1788757f553552dda059dcb9c8a49d2ab73304a401839dcc9f836173e5d8f884

Analysis

max time kernel
146s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 749KB
Sample260809-max3kawbje
SHA256 1788757f553552dda059dcb9c8a49d2ab73304a401839dcc9f836173e5d8f884
MD5 3ce9d4e8811e963a9975c2972cbd87f7
SHA1 635aa039dcd654e45220c6421b22673bd4ceff61
SHA512 342ee3242bd183e2be669e3aa02e6a731cadc3c2efa7c5041f83fc7b2aaff3db949cd7106d27866bcffe58018e96f98e1c0cdc4cc57a0ed09dd16570ecc2cc72
SSDEEP 12288:m93G6vHzOASubviBNDYa37AcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQc:mVGGTWBZmyoBSx4Q0AREO0SW0AXgO
TLSH
T1FBF40221B2C0C872D673193409B4DAA0A97EFD301FA54EAF23545B6F5DB07E24A39727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
5984	alg.exe
5516	GameInputSvc.exe
2188	GameInputSvc.exe
5552	elevation_service.exe
3360	maintenanceservice.exe
1200	msdtc.exe
1324	OSE.EXE
5100	PerceptionSimulationService.exe
2116	perfhost.exe
3380	ReFsDedupSvc.exe
1132	locator.exe
708	SensorDataService.exe
796	snmptrap.exe
1524	ssh-agent.exe
712	TieringEngineService.exe
4536	AgentService.exe
4708	vds.exe
484	vssvc.exe
3056	wbengine.exe
936	WmiApSrv.exe
4984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\30315b2e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009774073be827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b2c473be827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c3ddd78e827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2188	GameInputSvc.exe
2188	GameInputSvc.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	5516	GameInputSvc.exe
Token: SeBackupPrivilege	3380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	712	TieringEngineService.exe
Token: SeManageVolumePrivilege	712	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4536	AgentService.exe
Token: SeBackupPrivilege	484	vssvc.exe
Token: SeRestorePrivilege	484	vssvc.exe
Token: SeAuditPrivilege	484	vssvc.exe
Token: SeBackupPrivilege	3056	wbengine.exe
Token: SeRestorePrivilege	3056	wbengine.exe
Token: SeSecurityPrivilege	3056	wbengine.exe
Token: 33	4984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4984	SearchIndexer.exe
Token: SeDebugPrivilege	1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1256	2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 2188	5516	GameInputSvc.exe	91
PID 4984 wrote to memory of 5856	4984	SearchIndexer.exe	111
PID 4984 wrote to memory of 2168	4984	SearchIndexer.exe	113
PID 4984 wrote to memory of 3980	4984	SearchIndexer.exe	114
PID 4984 wrote to memory of 5920	4984	SearchIndexer.exe	115
PID 4984 wrote to memory of 1352	4984	SearchIndexer.exe	116
PID 4984 wrote to memory of 5096	4984	SearchIndexer.exe	117
PID 4984 wrote to memory of 2452	4984	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5984

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:708

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:936

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2924 2904 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2964 2956 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2964 2956 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2924 2904 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 426e4e9610a7868d000eb9af834027f297a39e4b1127523c6aaa70cbdda4851b
MD5 78e5e76de863a9fc24cdb25eba704714
SHA1 6c0882d05bfefee6ee6fc8752df12e30ba8fbaea
SHA512 dcfa3c1164efcba516d48e691dabe0fba5884795e60fd6a8ff2e0da946f5c2dace166e76a8aafc371882cbed82f5b065a1d4ed2e01c9284da960829dd1a12f1c
SSDEEP 49152:jb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnPoBjvAR0:B3q6gjBPto
TLSH
T1DFD59D03F29900E8E06AD578D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 faf5a87862837bdad905614c95f463c22c4d3bb9424b14e8ddd79c968fc129a2
MD5 e88d451f85019497395a439638685890
SHA1 2bbd0a1d616e83eb82ee49cf92b4613ed7f80b36
SHA512 59a70a083cf4b7bd2b2f103ad35cfb57f694512b7ec7a7239fc518d2a95361b49d3370755bbd4e453efa06a1633dec12397b42600c44de6f7972f05785e5b068
SSDEEP 12288:Z1XLsi8PZxYflRq2czAFcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:3XY5D0czAHyoBSx4Q0AREO0SW0AXgO
TLSH
T1C7050129B3D44DF8EE6B813CC8A18505E673785143A4EB9F03A4DA6A1F633D81E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 2901588d3828316230b3c56ef2b5d86df30294161e879cf3e9a81376b427129a
MD5 bd7c5777add2f496e29db6a1400702a1
SHA1 95959a0bcd7b034700c918dbdac49dbc25d03410
SHA512 25ae81ef901b4423155da5de31eeb5b8647e7bc49144029be94a313c4970346a8a95903630b13f91690df1d438871de738aa25caef34f64dbeffd70265ade61b
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+C0cykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQc:uwuuOWZyoBSx4Q0AREO0SW0AXgO
TLSH
T11E05F14AB2A44CF8EAA785388597D536F7F2BC012665CB1F0760C75B2F633616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7e7d7cd8253fd23072bed70eaf1a9d0a251321e7035ec02044c86b988080f21a
MD5 9fb506ef1ad845bb4d7f793e2883cf26
SHA1 6a7a2c492fe93f32574850f935f7184ecec521e3
SHA512 3cedb31754305ecc8912d82be5de28f6f6be30ad2fd0ff5622f6f9b5dbac4be7764e72ee46b71b7d03b52f742acd053808c4d839a1a8580d75bb02a3741a18fa
SSDEEP 24576:pVW1UPw50TRIgiyeSahLzgY1hJgPncLeRbMb8g:i1Uo50TRUyeSahLzVgPnQwbMIg
TLSH
T155451741762AC68BC6A940321E37D6CCAB707D01FE45AF1773C9473F8476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 983aff0760d55b5e135fbb54d6f9d2775f1f9f09314ab7e57ecfe56d6455472f
MD5 7d275d944486b8c693dddc21281eaf85
SHA1 506f4f18d8c0ba313d383b5dd171d404d79d0e05
SHA512 a617ae83e29f33fe8cce2ee60f4edee7c39b97ea38db7944888a04154e19f3b71517dc138074ae88ed5cd928a711998a475b8c49a10e503a92ddcd18ebf62df0
SSDEEP 12288:rghAPG06/4muJ7m7UQLxL6WDtS8QcwjJKYoNUVPPN0DHdiIdZ:rgGPUgfhG39AISKFNUVPV8HdiIdZ
TLSH
T127551A41A5A7E35FC9FE50330632868DABB49C07F7463B0573444A3C9877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c472dd05d2d837e87344f15d00fe889f85cde3bd55dba6205b0df7c317210fa5
MD5 f2efef8605dd9eb1b6f45e4d0719e0fb
SHA1 b6de5d1af175de2195c3a66d380ee73322be4c99
SHA512 ab98fc34eefc432e8c1b22e17b8bc4c6ed53dd32f587e3e961a0a11af8faacdbe6bd498b873a7b78231cba25099fbb2f40e8e638cde84ef68f65826c123ce873
SSDEEP 12288:s/7gcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:aKyoBSx4Q0AREO0SW0AXgO
TLSH
T1A0D4236BE358CE08E77B5D3C1458A548F5FE7C2417898EEF0524EB6B25C0BA90B2530E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1d1c922e3564bc18142a5929d4cb38ae7906132e728cffb551eaedf662008397
MD5 ab3f3a5fb94954bdef432ebc86c696aa
SHA1 20dba240e4ba5cbb68ed131b402f824af655950a
SHA512 ff0f6d42e985dbd83c7f579b5c14bf69148d179dc391744a75712301dc37a67ad0fbe7e1fa659e8bb062f5f17948b9a53be2da6dfd3fcac16fe28456c8c3454f
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYHyoBSx4Q0AREO0SW0AXgO:Jgb4mBIBhGF7oBjvAR0
TLSH
T16F65AE1E22EC02F5E1FAD2B89DAA4417D6B278160732D6DF0151423D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 a14f108a4b0569a66e76f0fce1fef56130167e2d8f307e617b0ddabebe9f9d9a
MD5 daf7bcb099522708fca08853e42dfd71
SHA1 9547427b7450820818412213a7dc90ec1c9c92e5
SHA512 d8b2ffe3f89abd321347e088c0b1830e470ebd19a913bafbb4050a5dcdca9a31f86445eaf0ad69c16f138681057a60be6405b85432355efd475e540b5094eea6
SSDEEP 12288:6pG0cykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:qG+yoBSx4Q0AREO0SW0AXgO
TLSH
T11EE4233EF2A5AE48C77B8A3C0460A585F5F5386013595FFF05A4EA7B5B807F42339A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 7ff8a1f98752f321d0006b174ffc0a9ef3e3a4ea4f4d489226a511a4741946f2
MD5 473963d882b63dea5cb107c14460cb28
SHA1 4b1f23b31a7e30a0782e3005dad32c57b0277c01
SHA512 3b9faea76de62420b6227ad9683b9ff1b2c88226294bd709e00b0817ec5ab70cbe901c0400c39ddab18aa2b91867dfaf4fd9ddecf1c5ad4926939c3121d0db3c
SSDEEP 12288:QOcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:Q4yoBSx4Q0AREO0SW0AXgO
TLSH
T1E7D4236AE218DE48E76B5D3C0851A688E5FA7C1513CE4FEF0528EB6B25C07F91739309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4bd22c4c6c00cfc49aca7d6b06f0a09a4486a19420f95a9fb024e852c8bf78c4
MD5 6f6f0154af2b3ff92ebe83c00d53234a
SHA1 762aa41b177fe154f5d68f3f9207e6901acaf11a
SHA512 69f13ecdf33b7cae3180b35d56a7e05e67c052585f01448b3fc3d1bb45636dc981c3840f2e528a2c26fb999b61d56c243fa9d2a4306fa2989e5a2544bce6c826
SSDEEP 24576:UTY8u8FpJqH1Fdrja7/mwyoBSx4Q0AREO0SW0AXgO:qnZFPqVra7/2oBjvAR0
TLSH
T19535F165B7E106F0D47BD13889824657F6B2B8250364EFDF06A88B561F13BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c2cac84424e13d38464c7f9b41e5fa74dd046763118eafc273115a992c0b960e
MD5 6c2eb97ba3bf82fedbc1e4ee8d446b3a
SHA1 c44ade14ff6a2d82197136b23bdc8e146cfef8cd
SHA512 0356b67dde342004b00f6a3f747b5dc1acf8ad68785701520e0c140c1e03b84d429dbbcd7df85d93eec9c1c2f5df199aa5df619d182e7b768ac0a77cee22c43c
SSDEEP 12288:FHvUrBFrEjwaQqcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:FPUr+NQUyoBSx4Q0AREO0SW0AXgO
TLSH
T1A105E12F62AC1CE4E77AA17D89828709F7727862135296DF02A0817F1E53EE87D3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 7eb61527c8084f3c7dc5f9036220374702572469aa24011cfa1c773eced2d8cc
MD5 7584a15eb657f9ec5b69d40c801bb376
SHA1 3398099eee7bc911112da77c8c9c573537477fc1
SHA512 c61a2d5da2cfb3a42275be12a7cd636d72dc5fe9c5abdc6de87fe8e222f7f5542caed0ebbe5b9ac00f31ec807e0834462d748b9b38d1a55c23596e20b6b20927
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7oBjvAR0:oG05lO43bNto
TLSH
T1E6D5CF6E62EC11F8D1BBD17CD9C64A0BEBB23815032556CF02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 488b6122682ca5d9ada3f01effc1b25a61a5060d8374cc2c4630072c4fbd46f1
MD5 1fe48fffb1852e2fff6167e50d6a413a
SHA1 b2bd546627095d31874c92097253b35447e7ad0f
SHA512 3350f7bbfd9476c89ba28608d4c3ff6f6bc87872bbcf18c9108b5718ef925fcd56a11b2b3af6ad380fda681833de1efb595715c8efd34938c5153a4e408e831d
SSDEEP 24576:HFa5POZ3dpbWVM50JicR2hG0lasx2+47eidnrPyoBSx4Q0AREO0SW0AXgO:la5POZ3wJt2pasx2+mUoBjvAR0
TLSH
T1A565AF5EA6FC01D4D6B9D17DC583861AE5B1342553329BCF022182BE3F27EE89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2fc62818c016164bbd95d9cc83db704801a2ac305bb83d530bd0a60654e450ec
MD5 bc34d4feab1f28d82db81ebd1316b12a
SHA1 d967ec53e8cc9bfce16f67c7a3bb671478d565b7
SHA512 886cb6aa2d0265d6bd9cbb500c83f2faf96fbee35dbb564f08fa7383d15fb22c9a57aad40821e47dfac2c9554a7c24b44ac9c8e4b29be50d65254c7be6e4e8ff
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FklyoBSx4Q0AREO0SW0AXgO:INc/zEOVHFZoBjvAR0
TLSH
T13A858C1623E901E4F1BBE1BE89679546FAB1786513348ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 4be919e0defe2301d3464fb7a4a57b43daf122a620bcc550f1b9b0ffe809ef55
MD5 c3d6572b7f01d955fc403d00eaf198ee
SHA1 bd991071173d4dc19fac3c9ce17795d3922ff41a
SHA512 4c2c8a7388938f3750802116595f8d8fc63bc6d2342053a6721988c11438b739a34ef5afb463895e1f3ba5301e061967db629e65dc4d5cc811ef75257a6ffdea
SSDEEP 12288:PVHPJnJP6szeCs6Rl28dfcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:ZJnJPbzB4SByoBSx4Q0AREO0SW0AXgO
TLSH
T10B15E03DD2A814E8E4B7C278411A1759FF71386C2B2669CB19B4D5353F42FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1841755c37f0e3c140b314a98759d5825e56c11760b7733bfd68337091e05bf8
MD5 64b21e1c2acd77dfc896fce5646afc0f
SHA1 c93fb01f098b05d0e10fc6d789216c7507d330af
SHA512 0e66665cd013e170fccdf10b00367c39ddb3a648feec84238c4c3e0bb94d81f3a546f3c83c02a2d7f69aafb716c30a8976ae2b28030b42874b5d89bded02060a
SSDEEP 24576:LCLHGL0MoeVtFumTijCmlKQWDkUtyoBSx4Q0AREO0SW0AXgO:LCLHGeeV5ijCmlDWDkUooBjvAR0
TLSH
T186A56B05E7EB4184E9F3CAF4C92694169A327C549B34F7EF4A80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 8f267fb128eaee32997e07b2db50c0da050e6349c427f056dfef43fb6350e539
MD5 9d565b80660fc64b450191bcc8711e05
SHA1 cd85a364d541d3b822ba9a817f81c997c72533f8
SHA512 7460d8306ed5a1a23144b67c44f07e1c515c36c287624d93179ff358a80a7908968b2a908fd87af08d506fcb041e3161312657d46bd6f7056ad265d5e39528ed
SSDEEP 12288:d1Hck6j5ZI7zcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:96DIJyoBSx4Q0AREO0SW0AXgO
TLSH
T1C005016D637A15B8D27BD03D85820541E2F2B47083565ADF0AA4C6BE5ED3FEC7A3CA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 d7afc9e17f30151015acea996f73a38b084e2953cb0dd28417f3876093c9c4a7
MD5 63632f4a6c30d0016068aa03693a709e
SHA1 008d15efd571f9d73960b45442f10545d31521e5
SHA512 de60c7418fe2ec1801c7100c0b8e5582e79b2008549beb2526b0b915af2384ae9e4469db2b9c9638f9380d911cfb4b02b0883092e43ca7b1e06fb5d907454e59
SSDEEP 12288:0G6kyicykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:ltyMyoBSx4Q0AREO0SW0AXgO
TLSH
T16BF42319E3989D84E7BA0A3C496282C4DEB5BC2057554BEF05A0FB3F2F707E46A35706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 b0c57c919119ea34ebd7876dcc9210661c58a2df621d5f3d461b36f591e0d193
MD5 24de087c5504f6206df0df8fc63682c2
SHA1 3b0859cf73635230f870b1f9a03fcfdbcbc5554c
SHA512 5b13ba7a7eb29e1fb7d4533cf508d537bb79a0f981eaab07ebe3c869516cfd2cdf781f12b19560e0f3c541dcf9498a43fb4610aa4383c469e6a5104a39870561
SSDEEP 12288:ny1cykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:yXyoBSx4Q0AREO0SW0AXgO
TLSH
T1DED4236EE218EE48E76A5D3C0454A688E1FA7824178E4FFF05A4EB7B26C07E51735309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 14557c8094b6f9fc59686057ab93c43c46837efe467cda260c57fda106d98760
MD5 cf53d3db2f9d5449227fcb2ac679950a
SHA1 652352ed68ba4350bc9a28d26db4d8d3b5f9641c
SHA512 b56f3ead4c12ff446846aadc40a166eb44ef88a76416717605beec842555f39a3d09cbfdf1e9e9d66f25a4481e48dd251710f063439a39405f3386e9f5275f94
SSDEEP 24576:PIg0LoTfaidZvyoBSx4Q0AREO0SW0AXgO:ggTTrZKoBjvAR0
TLSH
T113559D1DB3EA09CAE2B2D679D8725493D633B4311772C6DF2448C03A4D9AED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 bda7fff0c49e5393c369f387f11a31cafc544c342500ced52a124c60f83fc460
MD5 17878004d746cc9d2e8c9ab6d184eccb
SHA1 63f8ced1d8395edfb16527396efbd9e1207093aa
SHA512 9aa012c5f70c610fc7df8fd947c2b7f7b46b0cc4803b7e38c5a265187129c724d1ffc1caff7e0cca76246a6c130af577c3dd19b3a2a53e1889976270a0bf310f
SSDEEP 12288:OpJcm8CN9NqcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQEQO:OrcmRvUyoBSx4Q0AREO0SW0AXgO
TLSH
T18905F15FB36E44A5E2BB813C88814645F6B3743023525BDF02A0C77E5E93AE97E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8b2713889e86b60f6ca4369e36ca4d55a814c37c696182df0d615688a1482d40
MD5 1207524a2491cee1bf72562e9b16af63
SHA1 4e783a4af893cc8a17d55ee4324a7c4fde39d9fd
SHA512 1fc89c9b359040922fb1cd81f701de5eb5b7f6cc1d203ca995408d46e3c8e7a436b4d84f23c9f78c6357d0c02562bc03b067be9cbc0b47c9a2e5fda679942a61
SSDEEP 49152:7DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3qoBjvAR0:w3Upow8sB2to
TLSH
T1BFA58C3DA2E810A8D9AAC379C54213A5EA71782D3F3015DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-184-0x0000025C150C0000-0x0000025C15126000-memory.dmp

Download

memory/484-183-0x0000025C150C0000-0x0000025C15126000-memory.dmp

Download

memory/484-189-0x00007FF799180000-0x00007FF799651000-memory.dmp

Download

memory/484-236-0x00007FF799180000-0x00007FF799651000-memory.dmp

Download

memory/708-128-0x00007FF74A250000-0x00007FF74A667000-memory.dmp

Download

memory/708-127-0x0000016BAB390000-0x0000016BAB3F6000-memory.dmp

Download

memory/708-229-0x0000016BAB390000-0x0000016BAB3F6000-memory.dmp

Download

memory/708-231-0x00007FF74A250000-0x00007FF74A667000-memory.dmp

Download

memory/708-201-0x00007FF74A250000-0x00007FF74A667000-memory.dmp

Download

memory/708-126-0x0000016BAB390000-0x0000016BAB3F6000-memory.dmp

Download

memory/712-154-0x00007FF6BAD90000-0x00007FF6BAF25000-memory.dmp

Download

memory/712-214-0x00007FF6BAD90000-0x00007FF6BAF25000-memory.dmp

Download

memory/712-155-0x000001FDC1CE0000-0x000001FDC1D46000-memory.dmp

Download

memory/712-156-0x000001FDC1CE0000-0x000001FDC1D46000-memory.dmp

Download

memory/796-136-0x00007FF675160000-0x00007FF675214000-memory.dmp

Download

memory/796-138-0x000001C56E340000-0x000001C56E3A6000-memory.dmp

Download

memory/796-137-0x000001C56E340000-0x000001C56E3A6000-memory.dmp

Download

memory/796-203-0x00007FF675160000-0x00007FF675214000-memory.dmp

Download

memory/936-204-0x00007FF7FC9F0000-0x00007FF7FCB1F000-memory.dmp

Download

memory/936-206-0x00000242E97C0000-0x00000242E9826000-memory.dmp

Download

memory/936-205-0x00000242E97C0000-0x00000242E9826000-memory.dmp

Download

memory/936-242-0x00007FF7FC9F0000-0x00007FF7FCB1F000-memory.dmp

Download

memory/1132-192-0x00007FF7340A0000-0x00007FF73414E000-memory.dmp

Download

memory/1132-119-0x00000210178E0000-0x0000021017946000-memory.dmp

Download

memory/1132-118-0x00000210178E0000-0x0000021017946000-memory.dmp

Download

memory/1132-117-0x00007FF7340A0000-0x00007FF73414E000-memory.dmp

Download

memory/1200-65-0x00007FF6E03D0000-0x00007FF6E04EA000-memory.dmp

Download

memory/1200-66-0x0000022AC3EF0000-0x0000022AC3F56000-memory.dmp

Download

memory/1200-67-0x0000022AC3EF0000-0x0000022AC3F56000-memory.dmp

Download

memory/1200-144-0x00007FF6E03D0000-0x00007FF6E04EA000-memory.dmp

Download

memory/1256-7-0x00000000031B0000-0x0000000003219000-memory.dmp

Download

memory/1256-6-0x00000000031B0000-0x0000000003219000-memory.dmp

Download

memory/1256-0-0x00000000001A0000-0x00000000002B7000-memory.dmp

Download

memory/1256-1-0x00000000031B0000-0x0000000003219000-memory.dmp

Download

memory/1256-42-0x00000000001A0000-0x00000000002B7000-memory.dmp

Download

memory/1324-79-0x000002A014050000-0x000002A0140B6000-memory.dmp

Download

memory/1324-77-0x000002A013E30000-0x000002A013F78000-memory.dmp

Download

memory/1324-78-0x000002A014050000-0x000002A0140B6000-memory.dmp

Download

memory/1524-146-0x00007FF748260000-0x00007FF748503000-memory.dmp

Download

memory/1524-148-0x0000016589070000-0x00000165890D6000-memory.dmp

Download

memory/1524-211-0x00007FF748260000-0x00007FF748503000-memory.dmp

Download

memory/1524-147-0x0000016589070000-0x00000165890D6000-memory.dmp

Download

memory/2116-174-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2116-97-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/2116-102-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/2116-96-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2188-108-0x00007FF67D490000-0x00007FF67D559000-memory.dmp

Download

memory/2188-38-0x000001F324A10000-0x000001F324A76000-memory.dmp

Download

memory/2188-34-0x00007FF67D490000-0x00007FF67D559000-memory.dmp

Download

memory/2188-37-0x000001F324A10000-0x000001F324A76000-memory.dmp

Download

memory/2188-36-0x000001F324A10000-0x000001F324A76000-memory.dmp

Download

memory/3056-194-0x000001D1B40D0000-0x000001D1B4136000-memory.dmp

Download

memory/3056-195-0x000001D1B40D0000-0x000001D1B4136000-memory.dmp

Download

memory/3056-193-0x00007FF6E5A10000-0x00007FF6E5F17000-memory.dmp

Download

memory/3056-239-0x00007FF6E5A10000-0x00007FF6E5F17000-memory.dmp

Download

memory/3360-58-0x00007FF6F95A0000-0x00007FF6F9708000-memory.dmp

Download

memory/3360-53-0x000002A5DFFF0000-0x000002A5E0056000-memory.dmp

Download

memory/3360-60-0x000002A5DFFF0000-0x000002A5E0056000-memory.dmp

Download

memory/3360-54-0x000002A5DFFF0000-0x000002A5E0056000-memory.dmp

Download

memory/3360-64-0x00007FF6F95A0000-0x00007FF6F9708000-memory.dmp

Download

memory/3380-116-0x00007FF7210C0000-0x00007FF721804000-memory.dmp

Download

memory/3380-110-0x000001E6BBDC0000-0x000001E6BBE26000-memory.dmp

Download

memory/3380-109-0x000001E6BBDC0000-0x000001E6BBE26000-memory.dmp

Download

memory/3380-188-0x00007FF7210C0000-0x00007FF721804000-memory.dmp

Download

memory/3380-250-0x00007FF7210C0000-0x00007FF721804000-memory.dmp

Download

memory/3380-247-0x000001E6BBDC0000-0x000001E6BBE26000-memory.dmp

Download

memory/4536-164-0x0000020F0E050000-0x0000020F0E0B6000-memory.dmp

Download

memory/4536-171-0x00007FF782500000-0x00007FF782821000-memory.dmp

Download

memory/4536-170-0x0000020F0E050000-0x0000020F0E0B6000-memory.dmp

Download

memory/4536-165-0x0000020F0E050000-0x0000020F0E0B6000-memory.dmp

Download

memory/4536-163-0x00007FF782500000-0x00007FF782821000-memory.dmp

Download

memory/4708-175-0x00007FF6C3570000-0x00007FF6C37FB000-memory.dmp

Download

memory/4708-177-0x0000023C899E0000-0x0000023C89A46000-memory.dmp

Download

memory/4708-176-0x0000023C899E0000-0x0000023C89A46000-memory.dmp

Download

memory/4708-233-0x00007FF6C3570000-0x00007FF6C37FB000-memory.dmp

Download

memory/4984-243-0x00007FF73A8A0000-0x00007FF73ABDF000-memory.dmp

Download

memory/4984-215-0x00007FF73A8A0000-0x00007FF73ABDF000-memory.dmp

Download

memory/4984-217-0x00000178E9F80000-0x00000178E9FE6000-memory.dmp

Download

memory/4984-216-0x00000178E9F80000-0x00000178E9FE6000-memory.dmp

Download

memory/5100-86-0x00007FF741440000-0x00007FF74158A000-memory.dmp

Download

memory/5100-88-0x000001F1320B0000-0x000001F132116000-memory.dmp

Download

memory/5100-89-0x000001F1320B0000-0x000001F132116000-memory.dmp

Download

memory/5100-162-0x00007FF741440000-0x00007FF74158A000-memory.dmp

Download

memory/5516-26-0x00007FF67D490000-0x00007FF67D559000-memory.dmp

Download

memory/5516-27-0x00000224F8B10000-0x00000224F8B76000-memory.dmp

Download

memory/5516-95-0x00007FF67D490000-0x00007FF67D559000-memory.dmp

Download

memory/5516-29-0x00000224F8B10000-0x00000224F8B76000-memory.dmp

Download

memory/5516-28-0x00000224F8B10000-0x00000224F8B76000-memory.dmp

Download

memory/5552-47-0x000001F256000000-0x000001F256066000-memory.dmp

Download

memory/5552-46-0x000001F256000000-0x000001F256066000-memory.dmp

Download

memory/5552-45-0x000001F254D30000-0x000001F254E78000-memory.dmp

Download

memory/5984-16-0x000001B74E530000-0x000001B74E596000-memory.dmp

Download

memory/5984-15-0x00007FF78B5B0000-0x00007FF78B6D3000-memory.dmp

Download

memory/5984-18-0x000001B74E530000-0x000001B74E596000-memory.dmp

Download

memory/5984-83-0x00007FF78B5B0000-0x00007FF78B6D3000-memory.dmp

Download

memory/5984-17-0x000001B74E530000-0x000001B74E596000-memory.dmp

Download