8093418ea37ac8ae31aaf7e32ad3607976099df8868552d1a1769167eff31f4f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 745KB
Sample260826-m8wx6axeke
SHA256 8093418ea37ac8ae31aaf7e32ad3607976099df8868552d1a1769167eff31f4f
MD5 c0640708a1bef2dce2f57e06984db378
SHA1 bb1eedcbbbb1ac53f759dd06487e357199b2f3d6
SHA512 f453a8f2dc6b935cb314a3f1f31922c8163599610a1eff409daced66b79ad1b7fd5a4a56b0c05d6b2e01202fd1f18b491e65e4c504cf1881a5fb9d0343a7b79a
SSDEEP 12288:U93G6vHzOASubviBNDYa3JvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:UVGGTWBZ5Ox1/Omc0prdi6ffLJDI
TLSH
T1E5F4022072C09077E563093256F596B16A7EFD700F668D8F6384136D5EB07E28A38B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1624	alg.exe
1340	GameInputSvc.exe
696	GameInputSvc.exe
5552	elevation_service.exe
364	elevation_service.exe
5904	maintenanceservice.exe
5496	msdtc.exe
5808	OSE.EXE
4956	PerceptionSimulationService.exe
4928	perfhost.exe
6016	ReFsDedupSvc.exe
3124	locator.exe
5968	SensorDataService.exe
2336	snmptrap.exe
3164	ssh-agent.exe
1496	TieringEngineService.exe
3032	AgentService.exe
5316	vds.exe
4408	vssvc.exe
2980	wbengine.exe
4644	WmiApSrv.exe
572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4fa8b9e45387db0e.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2514f604b35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c10ec634b35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a82d15604b35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003af319604b35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d775a604b35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083ff2c5f4b35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
696	GameInputSvc.exe
696	GameInputSvc.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	1340	GameInputSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1496	TieringEngineService.exe
Token: SeManageVolumePrivilege	1496	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3032	AgentService.exe
Token: SeBackupPrivilege	4408	vssvc.exe
Token: SeRestorePrivilege	4408	vssvc.exe
Token: SeAuditPrivilege	4408	vssvc.exe
Token: SeBackupPrivilege	2980	wbengine.exe
Token: SeRestorePrivilege	2980	wbengine.exe
Token: SeSecurityPrivilege	2980	wbengine.exe
Token: 33	572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	572	SearchIndexer.exe
Token: SeDebugPrivilege	2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2324	2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 696	1340	GameInputSvc.exe	91
PID 572 wrote to memory of 3220	572	SearchIndexer.exe	113
PID 572 wrote to memory of 5748	572	SearchIndexer.exe	114
PID 572 wrote to memory of 5644	572	SearchIndexer.exe	115
PID 572 wrote to memory of 1348	572	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_c0640708a1bef2dce2f57e06984db378_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1624

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4928

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6016

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5968

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2896 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2888 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7eb787cbd19a6d9ab95dc4c2eecde21dd0ae1b09fee9ca487ce851f010c66c36
MD5 b1f9e22fd3212416de66938d8eb78b40
SHA1 beaa9831ae8bdc072de9997ca8cadc8eeb649b20
SHA512 6266c1315a032068e588992866a0af1e5907b46c6e52d8d6d2568420c9d85a46ca5064aa267af1229dea5c603a92275f2dcf5c3c80827f5e416ad793799f7721
SSDEEP 49152:4b+632BuPkFKRrdE6oh7stBhuXjfS4LWxn1sSVLJ:S3q6gjB2sSV
TLSH
T118D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 a6507f47846fd6fe463b179eea418174221be39f5cc3310b7a1fa810f47d0f92
MD5 eca10d86819b17e839b6866a8841251c
SHA1 0adc4e9e1ea724475850e234df58bb5fd0b60398
SHA512 8cdb201c6dc1a694a311c921523be29ad4b6d7106fe5bb5b4774a895acc273c68fe8d2e89e73cf1fc93b1b20c1000b3dd416038d6debf2527fe77f68e1c8422d
SSDEEP 12288:01XLsbCrxx3jlRq2czAcvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:SXYGXpczAoOx1/Omc0prdi6ffLJDI
TLSH
T12305F12863D004F9ED5B8139C9F28512EB73BC914760EB8F03A496651F637D89E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 25d243cf16c7557c3e59b2d84aec15fad0304ef0eff4443d9a684ddd104cdd1b
MD5 fdf4fc7edc1b975abceb044ce1464658
SHA1 a833443f812ccd572490ae830246d8caa010f121
SHA512 9565edef57b711651681f3052645246d30a0fa65ea8d03b22d2f02d8c78ce2209c9a89e16c420c6a3a8eca74d431e2c805d635de07752e22fc18056eafe30e1f
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CwvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:Owu+OW3Ox1/Omc0prdi6ffLJDI
TLSH
T16105F15963A01CF9E967853A86978132F7F2BC511B26DB0F1360C35A6F73361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8bd0af7085d9172708fe044687f5636fd0a22febe3bd2bf1db99cdeae4594dcd
MD5 a99264432c54f6bcd6f6b5eb384bb1d2
SHA1 c347feb5ea088e6bd16fa7f231ea3710e84d4502
SHA512 29116881ea60e5068a86c5b07a380245036612b777e01f9c7319b7a99f808538384f6201d6907a0c58c2b46d8ab2a6103fbfbfabe94abc26547800f557b380f0
SSDEEP 49152:zB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glOsSVLJ:Fu6JmTxd2dOsSV
TLSH
T10ED5AD13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 83c24bdb64ad7949caf97549d093b611e920c14bc2ee87702049f371850cc0ee
MD5 1e7a23f88e7183130a2bc29372f5ddf6
SHA1 bbea23c2a79feb51bcceae1c48fe563b433d9a71
SHA512 d21363b5c2a76161fbf66e4d9b90e81eb6d247f24f1b82d600c3149de38335ccbad687bcd20ea4c9915eab31c9bff4c9f5c1143ddfaaaa5325454c6919cbfb24
SSDEEP 12288:cX7svXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:yYOx1/Omc0prdi6ffLJDI
TLSH
T19FD423788391711BF51E8D7352FA41716B7DFCA40B46D88FA10023A86AF0B95DA3897F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 132ddb81070f08d7243fdee24464688bc90000368aff77e96e36888c465ec192
MD5 6b23ef63805565621f3c28e410525aac
SHA1 4c74983a8d67b5dbf79fa03e48c0877433415a61
SHA512 99ce43f9bb123460c591e102d88a06b73504d1cccf530c8d7320a4f6a62703dc2f5d309954b652900082d13f954a44d927916f98a3d93bb2427a7b2dd2654a12
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYzOx1/Omc0prdi6ffLJDI:qgb4mBIBhGFPsSVLJ
TLSH
T14365AF1E22E802F5E0FAD2B8DDAA4417D6B278160732D6CF1151427D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 bd8cb301a034a00374bd347d5ce911f257a3227ee61c4a067e4665db15a375b3
MD5 1169489fdc6361bd6ecce6c8e043e679
SHA1 28794bae980b3fadaf63f59d33db4cea159fcd74
SHA512 a0432351b341fe1021d69bf1aeb2d7da058ac0517b387350769c3119518f327d16372d2e0a254d615c23c299d892829765a475a138d54b1bc207d5a05095ce51
SSDEEP 12288:a5GVvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:SGFOx1/Omc0prdi6ffLJDI
TLSH
T183E4237C52E13059D53ECA3791F611A3BA79B8E0071659CF0190A3785FA0BF4E63CDAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 ea0cae0f521cd4524aa17fd1c74203abd9f882bd02c33395c70caa5616fb8a59
MD5 44c55d9f8a797b03569ed95c1f758c35
SHA1 9bab98a077a75defd8896f84995b887001b1b247
SHA512 a2bdd28e8cc82e7e431356af464f0d0c3cf88a17ccbc79e877a58964bbefe3f3140e43dc45736ca69cd40073b010fed9c0b92fd78c5e3fde36b3908edd67075f
SSDEEP 12288:GmvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:GKOx1/Omc0prdi6ffLJDI
TLSH
T1B1D423BC4381711BE50A8D7352FB01A19B7DECA10B4799CF611023686BE17E9D6389BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1f53e6c931b19bd5f4c39beacc2ebcf1045544e499822aa2491cfb9383d8dfa5
MD5 63bd9d82e063841b6b1ee9055f5a1c66
SHA1 1af35d708371522a74e1de9d44124ba72f7946ca
SHA512 302d23ed667f87d8373fde1fb5209ba11d682bccac261068a5c9c233ecff6920a777fea63fcf3ad7afc4b3d8717e87b66dc26c85d539b9db3997cd7df4a292b3
SSDEEP 24576:SLD8961pJqH1Mzria7/mLOx1/Omc0prdi6ffLJDI:Aoo1PqVra7/nsSVLJ
TLSH
T17335F16567E101F1D47BC1388A964663F6B2B8210365EFCF07A88B551F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6cb6f1381da2c3258a38a709187e55f6e3f51f3f1e8b32950ccf33e4af974fec
MD5 1f52c41b1a61ab3255d28ace16f982ea
SHA1 2618e9e2823c495750066cd2eb98d61fdefd56c2
SHA512 9808a27c0c7f25588feda0269f3454253c1b14943aba5e0130b291005a5b8afa43a01445a1af609dc3e0ffd617a33f67fa67de5a910b53d19c988657a4d25f4b
SSDEEP 12288:cHvUrBFrEjwaQBvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:cPUr+NQxOx1/Omc0prdi6ffLJDI
TLSH
T1DB05F12E22E818E5E67AD17D85D64319F771B8620712D2CF0290827D1F63EE8BD3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ff4957761cda7737c37b4d28810ce0b25e4f63444f7b02702b82f6938085267c
MD5 1a8b30b5bb1373f7d9dfc453c02b6b99
SHA1 fabd19f8e7d7a8cd1c478c2d2a75895454266ddb
SHA512 0a82cfaf54d277cd0b2a1767ded5452722eeb7882d1e282af79f4f4e8f3404e792ec78d9f915fc8d69835fa03b538b0049f33ebe81b3729998ad8e42d62554ec
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjsSVLJ:0G05lO43bKsSV
TLSH
T1BDD5BF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 cc99e159e1f161322833d03e518368f82f202a66bc6927249b7a0fbfca0af418
MD5 cdd313a7f466cfd0f828360f51401d28
SHA1 8dc8e12c19c3cf8cc7c8bede0ce33ba1dbca1cc7
SHA512 2c2f7c4304ea5077529aefd353e6d426cb2df2df951d6e82d1666dcf66b4847017a125069bfe3de15ee8a68a45f79ee052290f23130f46441048af32fea5b464
SSDEEP 24576:ipa5POZ3dpbWVM50JicR2hG0lasx2+47eidnLn0U7QYz/NAe5:ga5POZ3wJt2pasx2+mWUEqNAe5
TLSH
T18A65AF5EA7EC01D5E579D17DC583461AE5B2342153329BCF022182BE3F2BEE89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e13888e3c202e96651d287220535c6b8d94da80b7870b202a3b9a27943ce0296
MD5 7a23024aaeb38e0a9a10757bc4aa66bf
SHA1 f75e9a0f369102f72f56de81e112044cc805e1f3
SHA512 82f3b95ce039475ad8bed67334b1596ecebd8384e01d008d4b59c4a4db7743d6fced3d056f0fb688044e0755d74ff3a635f1e7b60083a0d491d5a111f0cfb1f6
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkdOx1/Omc0prdi6ffLJDI:aNc/zEOVHFFsSVLJ
TLSH
T1CF857B2623E901E4F5BBE1BE89779546FA71786517308ACF0291811E1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 11511abb0fbd561c88c7b3cc9f8253393107edce0612bdb80722a2e36780b3dc
MD5 db93de11dadaeff56adf1e326c19b381
SHA1 a56a11e0a957a07d2cbc48df7d69fad8edf8ba0f
SHA512 01cb9f5793062aa48915e289889c6865a062e98e475d29e00207b513cb5fface137952203844636567effbfbd2700e04f28a452c873b8edf95f106dd1f33a0af
SSDEEP 12288:VMHPJnJP6szeCs6Rl28d6vXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:QJnJPbzB4SuOx1/Omc0prdi6ffLJDI
TLSH
T16515D03CC2A420E9E4B7C2B5815A1656FF31387D2B2669CB15B4D1343F52FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ea294cb89b24d1f452f9ca96650c923ba56e22ce112fe94ded44974e82add9f2
MD5 aa303b1e6343280d5a14dbf247ae87d5
SHA1 d0ac69f5304faedf0243e9dcc22237f9ff615c3b
SHA512 fd8447125bf565df8e0e1d610e125792b4fb887f39dd7771ec04e899f5a87f3cc6961b30a85651adcdb433b162f2a2bd8b5c0bb339cd00891fa8b510a8529835
SSDEEP 24576:jCLHGL0MoeVtFumTijCmlKQWDkSn0U7QYz/NAe5:jCLHGeeV5ijCmlDWDkZUEqNAe5
TLSH
T111A56B05A7EB5188E9F3CAF5C92694169A327C509B34F7DF4E80CA6A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 ac1005b732c625275225351084c93c12898897f57f1f4694b4501ef6bf5b23da
MD5 4d8843b9d47d8dbf9cbf4821ef97a1ed
SHA1 2e48e76ec4f8ac3411de74002c7a240744ea819a
SHA512 d18e15143f60b3f19f45872f3fb6729df82dae42f3e0b62c8185360cdf37a2cc7607e42b91f14f1b06fd2486e80e55d4545f40141d7b74fbd1b53a92790cdd27
SSDEEP 12288:N1Hck6j5ZI70vXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:N6DI8Ox1/Omc0prdi6ffLJDI
TLSH
T15BF4F16C23B620B6D16BC03E92D30152D6B6B4B1871259CF0694D2BD5FA3ED8F93CE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 8afd18d28bb844736e6bbcb983c9114091fd9469a3f55bb82c6a5c255c6b12ec
MD5 229664044c9a818a3bba00aa2415f847
SHA1 a3464971f756ecc297f301277afbe791f4dbfc33
SHA512 85a5a94e3edc2893a7e1a51498b9c3393c5ed977ab63a7c1745a25d058001863096e59236b1afc52fb97567ea8ede1a5d75fb759bde15945e2925637c10020d4
SSDEEP 12288:uG6kyovXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:nty0Ox1/Omc0prdi6ffLJDI
TLSH
T181F4125843D0709AE66A4A3696F341A19F39FC600B1296CF5190B33D2F71BE4E934F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 38a96971b282f732356aa0f9c4dc3a1f4d5d86261fc4fe7ec6215dd401647738
MD5 a22433db4c635dbb107e89010998d78a
SHA1 5f81bf6237e418dcf6877cbe080c00c2d3217625
SHA512 871a7cd4856506b138818b00ba651a8563756fe0dffd6366277960b28efa2ab0817ce41f282f0bf596b3cc079c6f9161580064346ffc7b5bc151364acd3377d3
SSDEEP 12288:6fNvXOaC1/OmcFjYnpl/84RxwY45d6ffQ+JDbfkym:SNOx1/Omc0prdi6ffLJDI
TLSH
T1ECD423BC4391311AE50A8D7352FA02A2977DFCB00B0799CF619063785BE17E5D638DAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 c76d14d945918069e1283dee4ade2d9587cca00d7e4c3fdc6a2ec0258c65a246
MD5 57a39f468337b99c421fe2970124b5de
SHA1 1c786e20545358e166b9a7deaf725750a3f77e56
SHA512 ae5060c06df0fea38f721e4cffa0de8ce73926f6524602e233a7319f4ba8b5c956af57840b307996d3a9eb367f43fffb1a0a994395f88dd4717694fbc114a222
SSDEEP 12288:qDgIuZyFDK3tT5Tr7aVLIH9lH3cXqyNnEjGEU7Tkox/qkz/DJAeLAe:qDgILoTfaidZon0U7QYz/NAe5
TLSH
T1A5558D1D73EA09CAE2B2D275D8621493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 20d003cd1109ffa2a9483384eab9e89047c3bcf3d6f13d6acfba836edf118d48
MD5 4e537bd5129dab4d24d351a3d93f2797
SHA1 3f36610e34c6c8e9b84598386a40a3ab182dcf6b
SHA512 ee296a1cfb6ce6673470c77e0652fe222d72f8b4ed653b8b25672a3a84b0e315eab9d93f1725a01b86f877caa6524e8a124924c363f32fad634300392df7bb98
SSDEEP 12288:FpJcm8CN9qyNnEjGEU7Tkox/qkz/DJAeLAe:FrcmRnn0U7QYz/NAe5
TLSH
T11F05F14EB36A00E9E277817C88854245EAB33030275273DF4AA1877E5E5FEE87E39751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5dd662384e6326871b8a27aef3e921ccfa0159a0d44b85b16db9652c710b0cdb
MD5 c949b7fc129e834a8bb8aa320d80190e
SHA1 e378b4a74a355d65a5c47d688976de417a474834
SHA512 0bb4fa6204afa755331bbfebb1aaf83cfe136f0462b2581b1a8a8fd0fd4948db6f0751b462f8244a8d70c9d8066cebd42f351cb34737a0d18a8da04a253ac819
SSDEEP 49152:nDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3AUEqNAe5:c3Upow8sBSEcAI
TLSH
T1F7A58C3DA2E810A8D9AAC379C54213A6EA71742D3F3025DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-54-0x000001557DE70000-0x000001557DF1F000-memory.dmp

Download

memory/364-55-0x000001557DF70000-0x000001557DFD6000-memory.dmp

Download

memory/364-56-0x000001557DF70000-0x000001557DFD6000-memory.dmp

Download

memory/572-250-0x0000023EB5620000-0x0000023EB58BE000-memory.dmp

Download

memory/572-251-0x00007FF671210000-0x00007FF67154E000-memory.dmp

Download

memory/572-228-0x0000023EB32D0000-0x0000023EB3336000-memory.dmp

Download

memory/572-226-0x0000023EB32D0000-0x0000023EB3336000-memory.dmp

Download

memory/572-227-0x00007FF671210000-0x00007FF67154E000-memory.dmp

Download

memory/696-93-0x00007FF72EB90000-0x00007FF72EC58000-memory.dmp

Download

memory/696-39-0x0000020BCD390000-0x0000020BCD3F6000-memory.dmp

Download

memory/696-35-0x00007FF72EB90000-0x00007FF72EC58000-memory.dmp

Download

memory/696-36-0x0000020BCD390000-0x0000020BCD3F6000-memory.dmp

Download

memory/696-38-0x0000020BCD390000-0x0000020BCD3F6000-memory.dmp

Download

memory/1340-28-0x000002135A070000-0x000002135A0D6000-memory.dmp

Download

memory/1340-26-0x00007FF72EB90000-0x00007FF72EC58000-memory.dmp

Download

memory/1340-27-0x000002135A070000-0x000002135A0D6000-memory.dmp

Download

memory/1340-29-0x000002135A070000-0x000002135A0D6000-memory.dmp

Download

memory/1340-62-0x00007FF72EB90000-0x00007FF72EC58000-memory.dmp

Download

memory/1348-264-0x0000016BE0CF0000-0x0000016BE0EBA000-memory.dmp

Download

memory/1496-164-0x000001CBF3FA0000-0x000001CBF4006000-memory.dmp

Download

memory/1496-216-0x00007FF6933C0000-0x00007FF693554000-memory.dmp

Download

memory/1496-165-0x000001CBF3FA0000-0x000001CBF4006000-memory.dmp

Download

memory/1496-169-0x00007FF6933C0000-0x00007FF693554000-memory.dmp

Download

memory/1624-51-0x00007FF658C10000-0x00007FF658D32000-memory.dmp

Download

memory/1624-17-0x000001E0A7170000-0x000001E0A71D6000-memory.dmp

Download

memory/1624-16-0x000001E0A7170000-0x000001E0A71D6000-memory.dmp

Download

memory/1624-15-0x00007FF658C10000-0x00007FF658D32000-memory.dmp

Download

memory/1624-19-0x000001E0A7170000-0x000001E0A71D6000-memory.dmp

Download

memory/2324-1-0x0000000002EB0000-0x0000000002F19000-memory.dmp

Download

memory/2324-6-0x0000000002EB0000-0x0000000002F19000-memory.dmp

Download

memory/2324-8-0x0000000002EB0000-0x0000000002F19000-memory.dmp

Download

memory/2324-0-0x0000000000360000-0x0000000000476000-memory.dmp

Download

memory/2324-37-0x0000000000360000-0x0000000000476000-memory.dmp

Download

memory/2336-148-0x0000028C40D70000-0x0000028C40DD6000-memory.dmp

Download

memory/2336-146-0x00007FF63AA90000-0x00007FF63AB43000-memory.dmp

Download

memory/2336-147-0x0000028C40D70000-0x0000028C40DD6000-memory.dmp

Download

memory/2336-202-0x00007FF63AA90000-0x00007FF63AB43000-memory.dmp

Download

memory/2980-204-0x0000029588630000-0x0000029588696000-memory.dmp

Download

memory/2980-203-0x0000029588630000-0x0000029588696000-memory.dmp

Download

memory/2980-208-0x00007FF63A310000-0x00007FF63A816000-memory.dmp

Download

memory/2980-246-0x00007FF63A310000-0x00007FF63A816000-memory.dmp

Download

memory/3032-176-0x000001D0E5930000-0x000001D0E5996000-memory.dmp

Download

memory/3032-173-0x000001D0E5930000-0x000001D0E5996000-memory.dmp

Download

memory/3032-174-0x00007FF7EE830000-0x00007FF7EEB50000-memory.dmp

Download

memory/3032-181-0x00007FF7EE830000-0x00007FF7EEB50000-memory.dmp

Download

memory/3032-179-0x000001D0E5930000-0x000001D0E5996000-memory.dmp

Download

memory/3124-126-0x0000018CC9B80000-0x0000018CC9BE6000-memory.dmp

Download

memory/3124-125-0x00007FF609090000-0x00007FF60913D000-memory.dmp

Download

memory/3124-127-0x0000018CC9B80000-0x0000018CC9BE6000-memory.dmp

Download

memory/3124-182-0x00007FF609090000-0x00007FF60913D000-memory.dmp

Download

memory/3164-156-0x000001E30F420000-0x000001E30F486000-memory.dmp

Download

memory/3164-161-0x00007FF705950000-0x00007FF705BF2000-memory.dmp

Download

memory/3164-157-0x000001E30F420000-0x000001E30F486000-memory.dmp

Download

memory/3164-211-0x00007FF705950000-0x00007FF705BF2000-memory.dmp

Download

memory/4408-243-0x00007FF77A250000-0x00007FF77A720000-memory.dmp

Download

memory/4408-195-0x0000029548A50000-0x0000029548AB6000-memory.dmp

Download

memory/4408-196-0x00007FF77A250000-0x00007FF77A720000-memory.dmp

Download

memory/4408-194-0x0000029548A50000-0x0000029548AB6000-memory.dmp

Download

memory/4644-217-0x00007FF793DA0000-0x00007FF793ECE000-memory.dmp

Download

memory/4644-218-0x0000022687490000-0x00000226874F6000-memory.dmp

Download

memory/4644-219-0x0000022687490000-0x00000226874F6000-memory.dmp

Download

memory/4644-249-0x00007FF793DA0000-0x00007FF793ECE000-memory.dmp

Download

memory/4928-111-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/4928-155-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4928-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4928-106-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/4956-96-0x00007FF709BF0000-0x00007FF709D39000-memory.dmp

Download

memory/4956-98-0x0000019D4C370000-0x0000019D4C3D6000-memory.dmp

Download

memory/4956-99-0x0000019D4C370000-0x0000019D4C3D6000-memory.dmp

Download

memory/4956-145-0x00007FF709BF0000-0x00007FF709D39000-memory.dmp

Download

memory/5316-185-0x0000016A61350000-0x0000016A613B6000-memory.dmp

Download

memory/5316-187-0x0000016A61350000-0x0000016A613B6000-memory.dmp

Download

memory/5316-186-0x00007FF625970000-0x00007FF625BFA000-memory.dmp

Download

memory/5316-239-0x00007FF625970000-0x00007FF625BFA000-memory.dmp

Download

memory/5496-77-0x000001DAD4800000-0x000001DAD4866000-memory.dmp

Download

memory/5496-134-0x00007FF6DF4C0000-0x00007FF6DF5D9000-memory.dmp

Download

memory/5496-75-0x00007FF6DF4C0000-0x00007FF6DF5D9000-memory.dmp

Download

memory/5496-76-0x000001DAD4800000-0x000001DAD4866000-memory.dmp

Download

memory/5552-46-0x000001A24FD70000-0x000001A24FDD6000-memory.dmp

Download

memory/5552-45-0x000001A24FBF0000-0x000001A24FC9F000-memory.dmp

Download

memory/5552-47-0x000001A24FD70000-0x000001A24FDD6000-memory.dmp

Download

memory/5808-89-0x000001FF09B00000-0x000001FF09B66000-memory.dmp

Download

memory/5808-87-0x000001FF09930000-0x000001FF099DF000-memory.dmp

Download

memory/5808-88-0x000001FF09B00000-0x000001FF09B66000-memory.dmp

Download

memory/5904-72-0x00007FF6527F0000-0x00007FF652957000-memory.dmp

Download

memory/5904-70-0x0000026B80E60000-0x0000026B80EC6000-memory.dmp

Download

memory/5904-63-0x00007FF6527F0000-0x00007FF652957000-memory.dmp

Download

memory/5904-64-0x0000026B80E60000-0x0000026B80EC6000-memory.dmp

Download

memory/5904-65-0x0000026B80E60000-0x0000026B80EC6000-memory.dmp

Download

memory/5968-137-0x0000020B1FBC0000-0x0000020B1FC26000-memory.dmp

Download

memory/5968-212-0x00007FF7029E0000-0x00007FF702DF6000-memory.dmp

Download

memory/5968-135-0x00007FF7029E0000-0x00007FF702DF6000-memory.dmp

Download

memory/5968-209-0x0000020B1FBC0000-0x0000020B1FC26000-memory.dmp

Download

memory/5968-136-0x0000020B1FBC0000-0x0000020B1FC26000-memory.dmp

Download

memory/5968-193-0x00007FF7029E0000-0x00007FF702DF6000-memory.dmp

Download

memory/6016-119-0x000002477A510000-0x000002477A576000-memory.dmp

Download

memory/6016-118-0x000002477A510000-0x000002477A576000-memory.dmp

Download

memory/6016-117-0x00007FF6DDD30000-0x00007FF6DE473000-memory.dmp

Download

memory/6016-252-0x000002477A510000-0x000002477A576000-memory.dmp

Download

memory/6016-254-0x00007FF6DDD30000-0x00007FF6DE473000-memory.dmp

Download

memory/6016-172-0x00007FF6DDD30000-0x00007FF6DE473000-memory.dmp

Download