860ce11b79c2838f014554e40fd52431b424ec0f1444554142faacdfdc5a11f1

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 745KB
Sample260809-l16a7adk6s
SHA256 860ce11b79c2838f014554e40fd52431b424ec0f1444554142faacdfdc5a11f1
MD5 8d712ed60779e0277e79f33dd0765248
SHA1 be351ed45df7c67a030065dec686d5557e3b263c
SHA512 3d4a5696ffa9dc414a13f9d4acdaa5404fadc70469627fbebad527fdd6070812d06964872cd9af771a76e547796cc3691eba8e0e6e0b1e0441abea7699dca9ca
SSDEEP 12288:B9sG6vBqTAjubviBNDYa3ASXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNu:BaGGMiBZjoERRFI8Vp/EMyINTL9
TLSH
T1F5F4121276E0C4B3D9B30A3085F45961AA7DFD341F618E9F6380576A9D307E28D3AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4612	alg.exe
4400	GameInputSvc.exe
3320	GameInputSvc.exe
4608	elevation_service.exe
5604	elevation_service.exe
4660	maintenanceservice.exe
3656	msdtc.exe
3196	OSE.EXE
3060	PerceptionSimulationService.exe
6020	perfhost.exe
708	ReFsDedupSvc.exe
3232	locator.exe
5180	SensorDataService.exe
3396	snmptrap.exe
2176	ssh-agent.exe
4916	TieringEngineService.exe
2872	AgentService.exe
988	vds.exe
1224	vssvc.exe
2840	wbengine.exe
3612	WmiApSrv.exe
3796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c7cd391b05c2f27.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c80b819e627dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5e6151ce627dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000095801de627dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003521ad1ee627dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3320	GameInputSvc.exe
3320	GameInputSvc.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	4400	GameInputSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4916	TieringEngineService.exe
Token: SeManageVolumePrivilege	4916	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2872	AgentService.exe
Token: SeBackupPrivilege	1224	vssvc.exe
Token: SeRestorePrivilege	1224	vssvc.exe
Token: SeAuditPrivilege	1224	vssvc.exe
Token: SeBackupPrivilege	2840	wbengine.exe
Token: SeRestorePrivilege	2840	wbengine.exe
Token: SeSecurityPrivilege	2840	wbengine.exe
Token: 33	3796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3796	SearchIndexer.exe
Token: SeDebugPrivilege	3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3528	2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3320	4400	GameInputSvc.exe	91
PID 3796 wrote to memory of 4848	3796	SearchIndexer.exe	113
PID 3796 wrote to memory of 1520	3796	SearchIndexer.exe	114
PID 3796 wrote to memory of 5984	3796	SearchIndexer.exe	115
PID 3796 wrote to memory of 4196	3796	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8d712ed60779e0277e79f33dd0765248_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4612

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:708

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5180

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2984 1640 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1692 1704 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff3eaa0370068bff0bb36d5a98edb507a13d9cb4a53aef539cbd2002707f6a21
MD5 ce29fcbe5a37ac4fad5b82e9d565cca0
SHA1 488cb7cece5741aa532917a09610fe95de7afce0
SHA512 1f50e52673d0a4fdb34e030763b125ad02e620d87a338ad9448e9fdc91f4bfb351e424ea90a1bae5c85e22890c165e83f1517fb696307297cc6c796669b57c80
SSDEEP 49152:Ab+632BuPkFKRrdE6oh7stBhuXjfS4LWxnkoEPFI8o5m9:q3q6gjBJK8y
TLSH
T1E4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 8277294494dd284e1d62c36e16d9abcf82ff97b9b52667e0227503acebd74ae3
MD5 0d61870e45695c3d9e98b51fd4cd6525
SHA1 fb79155e3bed104d0558e4f1d544539741c0f1e7
SHA512 b56462b5a112b032d0475777cf0068c42bcb6f4024d0d9f1ff5f188303f0b7331721d7af552238fbfaf8e09ef73159840a5664411d6ff3d547da668893fae486
SSDEEP 12288:f1XLsVyfJxnIHvoRczAflSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNI/:dXYMTtczAfKoERRFI8Vp/EMyINTL9
TLSH
T17E050129B7E009F9EC67827DC9F24402EA72B8554750EB8F03A0D9655F237D88E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 49cc5bd0a5b7951b3b07b7ab5a603697319728c23e78b9267e95a7ae146945f3
MD5 c80cb3d948605489444674119bb269c4
SHA1 2e49399a524fd9b6ff9b845fa991e921cc1730da
SHA512 ee531d2a1a7bf27e4f8331e98a60d0a9e0af490b9b339b3771c21f6887d12536ff6ad36955f25b66701a56edecd44038291ddf95c2fab03e5a4d9ca9693f5bd4
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CbHWSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4Wdkzaqf:Owu+OWAloERRFI8Vp/EMyINTL9
TLSH
T1AE05F14A77E40CF9E9B74639C5978436F7F2B8112A21DB1F0760C65B6F23361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a136da0bce2b1f277108bc354bce3f07242337a5651546fef137d23cfe319042
MD5 c035110e4849f588724d1beb4ceaf53c
SHA1 1e2a1f2b1115c26fbc5016526a2f8a5247b332fe
SHA512 25ae36bd665eea54d504812d3a5d3c7d04481363ab8bb3c1d06c083d6188d79880557f43d54290cfa1b2eafbdc3c7c7704566b8cb912ddea4342c02872e54084
SSDEEP 49152:UB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glJoEPFI8o5m9:Ou6JmTxd2dJK8y
TLSH
T1C9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE49B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 9edc6f19b6f7314e08312c6bff6a0ee4fbd242db4cb090770426d7080679a2f8
MD5 17b36bfca88a066c148e527be680dd4f
SHA1 66afa69a5d8bdf9ef117f5ec12fc5f9c33d5ee8e
SHA512 8f1ef11da17a2720f9ccca31de53d7d29cc1d3c034b92a0980c1c712c86286bd6c7149fe2d787c0d22f79a32f0165f29dc544d224347ac3d0048543421820b12
SSDEEP 12288:cV7VFSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:0VqoERRFI8Vp/EMyINTL9
TLSH
T144D4231ADBF4CD85ECBA0EB0C1FE0806A6A8F4795B01DEDF87009595AC26EE4CD73456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 53158f91d14a48c1e14ba78aad9f5cd44f4c1d47c5056facae6b6c888594d345
MD5 2a7142f55fd14157a2df74b1f86e43e6
SHA1 6a9c1918127580b7e6193f82016d224a1b155b8c
SHA512 a0c312772bc868b181646a874d86eb4ee7f265633f39d59139fc1f5b7adb14d304ea242b8dff22ebc50f762c3c7a892e4f181df7c5cf0195d5c379118b5606b6
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYpoERRFI8Vp/EMyINTL9:ygb4mBIBhGFcoEPFI8o5m9
TLSH
T11865AF1E22EC02F5E0F9D2B8CDAA4417D6B278160731D6DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 0aee5736aae0356f4a40e16ab3233597945fd1074c4072041d9d6d3b9e804040
MD5 62d37a6261a5c296251b269289d4a8c7
SHA1 cc5bea75f730c4233b46fd6341b1075471c4ca44
SHA512 f9b34c0ae736e2d04794f6f681b55bd76d31b31dc57811cfb5a1ac107f2c84da65e2ddab60406fde8f29aa2803764e3204ca110d2acb14e942b0599d81726342
SSDEEP 12288:JKGYiSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:sGYxoERRFI8Vp/EMyINTL9
TLSH
T143E4222EA6F5A9C4C87A8B75C1F91807B9F0B4B557005AEF4A80D4B9DF16EF0C93AC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 46964939aa50bc6c5afb8a2f6f10476db4e35b801bbfc23bbeb7b0a110fc7e31
MD5 3b4c918cd221a924174b9f8c7ba31580
SHA1 40c1e5651fee9b805067e4a88eed8a1ac91670ea
SHA512 644beac632b6330f30fce269e13eb3e78cf34242198118d60edfdb0d7477a8b626190cb30545e07938685cf59868b277fa6526f6c29df3d6b7c74b8d72650b9e
SSDEEP 12288:CHZSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:CHeoERRFI8Vp/EMyINTL9
TLSH
T1CFD4231AD6F4CD85DDBA0EB1C2FA1806A6E0E46A5B029FDF8700D495AD1BEF8C933451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9805de48ea33cb883fb21791989d9785d0933bd8bc06662114755915ab82e8b1
MD5 28feecd334429dca6148f436355cbbf6
SHA1 453680c1a57385f6c004b8b5c6b0b53ec12be3f0
SHA512 71388e678cb43a6ab692ff1afa2575bf60e13dbe2b1be73a6006ee5208f7ac27b14d6660850143b9edbd230a4c6682e3caba5e62f812e023fd4c1e6f55accdc4
SSDEEP 24576:2cF8u8FpJqH1xErba7/mqoERRFI8Vp/EMyINTL9:j6ZFPqVqa7/7oEPFI8o5m9
TLSH
T10235F166A7E101F0D47BD138CA960663F6B1B4250360EFDF07A88A551F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 4ef8fde370f37fc87809732d320e8b2b747a5430c6e235355e25203c6058ea89
MD5 36d3fa2a248ae84fe562c0736e8b445e
SHA1 0752238d130c9271aa9ef6c4baf4dd3a27700060
SHA512 edde138219125e330da2aae2c5484abc356278cc59469b1904eb13a3734c4be9d4e64505577890864bc8953650664cfcaf6c2fa7a6a4f5564258d2d27ed968c2
SSDEEP 12288:kHvUrBFrEjwaQBxSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:kPUr+NQBmoERRFI8Vp/EMyINTL9
TLSH
T12905F12F66F81CE5E67AA17DC5964609F771B4620702D6CF02D0817E5E27EE8AC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 33d27322a5027f6dbf81f8064f527ad6ca23d662196ac2d9588dca64343c91c1
MD5 c8cfabc77243dbbe14fd9c4437a7f00c
SHA1 93fc11c45aeeac6fe05d91fd3084913c4653ba6c
SHA512 1820b201a469b99ea8238286091eccd4847b62a08a13d1db62ed8a49a59c90b20d43336fe1606f40687c791ca4508498e166899ae0e4c9167713d4a88578085c
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRoEPFI8o5m9:zG05lO43bOK8y
TLSH
T128D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 78aeab51ac7a67631ac33b3b01c46e89278f2e9995bd5baccde537dbfe702544
MD5 09c8b964148eaf77d093c5f71dc6f20d
SHA1 a409cf9b52e755fc0a4517f499575e2fa1fdc803
SHA512 f74c5311734dd5e23c1a0b09d2fbb3d2656cf862b848e01c05028052994e9286cdc51f9157c4954a17c2e5483baf135440d0c74eb94b96315216eb7ff26885d5
SSDEEP 24576:Jra5POZ3dpbWVM50JicR2hG0lasx2+47eidn4oERRFI8Vp/EMyINTL9:ta5POZ3wJt2pasx2+meoEPFI8o5m9
TLSH
T13365AF5EA6F801D5D5B9D17DC583460AF5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 59ea26ee1e6e5b71ba235cc7e89e720fb4752180cdd3b46573e4574608163ab1
MD5 c15cbc63d6855150e4aee0e49b2eefda
SHA1 3864665d490388f6cdcaf0669cfa34be4aea3b4b
SHA512 b8dba090d0284c59e4402f0585d7c34fcad1714c775f5362947e7bc5e695abf7502f3ecc4cf3c54539cd2fc43adb8d1dcbf4c44729c9f83fc55c8ba6a42b7c28
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkPFoERRFI8Vp/EMyINTL9:uNc/zEOVHFwoEPFI8o5m9
TLSH
T1F2858C1623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 7eb222b673bf726413bab40349a4a5da888ac381a52801384c79c95a5b2611a3
MD5 0d6520198f4085f31929358ed795371e
SHA1 bf4dc603cbbb0101e4e3bb9d47ab3a1fee6b005d
SHA512 eccee9c8e95baaea02e76e4964d5ebb5a0e528420c17c3f54bd267514c69abe7c1bc65b47c30c7626fbe9132d8240a406ad29e55ea7de8ecd5d1447556764d53
SSDEEP 12288:yTHPJnJP6szeCs6Rl28dXSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNI/:UJnJPbzB4SwoERRFI8Vp/EMyINTL9
TLSH
T1E415D03DD2A810E8D4B7C2B4815A1A5AFF71387D2F1269CB19B4D4353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 06a6d116344ccc3e421cce4add45f6614f5a02463dc7ec44583b7bbd960cd663
MD5 91b88eefd96916975ec0bee86b3ce256
SHA1 4ccf6ffafe858f4514bb20d36098bec5003bc6b0
SHA512 3d669e197ad661224b253bfea28f784e108791c0d92b1ac82466ed452c9ac8f6dfc7abb462fff2118a31f6651a697f8d2fa777dc99fead51d042fbca458e5c7a
SSDEEP 24576:aCLHGL0MoeVtFumTijCmlKQWDkKoERRFI8Vp/EMyINTL9:aCLHGeeV5ijCmlDWDkKoEPFI8o5m9
TLSH
T112A56B05E7EB4184E8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 786fd085bdddf741ab0477e260d6f85e7897c059e6ab5bf42387d7919dd43a15
MD5 9d473831b1e8c473120b1a04b93b5780
SHA1 27da436bcd728766c0328462ccc6d3520335acb6
SHA512 cf2e84800251a80f653169578c329a659dd6613d590ee2a6580454fcc9094784844efe41df70d4d8075a053d73b9eee1ded4ad2e3175e3b04e63fcf4370b44de
SSDEEP 12288:vwHck6j5ZI7RLSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:S6DI9koERRFI8Vp/EMyINTL9
TLSH
T1C6F4F15D63BA10F5D0BBD03EC2D30502E2B2B0B587125ADF4B94C5BA9E63ED8B939D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 734da8a31b123c2730f70e5b3595d1bc8fd083ef90096bff170d183cedfc79ef
MD5 2854e2846de03e5da184c34e1d847176
SHA1 58b60e1a9e289ff153ebaf4bc195670eafe17ccb
SHA512 82dd5fd1cbe0166805efab5e96bebccb6e6e1829c76d9af51c0c33ee3db9577bac619b75d20ff96b566296075361433cdfcd39a0fe1456a8b7c6a8d627f7c2ae
SSDEEP 12288:dG6kyGQSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:ktyGDoERRFI8Vp/EMyINTL9
TLSH
T152F4120993F494C4E9BA0A74C6F605559AB4FC349B019BDF4680E63E6E37BE4CC32B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 25ead874c01fb5b6cc80985924fe2da70eda1247ad4a21a324f6520be0d9f475
MD5 9afbc6406670eb00f355a723f0a519be
SHA1 104c011c83ec4d7aef150b76e205c4626b19448e
SHA512 ff529f20c3ea527b8bf9568aae030754092ac0f80e0ecb6c7569eb2708a9425e3ba10680ba15a5a6b7e2ebfdda5c1018aad2d207d6818d9ca8ce5a4d6529cb3f
SSDEEP 12288:bGPSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:6YoERRFI8Vp/EMyINTL9
TLSH
T1AFD4231E96F59985DC7A4EB1C2FA1806A2F0F0795B025EEF8B80D8B5DD17EE4C933841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 649ec79f926e4c961d72aca3c93a75c30671ca7f53fcf56955d5e765694536a2
MD5 88f9d1e6e98ce48c8d920913bbf0f367
SHA1 ed2188261f3daecc31625318e727a01973d320c7
SHA512 2c65eba74b4dc3eaf63d31d8b3f962eb3eafa17ccca7b82f617a1f257735353c813a3ec9e07bc295a8afa9f49d126e0a532c4f1af7b858be86596438ac9bf0d2
SSDEEP 12288:2mgz7ZyFDK3tT5Tr7aVLIH9lH3ccSXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4Wdk5:2mgzwoTfaidZUoERRFI8Vp/EMyINTL9
TLSH
T162558C1DA7EA05CAE2B2D675D8721493D633B4315772C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 b8a5a8e785c264873da086e8127e07b1da8d74a5901875c963c6c36855e53ae9
MD5 d671620c04633bb78236976897a3bf85
SHA1 c152c6250b9f9ac401573f64e53a1ebc7aeb3945
SHA512 fac34e80c2360d9ec176c927cebb182b536eabeeec92c2c26f988cc7abbd09e49bd4c30bef6866e9a06c7241cbbb411a42c6bfc19f45673cef09963f025784e2
SSDEEP 12288:YpJcm8CNySXPM40xHERRMXUbm3KfL1eVW7p/rQ0T4WdkzaqDeNIzkSw9g:YrcmRhoERRFI8Vp/EMyINTL9
TLSH
T11A05F15EB2BA00E5E1BB827CC9960506F6B3B030570267DF4290C77E4E17AE9BD35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 507a6bb5213e7987a95572b4305d6a81169baa7a133f140a709c2f924901efd6
MD5 2ca21c7029b76a271d9eeef269240b43
SHA1 f2b127083d59da778c623565d39b7762fe68f4c3
SHA512 6d3db99c8ce693d59ffc5f2ba2c4d2bd6cbc1e9996242546c13dd07654cbecbefbccc90f422c905ff3fe138ad097d14f009049507cad74a336a6f83dbb868b7f
SSDEEP 49152:lDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ToEPFI8o5m9:m3Upow8sBoK8y
TLSH
T1BDA58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-170-0x00007FF79FA50000-0x00007FF7A0193000-memory.dmp

Download

memory/708-117-0x000001FE5F560000-0x000001FE5F5C6000-memory.dmp

Download

memory/708-118-0x000001FE5F560000-0x000001FE5F5C6000-memory.dmp

Download

memory/708-251-0x000001FE5F560000-0x000001FE5F5C6000-memory.dmp

Download

memory/708-124-0x00007FF79FA50000-0x00007FF7A0193000-memory.dmp

Download

memory/708-253-0x00007FF79FA50000-0x00007FF7A0193000-memory.dmp

Download

memory/988-187-0x0000028ED47A0000-0x0000028ED4806000-memory.dmp

Download

memory/988-185-0x00007FF615BF0000-0x00007FF615E7A000-memory.dmp

Download

memory/988-186-0x0000028ED47A0000-0x0000028ED4806000-memory.dmp

Download

memory/988-217-0x00007FF615BF0000-0x00007FF615E7A000-memory.dmp

Download

memory/1224-194-0x0000021343AF0000-0x0000021343B56000-memory.dmp

Download

memory/1224-195-0x0000021343AF0000-0x0000021343B56000-memory.dmp

Download

memory/1224-199-0x00007FF67CE60000-0x00007FF67D330000-memory.dmp

Download

memory/1224-225-0x00007FF67CE60000-0x00007FF67D330000-memory.dmp

Download

memory/2176-156-0x000001CEC4EF0000-0x000001CEC4F56000-memory.dmp

Download

memory/2176-157-0x000001CEC4EF0000-0x000001CEC4F56000-memory.dmp

Download

memory/2176-161-0x00007FF794E90000-0x00007FF795132000-memory.dmp

Download

memory/2176-203-0x00007FF794E90000-0x00007FF795132000-memory.dmp

Download

memory/2840-205-0x000001840CF60000-0x000001840CFC6000-memory.dmp

Download

memory/2840-206-0x00007FF697300000-0x00007FF697806000-memory.dmp

Download

memory/2840-204-0x000001840CF60000-0x000001840CFC6000-memory.dmp

Download

memory/2840-241-0x00007FF697300000-0x00007FF697806000-memory.dmp

Download

memory/2872-181-0x00007FF7BEC30000-0x00007FF7BEF50000-memory.dmp

Download

memory/2872-173-0x00007FF7BEC30000-0x00007FF7BEF50000-memory.dmp

Download

memory/2872-175-0x0000020994EB0000-0x0000020994F16000-memory.dmp

Download

memory/2872-174-0x0000020994EB0000-0x0000020994F16000-memory.dmp

Download

memory/2872-179-0x0000020994EB0000-0x0000020994F16000-memory.dmp

Download

memory/3060-96-0x00007FF7B4A80000-0x00007FF7B4BC9000-memory.dmp

Download

memory/3060-99-0x000001A6C9B60000-0x000001A6C9BC6000-memory.dmp

Download

memory/3060-98-0x000001A6C9B60000-0x000001A6C9BC6000-memory.dmp

Download

memory/3060-145-0x00007FF7B4A80000-0x00007FF7B4BC9000-memory.dmp

Download

memory/3196-87-0x0000026AC9560000-0x0000026AC9683000-memory.dmp

Download

memory/3196-90-0x0000026AC97B0000-0x0000026AC9816000-memory.dmp

Download

memory/3196-88-0x0000026AC97B0000-0x0000026AC9816000-memory.dmp

Download

memory/3232-127-0x0000020A6F050000-0x0000020A6F0B6000-memory.dmp

Download

memory/3232-126-0x0000020A6F050000-0x0000020A6F0B6000-memory.dmp

Download

memory/3232-125-0x00007FF62DDE0000-0x00007FF62DE8D000-memory.dmp

Download

memory/3232-182-0x00007FF62DDE0000-0x00007FF62DE8D000-memory.dmp

Download

memory/3320-89-0x00007FF66EC10000-0x00007FF66ECD8000-memory.dmp

Download

memory/3320-39-0x0000014A74140000-0x0000014A741A6000-memory.dmp

Download

memory/3320-35-0x00007FF66EC10000-0x00007FF66ECD8000-memory.dmp

Download

memory/3320-36-0x0000014A74140000-0x0000014A741A6000-memory.dmp

Download

memory/3396-146-0x00007FF769D70000-0x00007FF769E23000-memory.dmp

Download

memory/3396-147-0x000002682DB60000-0x000002682DBC6000-memory.dmp

Download

memory/3396-148-0x000002682DB60000-0x000002682DBC6000-memory.dmp

Download

memory/3396-200-0x00007FF769D70000-0x00007FF769E23000-memory.dmp

Download

memory/3528-38-0x0000000000960000-0x0000000000A76000-memory.dmp

Download

memory/3528-0-0x0000000000960000-0x0000000000A76000-memory.dmp

Download

memory/3528-1-0x0000000002A60000-0x0000000002AC9000-memory.dmp

Download

memory/3528-7-0x0000000002A60000-0x0000000002AC9000-memory.dmp

Download

memory/3528-6-0x0000000002A60000-0x0000000002AC9000-memory.dmp

Download

memory/3612-219-0x0000017A07310000-0x0000017A07376000-memory.dmp

Download

memory/3612-247-0x00007FF712500000-0x00007FF71262E000-memory.dmp

Download

memory/3612-218-0x00007FF712500000-0x00007FF71262E000-memory.dmp

Download

memory/3612-220-0x0000017A07310000-0x0000017A07376000-memory.dmp

Download

memory/3656-77-0x000002679C420000-0x000002679C486000-memory.dmp

Download

memory/3656-75-0x00007FF6CB050000-0x00007FF6CB169000-memory.dmp

Download

memory/3656-134-0x00007FF6CB050000-0x00007FF6CB169000-memory.dmp

Download

memory/3656-76-0x000002679C420000-0x000002679C486000-memory.dmp

Download

memory/3796-250-0x00007FF6CA500000-0x00007FF6CA83E000-memory.dmp

Download

memory/3796-228-0x00007FF6CA500000-0x00007FF6CA83E000-memory.dmp

Download

memory/3796-229-0x000001F9CE990000-0x000001F9CE9F6000-memory.dmp

Download

memory/3796-230-0x000001F9CE990000-0x000001F9CE9F6000-memory.dmp

Download

memory/4400-29-0x0000023B57B80000-0x0000023B57BE6000-memory.dmp

Download

memory/4400-62-0x00007FF66EC10000-0x00007FF66ECD8000-memory.dmp

Download

memory/4400-28-0x0000023B57B80000-0x0000023B57BE6000-memory.dmp

Download

memory/4400-27-0x0000023B57B80000-0x0000023B57BE6000-memory.dmp

Download

memory/4400-26-0x00007FF66EC10000-0x00007FF66ECD8000-memory.dmp

Download

memory/4608-45-0x0000014844540000-0x0000014844663000-memory.dmp

Download

memory/4608-47-0x0000014844480000-0x00000148444E6000-memory.dmp

Download

memory/4608-46-0x0000014844480000-0x00000148444E6000-memory.dmp

Download

memory/4612-51-0x00007FF6F4700000-0x00007FF6F4822000-memory.dmp

Download

memory/4612-16-0x000002A33EE90000-0x000002A33EEF6000-memory.dmp

Download

memory/4612-15-0x00007FF6F4700000-0x00007FF6F4822000-memory.dmp

Download

memory/4612-17-0x000002A33EE90000-0x000002A33EEF6000-memory.dmp

Download

memory/4612-18-0x000002A33EE90000-0x000002A33EEF6000-memory.dmp

Download

memory/4660-72-0x00007FF68A610000-0x00007FF68A777000-memory.dmp

Download

memory/4660-63-0x00007FF68A610000-0x00007FF68A777000-memory.dmp

Download

memory/4660-65-0x000002004B830000-0x000002004B896000-memory.dmp

Download

memory/4660-70-0x000002004B830000-0x000002004B896000-memory.dmp

Download

memory/4660-64-0x000002004B830000-0x000002004B896000-memory.dmp

Download

memory/4916-164-0x00007FF736380000-0x00007FF736514000-memory.dmp

Download

memory/4916-166-0x0000020131740000-0x00000201317A6000-memory.dmp

Download

memory/4916-213-0x00007FF736380000-0x00007FF736514000-memory.dmp

Download

memory/4916-165-0x0000020131740000-0x00000201317A6000-memory.dmp

Download

memory/5180-193-0x00007FF746F00000-0x00007FF747316000-memory.dmp

Download

memory/5180-210-0x000001A7E2930000-0x000001A7E2996000-memory.dmp

Download

memory/5180-212-0x00007FF746F00000-0x00007FF747316000-memory.dmp

Download

memory/5180-137-0x000001A7E2930000-0x000001A7E2996000-memory.dmp

Download

memory/5180-136-0x000001A7E2930000-0x000001A7E2996000-memory.dmp

Download

memory/5180-135-0x00007FF746F00000-0x00007FF747316000-memory.dmp

Download

memory/5604-56-0x0000024731810000-0x0000024731876000-memory.dmp

Download

memory/5604-55-0x0000024731810000-0x0000024731876000-memory.dmp

Download

memory/5604-54-0x00000247315C0000-0x00000247316E3000-memory.dmp

Download

memory/6020-155-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/6020-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/6020-106-0x0000000000730000-0x0000000000799000-memory.dmp

Download

memory/6020-111-0x0000000000730000-0x0000000000799000-memory.dmp

Download