cb8be5017513061e07cf25c21adf36942187d55d6ef9a9011f00a8857845b590

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 749KB
Sample260820-p7zzjade46
SHA256 cb8be5017513061e07cf25c21adf36942187d55d6ef9a9011f00a8857845b590
MD5 3530c77b9bdef08d3eeca2036582504d
SHA1 2a107d65c44e2ba6e3f5a1a4cb22775a46126eba
SHA512 655e6f9ba9d4e3fc8c81b2ad2ec39e4a7120ed3cb290962a6405e719d9ff5739c41d92791ce688dcea2048c3dedebdf3e909917ce21ed4da60dd72a8e2c9816c
SSDEEP 12288:/93G6vH8qAoubviBNDYa3aUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4r:/VGGcEBZKV2ENQvMAxLaHudE4xy/vgtJ
TLSH
T1EEF4011232D0C4B3E873693054B1AAB1597EFE300FB48EAB239417695DB06D29E35777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2128	alg.exe
5808	GameInputSvc.exe
1832	GameInputSvc.exe
1608	elevation_service.exe
872	elevation_service.exe
1200	maintenanceservice.exe
1636	msdtc.exe
2728	OSE.EXE
2496	PerceptionSimulationService.exe
1580	perfhost.exe
5436	ReFsDedupSvc.exe
3232	locator.exe
4504	SensorDataService.exe
2444	snmptrap.exe
5928	ssh-agent.exe
1116	TieringEngineService.exe
4252	AgentService.exe
3828	vds.exe
3032	vssvc.exe
3212	wbengine.exe
4604	WmiApSrv.exe
1520	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46ccfb98209659e8.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce0cbfc8a330dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081d7ccc5a330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9c19902a430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fb220c5a330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013cc9cc6a330dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b379dbcaa330dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1832	GameInputSvc.exe
1832	GameInputSvc.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	5808	GameInputSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1116	TieringEngineService.exe
Token: SeManageVolumePrivilege	1116	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4252	AgentService.exe
Token: SeBackupPrivilege	3032	vssvc.exe
Token: SeRestorePrivilege	3032	vssvc.exe
Token: SeAuditPrivilege	3032	vssvc.exe
Token: SeBackupPrivilege	3212	wbengine.exe
Token: SeRestorePrivilege	3212	wbengine.exe
Token: SeSecurityPrivilege	3212	wbengine.exe
Token: 33	1520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1520	SearchIndexer.exe
Token: SeDebugPrivilege	1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1128	2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 1832	5808	GameInputSvc.exe	90
PID 1520 wrote to memory of 1068	1520	SearchIndexer.exe	111
PID 1520 wrote to memory of 5936	1520	SearchIndexer.exe	112
PID 1520 wrote to memory of 1692	1520	SearchIndexer.exe	114
PID 1520 wrote to memory of 4244	1520	SearchIndexer.exe	115
PID 1520 wrote to memory of 4076	1520	SearchIndexer.exe	116
PID 1520 wrote to memory of 5136	1520	SearchIndexer.exe	117
PID 1520 wrote to memory of 5052	1520	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_3530c77b9bdef08d3eeca2036582504d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2128

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1580

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4504

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5928

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2860 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2860 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6285043151ce77fa89ed1172421da414f10d317a8c2e3bb0fc07d4a3cd6ee381
MD5 32982c767acab110a8564fba57cfbe05
SHA1 ac891aa7cb74aa2e325db727b58146e6c0c3224f
SHA512 7e034c48f3bc2c6bcfffcdb89bcf163bc053ae19e895576f4d9f1042abbe6df17ea2ffc1d4a8f5d488ceeb2f7bd4b248f8af69cc09c366fd693bf82ff9ff8698
SSDEEP 49152:fSV632BuPkFKRrdE6oh7stBhuXjfS4LWxnCuUwLaHeE4xy/sJ:l3q6gjBCaZ4xy/E
TLSH
T1EDD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 700a4ceed2350a1014705243318a83dfa010692d26c5980b8d65a780040426a0
MD5 2df23cb53f6d8113c9e9795ebb81e7a6
SHA1 31391e37844a7510948518b2e74c069b169f0243
SHA512 a88020507766158811c8c86d328348d1476cbaed8e3195e558ecce6ac9eb8975c04fa1c73474ce5b4a8007a0daf21ea55bc489608e1069fa6a0fbd076f005f93
SSDEEP 24576:/XYnWzczAyV2ENQvMAxLaHudE4xy/vgtPjl:LzcruUwLaHeE4xy/sJ
TLSH
T18B05022973E009F9FC77813DC8A28416DA33B85147A4EB9B03E496650F237995F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 45143dbcb12f9b9a778d5ed3f94055158a7075a9a727d24de410ef1cef1abef1
MD5 4567b0ef1ca3bf90ab6288ddfea210db
SHA1 e18e0c66b3df814fcb5d6338de56afa978e1fdff
SHA512 b4f0ce2b4e0eb4f36e043d56d0375567bfacfb6241f198487ce2ee1c119e3a33e9c10c5c874e1c877089867623bf36ece0fbea110b9064b70b81fd22b4e78c70
SSDEEP 24576:uwuuOWOV2ENQvMAxLaHudE4xy/vgtPjl:uwVOpuUwLaHeE4xy/sJ
TLSH
T1A105F14A32E41CF9F87695398597C53AE7F2B8112A65CB1F0360C35B5F77322AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7abc6ebce985ce48d252e4d3a4419df3fcbc51c665f5b85b1be63ae5d4cdf6ba
MD5 2a2d454148a83a29289aeb42f70d0520
SHA1 7f0c5ccc89ae7a1e63b1665b80ef51ee8e44d4ea
SHA512 7e5d9a5f6372341704f7bde0050b7efad52d3d5c0d4b6e044de201f7f73f107d621a32a992b48a99ad49f3adb8bf4a8ef04f55ab86916839db1918cdcabc407f
SSDEEP 49152:Uj+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5uUwLaHeE4xy/sJ:ou6JmTxd2dYaZ4xy/E
TLSH
T1F9D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b1e1dd9dc548684f9f609446ad0505c30b9c864f8ed37191f638be54f54dbcee
MD5 0f2e83945c143e26a4617b0ee16585a5
SHA1 c231c7aab6f2bf9a475bc304020305f91118a6ab
SHA512 fee04553f26727f39b6592f84129b289584823fa52f87c5559e3da32b418d36395a8cf64a23b6e8ce965831d731d6fb10df540342da30532c429b40fee4dd5e4
SSDEEP 12288:anwksU3fEJ7YSA0jwm/dgZkwt6nqEJF89F3iI:SwpUP6OmSt/mF873f
TLSH
T149452851726BC75FC6A940325E32C2CCA7707D01EE45AF0773C9873ED576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 004ebb3372e666194d96a80c77d3a7498542cb16fbd37c345e1227e5305c8ea9
MD5 a727d92edbc4007dabf63307b2a580f5
SHA1 23452efa19497efd289f557201b4ab969380a021
SHA512 4386905142cb0c2d2b2d1fe24cbdbd33d76eea0d9d362b07c8a84f3277cda6b593b47e4c9bfa41af40e410b26713b4b85852e3d2978d2e97785448055c782bac
SSDEEP 12288:4zdNdcoSZA5bFkRP2T+Wq0/Usp4hSqoEYMVrXojcEIy9mbnio:4FSZqbFZsEj9mDio
TLSH
T1CC75F9819437A38FC1FB603207665B4CABB4EC0677496F2277894539D82BB25B4B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f30d85b792edd220edd09c0647d3d9c3a074cb1a73174bf6f4ab2df430be0f14
MD5 353ef5b5a32ca5cb38a8b0942f6f0828
SHA1 260f1f4d66e06396b45a7bc4c15b7c68b9fc1a68
SHA512 38566b440494200cf20fcfa98f9b4adb8230ca22331f28a800adefe803c4a671bf5b2f79e9ef06fc7ac87793a6b27a6e39e3e90e20bffe0fe22bf2292d6e3ab7
SSDEEP 12288:sn7hUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:ChV2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T1E8D4230772B4AEA3FC34F9356047956D952EB9244BE8CFA30310A28458A1D5BAF3177B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5605d5da43038e5a3cd1374229e3e31eb8935bd5a9cb6a211d0a59e01f5bc1f3
MD5 d190a42cb779576a6c22d8886fb8c001
SHA1 970197c9f3cf04061ed51cae03bd9a7b72f28b2f
SHA512 b9a6e0f52f30825d59daa302de1bc203c201b66560e413d98c1a5d283c4e0249929fd71e11fa14be76838c67f88fc8aa9923b425ff7f6fa237a5fb553b5858cf
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYnV2ENQvMAxLaHudE4xy/vgtPjl:Cgb4mBIBhGF4uUwLaHeE4xy/sJ
TLSH
T16365AE1E22EC02F5E0F5E2B8DDA64417D6B278160731D6DF0251426D2F3BEE89E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 7682abc9645ae4575e881416f023813d2b3a97e7780a573354f9daf5b0568a23
MD5 454a5db1b01dc28e02df0e4280714629
SHA1 d42bdf718b33a5ce6a7690cc2de236cc12363866
SHA512 f66199f340ee33070225dd86681dc77e813381769a8586f29aef19170aeb13dbd1a3b860abf7ee31266907bee8cc774e949a13bf5e73db435332528dbd39a1a7
SSDEEP 12288:6WGzUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:9GzV2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T1D3E4221E31F4B9E1EC34D53A5052A46AB47275304B685FFF03D0E2748EA09E66B31E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 3132dbcdead213bc5e6fbf75edae784caaacb39a8fd59e76a44087838799f627
MD5 63d380b31e2d24c13c25e426300c986a
SHA1 e9922e26f233ce97a94c18884f33e33f65c8718d
SHA512 aeccd2ce693141877abba63184359f2541e76eb590c0791548b493e8ee8439b41afb84edd979da5de4104067c18b089d91b18cf13fcde4bb99b7f300092c5cce
SSDEEP 12288:P9UB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:P9V2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T122D4234A31B4EEE3FC30F8365043A55E8559B5214BE89FE30350A28458D5DEBAF316BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8234ac7f907b7ee2f10dc80c58898625f00720a175380778be4ad6a38bf56ff1
MD5 2d438633d8bcdb005689f618a960b301
SHA1 455f471e82c1dc3a57981ec6c2add8d50e566eaa
SHA512 365ff19d4e44eaa1e16c96c16061ad405e406bb678b494166d7360b36aa12ab3053932f739c1b2dc77e8e5d0fc52b6c18133c47af20a3599f0627ab7663af23a
SSDEEP 24576:y4z8N8cpJqH19Eria7/mLV2ENQvMAxLaHudE4xy/vgtPjl:z4ecPqVXa7/YuUwLaHeE4xy/sJ
TLSH
T1EE35F16576E002F1E477E13889824667F6B2B4250374EFDF07A88B551F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 66068f336963148c4684889fb49d0a3d2389b3822ab90c45fd17bf6d9bd15160
MD5 1b1689ceb239bf2b2d2733571c698e2a
SHA1 42d8126c3edda77e7d60c27881889eeba0c362fd
SHA512 61354ac604321230d4459126b8e0a9b06989bd8b3717b67724047b085c182f462941b1ce5c229e238fdf591e06a91e656f2830c94f9a6ddd774d162f10c50585
SSDEEP 24576:6PUr+NQZzV2ENQvMAxLaHudE4xy/vgtPjl:6JQXuUwLaHeE4xy/sJ
TLSH
T14405E11F22A81CE5F976E13D8582860DE772B4620751D6DF03E0817E4E67EE8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 5efcb12ad82e6e8c2981a79bbd403ee22b0f45780eceb783e8a05494bc2bf391
MD5 647949a54b9160281f67c0b2dd7c31c4
SHA1 c38521dcf7d558bc11d53f8ebc4a7f042cfe74ba
SHA512 9fb34e91416d6c3afd25c4c045ae2de675f59556d0081b08a6bcd24e1afdfd1f406ceb09ca143ebf4331e1ecb81e4c8af27cc1c8dabd0732487ca59516c584a8
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyuUwLaHeE4xy/sJ:tG05lO43b4aZ4xy/E
TLSH
T1E2D5C06E62EC11F9D0BBD17CD9C64A0BEBB23415033556CB02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 0b41b7ff6c6cc2cde25e8b1433bfd2d1d0c598b7868a1c2178215d5afe8bed62
MD5 fce97b1096f336b9e14cc9be7d345796
SHA1 6d145a17ec6041a16f250f6a08711fde9713d7a9
SHA512 e583c64e227ca6d92b4706a290fb69460231040afb2ef82d520ebe3ae31ecf6647f51886d33d0d8b923f4c9eae890fdf09e636abd4c0bb90904e0e8f9aafa4bb
SSDEEP 24576:ISa5POZ3dpbWVM50JicR2hG0lasx2+47eidnNV2ENQvMAxLaHudE4xy/vgtPjl:xa5POZ3wJt2pasx2+mFuUwLaHeE4xy/E
TLSH
T12765BF5EA6FC01D5E579D17DC583861AE5B1342253319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e05a8a33c0f8e179081dc00a2e87ce2a4d68503f4fe8ff8e787f86ec66e02d1b
MD5 0e80f2cdd93e9a7392c5712f86eb5db3
SHA1 d70a44f8ffbafcddbe6255b1ce80899ecfb809ba
SHA512 0164f293e75f936e62e3a678e69256147449a653d786ea68eb175b4916700c18f616abd1bc173311c7db2b6aac5529b8e2ef672fba050883e58fe5db765fbabe
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkIV2ENQvMAxLaHudE4xy/vgtPjl:/Nc/zEOVHFXuUwLaHeE4xy/sJ
TLSH
T1D5858B1623E901E4F5BBE1BE89779546FAB1786513348ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 cb51caba22170b2d228a0864c8b99373ca110d8cc59dc4937249f1729cf56efa
MD5 65a2d0685b73bf79c62793fd2a48c64e
SHA1 5ccb4e9368e504f1872390c60c4fc477004e742d
SHA512 c182327064b8abcbff711745a179eff76b0b0d952d9cb74e217cffe6acae5c56b80a365e8f07fcdc8d5ff307e8db661981939236614560ab1eb354ca24fda855
SSDEEP 24576:tJnJPbzB4SqV2ENQvMAxLaHudE4xy/vgtPjl:tJnJv6SAuUwLaHeE4xy/sJ
TLSH
T1E915E03DD2A810E9E8B7C274815A175AFE31387C2F2569C719B4D5343F52EE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 34627a797eb9fbc032a012e45c8e64c7f34c61568b54d1b56413aba85db9f432
MD5 524a41eb983235a735db984cc508be89
SHA1 a123640ca6e7b967e203a18e861b4697c6f871c4
SHA512 492c8ad0083ab9514791af949a2cb934bf73c392380f81fdd779f26f0b6072e11e39ee86c6a85c556796a2980b31acf51755b13ff92705cc90c945122a169496
SSDEEP 49152:HCLHGeeV5ijCmlDWDkwuUwLaHeE4xy/sJ:iNaZ4xy/E
TLSH
T1AEA56B05A7EB5184F8F3CAF5C92294169A327C549B34F7EF4A80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 be6d0044993c782294be8834fd2aef9380494a622507cfa6ec21b8e8b93fd4e6
MD5 56facc5d90370d0f5f5a0b3314deae35
SHA1 ef094434ac60fd163e52627a36afce5e8076b424
SHA512 909185b8c4f13a7bad0ff62280d79f66eee0e3257ef1512955bed52258911210a1af7d75b157d0401a542024efc6e20e260659bf140c8d884ca769a6afc36f25
SSDEEP 12288:g1H1k6j5ZI7VUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:76DIxV2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T15105015D33BA11F6E077E03E81830506D2B2B47087655ADF0794C1B98EA3EDDBA39E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 b5825e778b146f34c3ae20d42790f86a53687c2549b02fb42462a767181cc6ac
MD5 aa4279b5ade52de97490b1d8818abdd3
SHA1 1b015fbbaf8c36af09eab0d3f4cce7a94024cefb
SHA512 32bb89fff52d143aceb7a0add1873866de8b9a13a6eb8d0a5b11bdcda622fb2a97020f9387841dc39bfa457b5df15ac97f5bf77e6fcc7055bd344fda535c2d3a
SSDEEP 12288:WG6kysUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:/tysV2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T151F4120533A4A5E1FC759539946381A9CE35BC304B648BEF0390E32D1E75BE6BE31B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 efe3934a0e6320afa45e17ee27c364744f26363f9a315443b9fb9f0767cdde0a
MD5 20bec1feab1e79e68f3054bf903916b4
SHA1 0b6f59fa1a8ab0e4d99d4edc1a1b8b089cceea32
SHA512 a12860cadb0d851d846ce099885aa22307cebd1ac2840265aee6b784ca10458ad110c40daad5372a4ccb3b4c6ab2c8cfdcc34e010218ceb26ce92aa3922d5bc5
SSDEEP 12288:BhbUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:3bV2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T192D4234E31B4BEA3FC30F9365043555E8066B5304BE89FF70390E2A489A59E76F31A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 538741fef2901c824e7c0de450a91555c1a555ec88cfc3345b9466eff0c554c0
MD5 b7430b81594da6386a73b3d7d8c71d34
SHA1 f2230904853f5b4ffb642f362d84c34a5f6dc6d1
SHA512 5f3ce44c7fcb264bbce0eb533c9f5aececf3229c16816011c8eca2ef79be09b16aa8fae078f752a9580ad77fe3342064ed99ec5bb1a7f5e66c38b9bd5c675763
SSDEEP 24576:eKgFkoTfaidZ19V2ENQvMAxLaHudE4xy/vgtPjl:FgbTrZduUwLaHeE4xy/sJ
TLSH
T12A559C1D73EA09CAE2B2D635D8625493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 775b53edf330b3b3997e8591b84353846a8a4737f82b7f0fb9192122c00e5e98
MD5 56a6f2c9515a110f6bd4b05619612925
SHA1 aa6cb6e43124fad681ea0a3ba2434d4007fb8ad1
SHA512 834ce7c23b2c49099b8edee37e429885c270f5c9306d2bf11c4d845e042676030b86624b04258802525d52304db854128556c7077aacd89cacfbac9f29fb5f65
SSDEEP 12288:upJcm8CNMUB1K2ZIiGlNQbjMHgxLaHbylD+74xHTG8b8z/vhB4tXf8Ul:urcmRMV2ENQvMAxLaHudE4xy/vgtPjl
TLSH
T1D505F14EB2BE00E6E4B7D13C8882455AE6B3743057615BDF02A0C37D4E679EA7E34B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b0c8403ce1819ce1586f09e578c69749a81ee42491283702f265918bb7e0792c
MD5 6b1348417c3f3c9470a833876bcff90e
SHA1 77012c605bd17aa87d41363cb0c3c80aff6b5632
SHA512 5e159dca6523698beaaf35f175affab7ba09e2b95a09581a769f4f1741d38a4915f493e621cc91bda657affaad3b9debb8d28308407815913c1fec1c3c277b68
SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3FuUwLaHeE4xy/sJ:G3Upow8sBRaZ4xy/E
TLSH
T1E7A58C3DA2E810A8D8AAC379C54213A6EA71782D3F3055DB0174C178BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-53-0x000001A866A80000-0x000001A866BD9000-memory.dmp

Download

memory/872-55-0x000001A866D00000-0x000001A866D66000-memory.dmp

Download

memory/872-54-0x000001A866D00000-0x000001A866D66000-memory.dmp

Download

memory/1116-162-0x00007FF6FB970000-0x00007FF6FBB05000-memory.dmp

Download

memory/1116-164-0x00000200B1910000-0x00000200B1976000-memory.dmp

Download

memory/1116-221-0x00007FF6FB970000-0x00007FF6FBB05000-memory.dmp

Download

memory/1116-163-0x00000200B1910000-0x00000200B1976000-memory.dmp

Download

memory/1128-7-0x0000000002D60000-0x0000000002DC9000-memory.dmp

Download

memory/1128-1-0x0000000002D60000-0x0000000002DC9000-memory.dmp

Download

memory/1128-0-0x0000000000600000-0x0000000000717000-memory.dmp

Download

memory/1128-42-0x0000000000600000-0x0000000000717000-memory.dmp

Download

memory/1200-68-0x0000021FCD4B0000-0x0000021FCD516000-memory.dmp

Download

memory/1200-70-0x00007FF6A30B0000-0x00007FF6A3218000-memory.dmp

Download

memory/1200-63-0x0000021FCD4B0000-0x0000021FCD516000-memory.dmp

Download

memory/1200-62-0x0000021FCD4B0000-0x0000021FCD516000-memory.dmp

Download

memory/1200-61-0x00007FF6A30B0000-0x00007FF6A3218000-memory.dmp

Download

memory/1520-250-0x00007FF61BB80000-0x00007FF61BEBF000-memory.dmp

Download

memory/1520-222-0x000002235FA50000-0x000002235FAB6000-memory.dmp

Download

memory/1520-223-0x00007FF61BB80000-0x00007FF61BEBF000-memory.dmp

Download

memory/1520-224-0x000002235FA50000-0x000002235FAB6000-memory.dmp

Download

memory/1580-171-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1580-110-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/1580-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1580-105-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/1608-45-0x000001C53FD90000-0x000001C53FEE9000-memory.dmp

Download

memory/1608-46-0x000001C540010000-0x000001C540076000-memory.dmp

Download

memory/1608-47-0x000001C540010000-0x000001C540076000-memory.dmp

Download

memory/1636-75-0x000001E279DC0000-0x000001E279E26000-memory.dmp

Download

memory/1636-161-0x00007FF71B640000-0x00007FF71B75A000-memory.dmp

Download

memory/1636-74-0x00007FF71B640000-0x00007FF71B75A000-memory.dmp

Download

memory/1636-76-0x000001E279DC0000-0x000001E279E26000-memory.dmp

Download

memory/1832-37-0x00000255DB4C0000-0x00000255DB526000-memory.dmp

Download

memory/1832-38-0x00000255DB4C0000-0x00000255DB526000-memory.dmp

Download

memory/1832-116-0x00007FF7194D0000-0x00007FF719599000-memory.dmp

Download

memory/1832-35-0x00007FF7194D0000-0x00007FF719599000-memory.dmp

Download

memory/1832-36-0x00000255DB4C0000-0x00000255DB526000-memory.dmp

Download

memory/2128-15-0x00007FF793C80000-0x00007FF793DA3000-memory.dmp

Download

memory/2128-16-0x00000256466B0000-0x0000025646716000-memory.dmp

Download

memory/2128-17-0x00000256466B0000-0x0000025646716000-memory.dmp

Download

memory/2128-73-0x00007FF793C80000-0x00007FF793DA3000-memory.dmp

Download

memory/2128-18-0x00000256466B0000-0x0000025646716000-memory.dmp

Download

memory/2444-144-0x000002CACFEB0000-0x000002CACFF16000-memory.dmp

Download

memory/2444-145-0x000002CACFEB0000-0x000002CACFF16000-memory.dmp

Download

memory/2444-143-0x00007FF6ABF70000-0x00007FF6AC024000-memory.dmp

Download

memory/2444-210-0x00007FF6ABF70000-0x00007FF6AC024000-memory.dmp

Download

memory/2496-96-0x000002D957C30000-0x000002D957C96000-memory.dmp

Download

memory/2496-169-0x00007FF722B20000-0x00007FF722C6A000-memory.dmp

Download

memory/2496-97-0x000002D957C30000-0x000002D957C96000-memory.dmp

Download

memory/2496-94-0x00007FF722B20000-0x00007FF722C6A000-memory.dmp

Download

memory/2728-84-0x000001D7FA320000-0x000001D7FA386000-memory.dmp

Download

memory/2728-88-0x000001D7FA320000-0x000001D7FA386000-memory.dmp

Download

memory/2728-83-0x000001D7FA0F0000-0x000001D7FA249000-memory.dmp

Download

memory/3032-196-0x00007FF6E0580000-0x00007FF6E0A51000-memory.dmp

Download

memory/3032-190-0x00000132C86B0000-0x00000132C8716000-memory.dmp

Download

memory/3032-243-0x00007FF6E0580000-0x00007FF6E0A51000-memory.dmp

Download

memory/3032-191-0x00000132C86B0000-0x00000132C8716000-memory.dmp

Download

memory/3212-246-0x00007FF7F7440000-0x00007FF7F7947000-memory.dmp

Download

memory/3212-202-0x0000022CF7B90000-0x0000022CF7BF6000-memory.dmp

Download

memory/3212-201-0x0000022CF7B90000-0x0000022CF7BF6000-memory.dmp

Download

memory/3212-200-0x00007FF7F7440000-0x00007FF7F7947000-memory.dmp

Download

memory/3232-127-0x0000022DF8B10000-0x0000022DF8B76000-memory.dmp

Download

memory/3232-199-0x00007FF6DADF0000-0x00007FF6DAE9E000-memory.dmp

Download

memory/3232-125-0x00007FF6DADF0000-0x00007FF6DAE9E000-memory.dmp

Download

memory/3232-126-0x0000022DF8B10000-0x0000022DF8B76000-memory.dmp

Download

memory/3828-187-0x00007FF60DC80000-0x00007FF60DF0B000-memory.dmp

Download

memory/3828-241-0x00007FF60DC80000-0x00007FF60DF0B000-memory.dmp

Download

memory/3828-182-0x000002E0ECD00000-0x000002E0ECD66000-memory.dmp

Download

memory/3828-183-0x000002E0ECD00000-0x000002E0ECD66000-memory.dmp

Download

memory/4252-179-0x00007FF7AFC90000-0x00007FF7AFFB1000-memory.dmp

Download

memory/4252-177-0x0000027612880000-0x00000276128E6000-memory.dmp

Download

memory/4252-173-0x0000027612880000-0x00000276128E6000-memory.dmp

Download

memory/4252-172-0x0000027612880000-0x00000276128E6000-memory.dmp

Download

memory/4252-238-0x00007FF7AFC90000-0x00007FF7AFFB1000-memory.dmp

Download

memory/4504-136-0x00000216DC050000-0x00000216DC0B6000-memory.dmp

Download

memory/4504-134-0x00000216DC050000-0x00000216DC0B6000-memory.dmp

Download

memory/4504-206-0x00007FF72C6B0000-0x00007FF72CAC7000-memory.dmp

Download

memory/4504-232-0x00000216DC050000-0x00000216DC0B6000-memory.dmp

Download

memory/4504-135-0x00007FF72C6B0000-0x00007FF72CAC7000-memory.dmp

Download

memory/4504-236-0x00007FF72C6B0000-0x00007FF72CAC7000-memory.dmp

Download

memory/4604-247-0x00007FF642D80000-0x00007FF642EAF000-memory.dmp

Download

memory/4604-213-0x000001DB2C830000-0x000001DB2C896000-memory.dmp

Download

memory/4604-212-0x000001DB2C830000-0x000001DB2C896000-memory.dmp

Download

memory/4604-211-0x00007FF642D80000-0x00007FF642EAF000-memory.dmp

Download

memory/5436-117-0x000002398A060000-0x000002398A0C6000-memory.dmp

Download

memory/5436-254-0x00007FF793900000-0x00007FF794044000-memory.dmp

Download

memory/5436-119-0x00007FF793900000-0x00007FF794044000-memory.dmp

Download

memory/5436-118-0x000002398A060000-0x000002398A0C6000-memory.dmp

Download

memory/5436-195-0x00007FF793900000-0x00007FF794044000-memory.dmp

Download

memory/5436-252-0x000002398A060000-0x000002398A0C6000-memory.dmp

Download

memory/5808-103-0x00007FF7194D0000-0x00007FF719599000-memory.dmp

Download

memory/5808-27-0x000001E8FDDD0000-0x000001E8FDE36000-memory.dmp

Download

memory/5808-28-0x000001E8FDDD0000-0x000001E8FDE36000-memory.dmp

Download

memory/5808-26-0x00007FF7194D0000-0x00007FF719599000-memory.dmp

Download

memory/5808-29-0x000001E8FDDD0000-0x000001E8FDE36000-memory.dmp

Download

memory/5928-155-0x00000250E5AD0000-0x00000250E5B36000-memory.dmp

Download

memory/5928-152-0x00007FF707ED0000-0x00007FF708173000-memory.dmp

Download

memory/5928-154-0x00000250E5AD0000-0x00000250E5B36000-memory.dmp

Download

memory/5928-218-0x00007FF707ED0000-0x00007FF708173000-memory.dmp

Download