Download

memory/5840-125-0x00007FF785550000-0x00007FF7855FD000-memory.dmp

Download

memory/5840-126-0x0000022DB4D90000-0x0000022DB4DF6000-memory.dmp

Download

memory/5840-198-0x00007FF785550000-0x00007FF7855FD000-memory.dmp

Download

memory/5840-127-0x0000022DB4D90000-0x0000022DB4DF6000-memory.dmp

Download