9216a40e6f9c0acfc415d61d02fc574903ab90a4b32461f1f0149e70b7c15a1a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 725KB
Sample261002-p3esssshmf
SHA256 9216a40e6f9c0acfc415d61d02fc574903ab90a4b32461f1f0149e70b7c15a1a
MD5 6aa526d72984a6b2d7f271f1ca8afb29
SHA1 038f6834d16e815014cce63a7b284a1a6b9bac09
SHA512 cad8fedfe52a4cefbdf589e84aabd41373d7dd2f35726d3b7d8c8d1f17feeb928c45fa8f721209e7bb47b4c9a66af9c5ae831f839704daff103582c144985c85
SSDEEP 12288:Ov9PGxTszBAGubvoXmH3lfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:y5GtI/4VfJ4yL/tNCJPXUQrP0
TLSH
T138F4026231C0C0B3D97306340AB4E571963DFEB01F7956EBA7812B6A6EB46D24D38763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3164	alg.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4188	fxssvc.exe
3772	elevation_service.exe
3388	elevation_service.exe
3308	maintenanceservice.exe
4708	msdtc.exe
4276	OSE.EXE
3420	PerceptionSimulationService.exe
4164	perfhost.exe
3508	locator.exe
1668	SensorDataService.exe
2984	snmptrap.exe
3384	spectrum.exe
4916	ssh-agent.exe
5016	TieringEngineService.exe
3676	AgentService.exe
884	vds.exe
4816	vssvc.exe
2188	wbengine.exe
1236	WmiApSrv.exe
3816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b4c97925c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000010626bd6c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000749e9fbd6c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd0baabc6c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fabcbabc6c52dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006358d7bc6c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c5c99bc6c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a814f0bb6c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048eee8bb6c52dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4188	fxssvc.exe
Token: SeRestorePrivilege	5016	TieringEngineService.exe
Token: SeManageVolumePrivilege	5016	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3676	AgentService.exe
Token: SeBackupPrivilege	4816	vssvc.exe
Token: SeRestorePrivilege	4816	vssvc.exe
Token: SeAuditPrivilege	4816	vssvc.exe
Token: SeBackupPrivilege	2188	wbengine.exe
Token: SeRestorePrivilege	2188	wbengine.exe
Token: SeSecurityPrivilege	2188	wbengine.exe
Token: 33	3816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeDebugPrivilege	868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	868	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4780	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2752	3816	SearchIndexer.exe	115
PID 3816 wrote to memory of 1812	3816	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2220

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1668

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2984

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4008

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2752
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 89fc8f5cf1e5a520791cbc90f28ee6795ad60e955a4680d229384b4c8d61d25b
MD5 71831c020529929d0cf414d082fd52c2
SHA1 c68c4b485badffdd78f95c400dcda3188b560a9a
SHA512 882906e820feb7d233cb9b7827d40402abb3c4d8d1fc8d1e0a9e02019520d2912c09d0992439c59679ce9f4714063766bead0e85b2b6e9b8d37b7df02b634702
SSDEEP 49152:qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnUfJ4klKXns:c3q6mjBffJ4k
TLSH
T180D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4f99aa5560d99e47f09dcb068ac22c5cc0d74b1fa14d5ecf94787cdbf14b72a6
MD5 a2b138baefb002187bd7f8064f919583
SHA1 793bf74ab84fb5f8e3dcb25853ad1dbad58c9324
SHA512 3ad4f6ba39936dec16c2a73e2fb3e0a4b9752156c810c704138e7275d0335385fceb95354d4928e68b411b99fb195a49d516f1d0bbb9e584704b8c413b290f8d
SSDEEP 12288:A1XLsswWkxy2lRq2czADfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:WXYfDtczADfJ4yL/tNCJPXUQrPW
TLSH
T18F05F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 30cdb119ee2ed2486b61c5e85b526eaa9fc102bc76e5f4b31fae2c5cbd5235be
MD5 4542f3d85b6bb1a81ebe9669f232fb53
SHA1 23c495552a4d6cf9a175b37a4df4cb7ae912513b
SHA512 49ecd1c596fe43e93ab380cfca3c1053e5f3d8e357bc53ed96d4f3d057a2d38ecb6859916bca246a38383652f12bdf8af6066589425b8d7a4620663c78a1a567
SSDEEP 24576:+0Le5ji0hmxhrMcfJ4yL/tNCJPXUQrPt:+Pji0AzVfJ4klKXn1
TLSH
T17D35AE56F5748335D073C0B9C5D2A68AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 79b0fb67edd13564c6e915762336b874d0f8b71389affe70c84946f6fef618d8
MD5 92ef26e3032349f0dd1e70803c546a4f
SHA1 793fdbd55ac17ea6f2a4c7952fb1d30fbb82b4f2
SHA512 d4027399b557b55a70f08beacaa83546a3a8b381577ebc07919d2abaea278f9dcf716a2863c2f13a86efd0681a4c8380859ea33976f8f4ecec1c390bf7d8c079
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyuqfJ4yL/tNCJPXUQrPe:j/ezSC6vUzPv+Hjy5fJ4klKXnG
TLSH
T130756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e3d88a34fe1685a09b8eb18143a62ee8b3e76422952b6eee5c2d6312c82e5cbf
MD5 3bdbfca9e3bf1f2fd11541cb624f1436
SHA1 a5bf818f066ddf9d2831b24f59bc6c676a46e753
SHA512 78079f5315dc4bb619e907c579692c3220e4dd8d034cc5a6edbd79dc1b5af99073a040d4aa7d7919c290e22aef87f15e83285b502db81ac19615e84be8d69b1d
SSDEEP 24576:vVbqPb88hv/l+BPfJ4yL/tNCJPXUQrPm:vVO88hXl+1fJ4klKXne
TLSH
T152559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 03577da898e6e6d9fb9a6f8748cfa9b5438e9a9503fb8534036c9b7e9885bbd0
MD5 5e7efa9b501c398ec6ab657c130733d0
SHA1 b1068a3989d4a865f125b2b34fb3ed5305ff414d
SHA512 8f455cc8df6e789d1229e9b2c5557b04e6d68bef9bb45c43812fc154b3693e87158f7f01a072500b9e98b23b5981d6fcd0eedf20a33f96692413559c7a61ba29
SSDEEP 12288:XGofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:XGofJ4yL/tNCJPXUQrPb
TLSH
T172C423E75184A086DF6687F82A8CF001C704BEC5562FA2E7DE42B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3b3fbcafe5b5216f33d511355e270afdd9cf7ea00cc8caa8a862e826c48a01d4
MD5 f64ed27dca9ba600ffd14b0972f628d4
SHA1 78964448ff87dff5787ffce36192ec6ba664f029
SHA512 b754df69bbbf492ed5c73111b312d26438b328b881afcfdbbea5dd4283aff76c126eaf4270962900452922490c9d0a3808f7343c9dd2b24800c9adcfb7cb0d5d
SSDEEP 12288:weBNUbTVO86U3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:wJIU3fJ4yL/tNCJPXUQrP/
TLSH
T14105C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 60022d4c102dfc1e3af7616837c245da7dfab53a51dc973ba4c03670a34f2a3e
MD5 c1b01db464bf76bee61066581da5cea1
SHA1 4bde2e19a93edc0a01c962b8d74fa0a89cb857e5
SHA512 d87c2bd8cfe77079335ef55ac8520f0d5cbf134aca70512651df298d433890e0c821b1b0e0e793ad1aa19681401565408167eaea8b866fcd62c71da513e1d013
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THg:jQvGAdlCEL8c/WRNw5CafJ4k
TLSH
T104266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2e19a869116de40b6dc80fbcc2b45d956d0de385482245314550d46a65acdae1
MD5 6717e96a526c87cae5db37bc6c4290c8
SHA1 63519c1dd909b3e73db5b213667483b186edacf5
SHA512 263b4f9c6773111cf5fb333cbdfcc1965c250c2cb66b1f2934dc3beb2d2da98032fdf0f0c4aba812a8d4c502961738855d8ebed3ad351a12d81bc86f0d7ea375
SSDEEP 12288:3AwSfxL/2Dc3mDLLmt0LDQewsAjFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+:QfewsAjFfJ4yL/tNCJPXUQrPw
TLSH
T12915E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3d4816136e03835da2be78972cabb29fdb22aee9e1a7536e5363c42331f39353
MD5 5cec1cece526cf1fae37a995fc490276
SHA1 f13745235b6b7b5386d8d55f519851b0c069e7b1
SHA512 409afae0ac6c0a20e955c1cc07c039b5e50a30755b1b5737afdc16a4f65fe447807589999bc1ef3fbb0e89edae45ac3e0a450dd45da82153f8a1096f36252526
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHdfJ4:HUEtQevvqc2W1cpV20I32d
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 acc3e62d0de1623bfd3ddc07f301f27b22dd4b1dfafd8875c9774a948e2d0b86
MD5 990b6de8a30f0546f7698a171c9f68e3
SHA1 9ac4f2725aae0be2418d6cebbc440051e795231b
SHA512 4e2f2121b00c41345bff08e5136c75af4596466e862cc33a37ff6e645845d13542afb975c03291a364803c7b7a73562e0dc463f95b62652d94478ebf23c53efc
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zlfJ4klKXnO:HoqtVjnmefJ4k
TLSH
T15FD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 27159d2b795a5346095ef80161715e6d85391ad1ebbfe07bc9da1a1e0a14bec3
MD5 db59c921a47d45fdd3a176b2f35d772b
SHA1 8d7bc223169a7992ac0051c31299384b7b75b34d
SHA512 48ae1a78f78ddff4e5d5bebf6a96cc0b37e36ada594e13ba6fbdfffe473f313651f5ddd1e127139df0add4fe3734d8443fe1072ca22bb8fd210fc097f028cea3
SSDEEP 24576:EAhGL6IFoiwtA5l7S53+fJ4yL/tNCJPXUQrPa:EAM5Foiq5OfJ4klKXnC
TLSH
T1ED359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1961bd7fef9f463a38f95abc6fb5b8e57b7a329bb561b49922deca2cf0233121
MD5 f475724f84c4ffa667e1af852742433b
SHA1 9632d0ae7bf757d64b7dd8d26a7d93dc4a0c6def
SHA512 b83f4399aba2649a2055c12ca7c03f6ba0b37708f97c8d305e5d8c76c63956d90110b5261d16c391497c7ccc2fb963425459ec38d0d18dca4d79eedf23b0af96
SSDEEP 12288:Imw5HEjsChNEBFgl0WDm+CKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTs:lwuROWZfJ4yL/tNCJPXUQrPg
TLSH
T11E05014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6f17b9ac999fa3cb3f1c9380aa36f78181566fbebbbc142d503a8bb7368da73f
MD5 d59ff10352bddc3af0ec697e308401e2
SHA1 16c07c633493afa1484a17892c9ea1de6b4e7926
SHA512 7bf88916a0d04e703d1a32722b9b5542e55e71a287bf75d411daebcc40335a0290664634515be43a01bdab563e162292c690faa642eb1aba96351f564323745c
SSDEEP 12288:oyZ1Iy1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:9ZuEfJ4yL/tNCJPXUQrPb
TLSH
T136E4129B32D460F9DAA782BC8AD4D101D33178D2273A43CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 801d21eae47207fafa12849ebd2e597f371e84f3a0c32d82ea01919bf59e86ba
MD5 8b71bde26685aad48555ca402e1c3710
SHA1 f4640e5bb14ce13a58417e5247849de6b863c4f1
SHA512 d466e48cc4c9d07c16b5fd3568cbd33f93a2dd311c2ca6eef5d4a638083ce61fee67d3b5a51815f5e8ee4813919d09b03c177a9e7bbfabf5a4bd75f8d73d30bb
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UL:NQRQyi36YOcPDLvw2gAf+PN3LfJ4k
TLSH
T178667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f20caa242ff25ee3c56ebd6f712de0ccf12543a6a155c9f3ec057da6cb0fc74b
MD5 2300ec3b8e84af0bb0552e02141a1ce0
SHA1 5e153e8b8673895a691af75d14e59635e189632a
SHA512 847bf1bcabb969c73cddf21cd9147bfa025e90efec695da3f70ebe77057766da1fe980db48f443ca02a5b06ed3cd33e7b9cf20b461681f1758db555c163c82d5
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UO:9QRQyi36YOcPDLvw2gAf+PN3LfJ4k
TLSH
T164667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4b183836676020cd8065c71f29c2b2f9148c8aee43c590a6cdade34f6f113951
MD5 2ad30e5617b5788b9ca8664b81ac4a21
SHA1 ff5b1e749137fced77be5392ad08e8e1554b88ff
SHA512 102bdef2a85772920410596278350bb1f8890976d2d7d2d6c1bc2377c4c2921a2e52406a08d6c603088cadf42f59ee07cb461d1fd074fba4174491148492490e
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0UfJ4yL/tNCJPXUn:L68Qg55nhkeWu7PNU3/VfJ4klKXnY
TLSH
T1B8B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 78bee49f83312a886b13bd225cb29995da0b2025d161568c8d8d2948eb5768a4
MD5 0caa58e66af44351808fbb488a6789f5
SHA1 4c25cd5b66da31dc1aebe85240ba97c96f56a3a1
SHA512 34898cc711fbffde6f95978e69f4a6537254ce06ab86f2acc480f81dd63f664303bf966765ac3874efade8be7703ca37edc7be4f5f67d94ba557e67945a40067
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99C:Ky5112gYy5azzVvU69nLKnhZofJ4k
TLSH
T16C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0023c31824c1a9c6590945d05a5cb1ad95ec18f08861b6cbcdbba929975ade9a
MD5 0fa8e93d434e8094a4a2ed03f5f40662
SHA1 530fdb8e6d0bfeda588dccd581ee8eb73d0855ee
SHA512 476a3332234f3f595b94c54d35a69a217b7b4b813f9602d1e8d32ba62a37f5649cb9b90e32b974b9a6e98a29fadbf2cf02fb19fa1920f5756ae6a27e48d26344
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glTfJ4klKXnP:Qu6JmIxd2dTfJ4k
TLSH
T114D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0aecf3405d6aa578fe7fe18f4b52edb2d2340ce842db2d24bf7aef0d144168c0
MD5 e1f4a72369185258a1f35281be29f048
SHA1 d4cb84321ffd11f3009874925cf8ac1506d7489d
SHA512 f2caa7f3c48a1b4ba793d35d4faa7db15481cb2f986c6ddb39c5a5e4caaadcfefa144fb2c2500d2fcf5d4af2155ea96b1ab8046fe3036289919b3a3026f27dcb
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4xXfJ4klKXnS:GmifPqRefJ4k
TLSH
T103B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c1d5340b8cf74f193c5a07413686e5cf9c6f45603c463b5783f85597e689acd3
MD5 0c84c8e78d3b9d74575ce289edd0af08
SHA1 81efcd5f6f0c758b99c1654de9600d8861c4a47c
SHA512 21b69f1008195eb6e4db0ebbb44381c52a8eeb470e77e3229e774f535f9d77c2137d5de3862244843a4f7e67556b99d30b0cd3363a3251baca528e44ef0c7c0e
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqEfJ4klKXnP:p5dKqi61EfJ4k
TLSH
T100C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 73f9eef6b54cad3f1809fedaa4f5c9087b7f9f6d08094e20e24722552217a699
MD5 53c40c466f8483c855ab7a79c1b4c29b
SHA1 6a7e1ce24fa2430538096a0aa05169d3c2a6adcd
SHA512 444713d51f8e22230e2f9357e50acbef2aa268755dee8750ab9a7dbf04b65e308ad1e3a54cfd141140f067663dc661bd515b95062218e2736e6d4ec65abc0bc7
SSDEEP 49152:AhtSn8EApI0figjgiDn0AP5wDfJ4klKXnu:RX2iWphyfJ4k
TLSH
T1BB95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a0ab6c2ae02da0acebb75253abf65ed9150075821546917982cab085712acb1f
MD5 b9e5f31e6b49b37462e3f929e0779f82
SHA1 01f8cab52821ac5636597bcbe3f94491cbd05a31
SHA512 149d76495b7e223c664965677836e23e55c063e4f7823662918ede8b976589934289ccf18196187b5186ea393d411b21567f74068ea8c3a7d478eca3f4469778
SSDEEP 12288:rwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:rwfJ4yL/tNCJPXUQrPj
TLSH
T195C423AB60D5948ADE5587F81A88F001C3087EC6672F62F7EF42B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fee8ff11a5522043a23c5353568c05c16fb87ce56b192f65df189b664897f98b
MD5 09689aacb68f82cb8988124d46165287
SHA1 54d9637ecf181a1218acbde4148c3037220ab49d
SHA512 9f5f9ef2b70cfef0f66b88cde68079d97e4379af0476181e65c7ebc951ffbb68027ffcb9874e4d845902121e8b986ff7d151b65248a9a5ff29ebdc76e0da8482
SSDEEP 12288:xRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:xRfJ4yL/tNCJPXUQrPp
TLSH
T1C3C423AB60959486DE1587F81788E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 aa59783721ce27e48835ea69821308733d8d15e45c859aecc46c368760d09f77
MD5 c50c7a22292cbc5696ffe29a4e8d8adf
SHA1 d22e39f8d388d9c91026bb99b8f5622659c5ea79
SHA512 f869f290a7380dfb5be8f932658c6ffc47d8830015968e35e7f459d584d73ee26177ff646a77ea28f3fddfb4ff7f451725f0a5a741f78b96d08ccd1cbb0ca000
SSDEEP 12288:OffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:OffJ4yL/tNCJPXUQrPp
TLSH
T1FCC423EB6095948ADE5587F81788E000C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3ce96d77b22ced6766e1b52fa72bffefa09cfece1311162028a3905b773873fe
MD5 40a4354cae35e3e72cd5cdcf68086717
SHA1 075ce1f50d51b3ec24b437bf3abaf7ee23354cf6
SHA512 5bd4c0bb7077585df1f80efda1f83feb3ea0678502f3b0df1aa4c350b4622b515280a639a09b36b02e269830303f1b936464b7d0d203d311f7f7952c62758232
SSDEEP 12288:mVefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:NfJ4yL/tNCJPXUQrPd
TLSH
T14BD42397219490C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1b725d55d541bca6691821643d7b66293a15a831f1736639f740f1128b8271b7
MD5 f4b22fd6a2a852bd4aeda6465fef6200
SHA1 f8295c9afa408d43e1401eaece345478ae63bad6
SHA512 48aea5d2bde4c5af79cd999da1894a44e5141fd2a8ceee560df3ad0d71e02da4833d2881f3c70c6c4fa86564328a479b683c97a77ff271d657dfb809b13b7282
SSDEEP 12288:sWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:sWfJ4yL/tNCJPXUQrPm
TLSH
T1FDC423AB60D5948ADE1587F81B88E001C7047EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9c60666e95fd23d5a931b7bab5d06c38dbc3c67c23e267e5675ed17ad292f510
MD5 752756d550d0a81a86e4b37edbdd5219
SHA1 96b52d56d274f6bd5c51938e8ff684084c570aca
SHA512 498aaf9f767b216e646e96264435d0dce97642c7457a237b08db1d09c38858cc61f23501bd14079295a3b7f21ea6d12ee1e595a34d5968f89691d1f4fcf2cc00
SSDEEP 12288:rNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:rNfJ4yL/tNCJPXUQrPr
TLSH
T1C0C423AB60D59486DE1587F81B88E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 93e081ffb6b68deab82a02eb0311a34ae65e1c195d452083f615b5db9c8bc011
MD5 1450bf0361431170fd423b0023df83d4
SHA1 2f7329ae495cdf4d6a6cd375c29ea192b2fe8b48
SHA512 7832865174d303336241bf64d4ec3ee29a33aeba1a580c3a1ddcdcb85c0642fc0add276f0f8babd099a1c15d6ad9ae4f12dada95308b6c4ab15b9441642be55c
SSDEEP 12288:5pfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:5pfJ4yL/tNCJPXUQrPz
TLSH
T112C423AB60D5948ADE5587F81748E000C7047EC6672F62F7EF42B8817FFD91A259C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ffc85c265dc57f7260170af2c207c2a22e44b6225145e3307068d723634f5a18
MD5 15e5e32f68e07665834f8008bbbf521d
SHA1 3280737398344933f99cb6c06e1d574397f0cb67
SHA512 0b736437515848ea43099276aa89129dcbb153d5d4552479d548af43cea3799bb2b17992cc669e45f7a04bd5cd135c8c353277f7c9a4bcd822a758cecffe5721
SSDEEP 12288:fiZwbDzzFEoS2cPvyxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:6ZM3zFVSOxfJ4yL/tNCJPXUQrPX
TLSH
T1490501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 82a52c111239c0f058070b25712ef79d3f5409f03249aa01b31e9933a45467ce
MD5 bf2f317b790632e97c8dd59d6c11d334
SHA1 7b6ccc0756d01bc4da970d6e3b3e50d0d78a86ba
SHA512 7f392ae2e5d35a219186ba0eb24f45db5bf1f87210e58494ed32753b6eac9a4da468d8dc9415462c6708608dbf12d45a3dde3e4dba7c9a4d3af974a1932af1c6
SSDEEP 12288:J0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:J0fJ4yL/tNCJPXUQrPy
TLSH
T15DC423EB6095948ADE5587F81748E000C7087EC6772F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c5bcceaf622c765b2c447d5ac2ef725e548192b8ab1a192dddfdf5b554a746ac
MD5 63786912c3f50545216757978bcd1057
SHA1 c53bba9eacc0b805232d2f743f8435386e8a7074
SHA512 8ce056f3c669e9da998b04c7912416506b450cb8500c607186edbfd655003c4fd1c0e3883669ba65fa2fd77ae211535ea56651c37664b03198047b14f48b3790
SSDEEP 12288:/YfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:/YfJ4yL/tNCJPXUQrPy
TLSH
T17BC423AB60959486DE1587F81788E001C7087EC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a06ac43a9e1984a4fe59968a34e9124a4b15af70514cf05ae7fca76a633ff017
MD5 fad51094b70bd758b190dfec55e7b292
SHA1 d763a2e1615141dd1a3aeb2115d4dbd7e2b66edc
SHA512 74eb00ddbe516ea969ce783be4ebdcf0c03adf48db06823d56daa1a4b2f6bd851df1936a256c3b77d2608f6e7d9f0e4c7f09b9c6166c311a6d5f5fdbddf064e6
SSDEEP 12288:ZyPz5L81fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:Yzy1fJ4yL/tNCJPXUQrPj
TLSH
T115F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 440a65ff390e97b7d9088812602d3fa51ad4116ab27cc74ff9bcf0f58246b0a3
MD5 d790ca1ae682e0a6dad3fd04428d504a
SHA1 681067256a66e3579c490caff356128fc5a14a9b
SHA512 531f725e3dcff4ba44ca9fd8a861034600b533405f20e8b5449f9ffa2ca9d3110469ccf45f3341b0cfb29638f62738e0fb11961b601745c0faa45a68fe130e59
SSDEEP 12288:p0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:p0fJ4yL/tNCJPXUQrPr
TLSH
T111C423EB6095948ADE5587F81748E000C7087EC6672F62E7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f04ddca62b3af2ede2461d2de9d1e744aca5bdee1446473978465c31b53380f5
MD5 a8cbee2319b1356561d7918be7f3930a
SHA1 b0bdd1f481d8fefba3929e12e2335a709864d814
SHA512 f843183394dbab972261f362f65616be22563e118c3c54ca86daa7784c099a1b687a2fe2aa8c3401b643df9f0f24e3fb67252656cdc01b4f2742c5c0a44e2b4d
SSDEEP 12288:B0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:B0fJ4yL/tNCJPXUQrPr
TLSH
T1A6C423EB6095948ADE5587F81B48E000C7087EC6672F62E7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e457c95e7f8d5b09f75c97ad06f56fc64e13d8f90d8a8db7f296adec6484d743
MD5 ae4c8e105da7e46fd0a5f4188c7dd4a9
SHA1 6b70286ceb4ff8f7cb9efb2f0e379b8fbf70d646
SHA512 5ed64cba32cb49ef72cc6528c203f655d585d0e4ebf555bf84f641b0466105cffbb90c2e6d2619e6e84130af4ef3ce0ed1ecd9d623f063f713a649c7b052dfbf
SSDEEP 12288:ByPz5L81fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:Qzy1fJ4yL/tNCJPXUQrPS
TLSH
T173F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 892024bb053d37299f7cdc5e313d950c30932be1ce7d7c430b955a421dd80519
MD5 a58cabab5b11f9b6763fc703d21afa2d
SHA1 61edb8bcaa0f663c44401b83c2037202bb9ecdb5
SHA512 cedc6cbef1bf3861484be64555efae7e5af4e10b5530c4d85073f141f00273baa3aa10089e4e9865c2f0057c4b7040de066d82be815e49f81719165939a779d7
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBsfJ4yL/tNCJPXUQrPp:AP4m4IpOO67W8KafJ4klKXnB
TLSH
T1CC65AE2DA7DC0096D0BB917886658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d5778f8380f5caa4cddd20deb3e1f7cbd55971d5773ba6f21ce83c33db58ae4b
MD5 e821822dc24cf8f296f2107701f6f0c8
SHA1 b0d67d25f5c9ac7391ebe2c340bdda7434712f45
SHA512 8348bc78129b6d628af25518172b7dab616170df43e5f3efca1fa7d4d1b2fda2ac028c02b8bf96aedf3b03e77588b616cfbc66f5d22f4854936e235e6d8c1353
SSDEEP 12288:mpsfEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:vEfJ4yL/tNCJPXUQrPz
TLSH
T134E4015AD29841D8C46E92B8CB449200F3237CA593E2D3CB97C0F47E2FBA6945DE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 248f2ee6afacec25824779fbec29bd91c66334dc52de3e9f4e65d59fae6344dc
MD5 d21fd85dcb946646797c563f12e4da83
SHA1 077f2a468617ae0f7daae3244f98899ed2a40abb
SHA512 56fe39dcfc604c4b4d56c6a0007342091246e8a501707ad1723c01a504ec43c9cde73cf80453410de7425d5faa2bb48348704af7b514c7d18dbadaf742e7dcea
SSDEEP 12288:LkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:LkfJ4yL/tNCJPXUQrP6
TLSH
T1A9D423A761D8D446EE7687F81648E00093097ED56F2BA2E7EE42B4853FFC9161D6C323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8ac54d26f1cba86f8df98391a5a581d36989e4c951863c12cf5f643b48d42cbe
MD5 76625a84c05c325de3a12d4374db0bee
SHA1 d4e7601598696cb9c8af3819474bf1b3cc37ed34
SHA512 39c152f34d872e9588de4dc216a61478b2bf2af766b56ed3bc5dcac363ab37b8ef40a480d6fef4fd075547fd8f262c29f0047a46454929f4ef8f9d6db0f3113d
SSDEEP 49152:aa0h2GEkuAe73q3pp46zwwQWfJ4klKXnb:aa0hNYG4JwdfJ4k
TLSH
T133859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 8bfdf7fe6d354d8a7cd3d221b609ef8e6f1ec2fc410a614d87d207e4c4033d0f
MD5 29f26a37bb82dbefd225d4423d49cd6a
SHA1 563af05124511136b6bdeea2548c948c2144caf0
SHA512 732d0169df7e074f890cd31aba8227b1c5cf3a130b8843ed2de891e12b534d66823655ba6544e41e23c3ff47ea2639481d959d0b619ef8837a2dc2be8d3f9a14
SSDEEP 12288:FhbHjfXhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:FhbHjPhfJ4yL/tNCJPXUQrP6
TLSH
T18DE402BE22AC20D9E571D2BC5684D106C331BC951726A3EF67C2817A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3740166cba018235b6560f77a46bac9a7d559b8433551b31bd8e6568b2e0c07b
MD5 dbda2f3a4e32a1bc113b4e2d7d92b682
SHA1 d79f228c421eb06894b5a6c20156884bac6afb1a
SHA512 ae5361179b4d56cf8321b4b7acac00e9ad3d9860fd2e0f96d81df5db19ebc4994b7f1a472fb6458129de65da054a4e49bfabfdb8c62b394ba00e48d2281fa2a8
SSDEEP 24576:93YgnJcRTk4yti+R5dBR/ZfJ4yL/tNCJPXUQrPX:9IgnaTk46pBR/ZfJ4klKXn/
TLSH
T19245B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 6a0cce9023fef6a00560a13cfbc642f05c313e99ab88f027767642cd352c27a7
MD5 5ae944a3951890c58d2747e8774b4ad5
SHA1 207850fd87916b8f9c7513d3555ea92e2f835732
SHA512 f2f13569328bf5d4267be67dded5c9052e2c3f1e499b2131f7d6570793a0eba8674f83a4ad2872f32dc2e2a7c61ba50280612c59c035f9b5db9b0b1f87d865e0
SSDEEP 12288:nIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:nIfJ4yL/tNCJPXUQrPA
TLSH
T175C423EB6084948ADE6587F81A48E001D3047FC5272F62E7ED82B4857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 c91d25898f7a4ce7f44e08ee96a4388d106d081e5909abebe4c7f5df5df8a1a1
MD5 bb9bd59562bd27b39a497a3a364db4bc
SHA1 a9599ca0869ef3b35346dfc7e0070e0eec381ca5
SHA512 50fce9033b3270746a8e17b629f8ab69905b081a657cc40579bd7dad5118fb7e03ec7ae2ab2af815ce48aee50bc572eaed6697c297bbbfa52a9a47efe3ea97be
SSDEEP 12288:tObIA4LWOsvAYFTDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:KAL3UTDfJ4yL/tNCJPXUQrPg
TLSH
T14825F155F69400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 8134d1a43e49a0a3adc0254611c11fc6b798bf83f0b9a58c4d2ee8ba85736d2d
MD5 b67d1bef69c36616e75b5c5210abdc4d
SHA1 84859f0847731694de38098dc143f130468356f4
SHA512 e24423dac1f715ac0109059fb8fa4f487396fabc176dd25d8b37070b3b177bdee351244f5ee2e5ecbe60ce2648fefa47841f3e18c5a1675a9185246cbc64e507
SSDEEP 12288:VpFtvOXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:rOXfJ4yL/tNCJPXUQrPx
TLSH
T121E4026A32EC10E5D576927C4A85D209D331BCA6172653EF46C080AE2FF7EE86C3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c22599994bcf6fba4e353beb2efb99e7260d102eaf190ed379417391fa336e81
MD5 75283b8642f34c4b27ecd3312b929e61
SHA1 8f52ee41bf9632d4bd62ffba7c29f1bd0f0f1397
SHA512 9c60ece454f0888adccf73e0634b9c6cfa0067ef160cfa2eb806fb1417c4e4002b4c2962bf1aa20699a74482f92317ced5a523629e529b044fcecda97d811b3c
SSDEEP 24576:h7NM9YqZqmWMUkPjZM48Mv6bEhs0fJ4yL/tNCJPXUQrPV:h7cBWMpPjN8DbEhBfJ4klKXnN
TLSH
T10D65AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a4995aff3ab7eebfb2c26321046e453843244763402e32621481461675e4d7ad
MD5 f7c854e9e068ad5236ab7a2947337335
SHA1 60436ff7a41e327fc485f1f9d18d5386d526f14d
SHA512 90c2e9e8206f10ca2e4b9565132aa6e971fdc42be5554919e98ef0c69e95175ca3003225cbae6b8fbd8ba3c4ac227f7270e3e2f5dcb63a28eb864578b9b6ddaa
SSDEEP 24576:qW6BApg2YuyuNDYTabvcdvNYf8km1CfJ4yL/tNCJPXUQrPf:qF2YuHNETovAvNYf8kmUfJ4klKXnX
TLSH
T1D4858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1fc6748f205ec5ed8a941525fc230e51488cdcffe5789659cba3d6f720ec0b42
MD5 87ff767162b09da5c7733d1ab3b3e3ff
SHA1 2340366d792b57e8b253181ebb4a0a8866115ed1
SHA512 f25e90070e73b2ab9d0b83b1ca0d433b4849a04f0db7b7e5b0eecd5774d73baac272814c711af44b4997ba5f850a97cc20381b8a66d84d93f12b3d81cee8c4d5
SSDEEP 24576:+AFs06+Omlf8NXEbTorfJ4yL/tNCJPXUQrPk:3Fs060loXu2fJ4klKXn8
TLSH
T14965AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 171725e9d233f3b4c0afe6e3162fcdfd0c24f421e4c64fd6ab2652f5a5722707
MD5 48b8bda3807047a73952f5a38c97a9e4
SHA1 b13d6bd5993059fa8e0e9ecb348631a6b4525993
SHA512 e640a6ac7e44862688baecd9c9f21c549011c81bbb544d49d29bcad0052ce1857c6d0fd42ebb8ebed0caf7879e8d521e63c5c499ea8eac128306edcfbb128eab
SSDEEP 12288:3CJnJ5D3VkrDzxUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:SJnJ5D3WX2fJ4yL/tNCJPXUQrPN
TLSH
T11015D02DD2A810E8D4B7C3B482496746FF72386D2F266AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1ff5f9e53f25f4c8e57acef776d3795d113ccd734de2d4ebeca3829688f703ef
MD5 10f1c995e34c389f3464aba5e40da459
SHA1 287b20f71bd7b6cf92a8d2eaec3e769de3e41559
SHA512 d59c8fadd86c6830bf710336b6e91c629f96df08605d29def79906f11690de90469d0a3f086a8209b8a14b5b7a01c41bab7483fd0ca24bf65d73a6742bc361a2
SSDEEP 24576:DEPghm6/7IIXdwcXrif7qQncjlP65i3VuZfJ4yL/tNCJPXUQrPy:kg06DIKdwc+eQnSt65aVwfJ4klKXnK
TLSH
T16E955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 e85d2567b7971de34a091aa839608d3d2b509f5d50bb9478725c011560d33e1a
MD5 434a242628a9cf502fab200bd50c92e0
SHA1 2aae155e53fa8d3a43d5ffb09954426ab6081102
SHA512 f961d5cb4e3229005406f1e4c9d5d4d088bb898d27c631bfbebccdfe809d34da12c1a131c401900cbfba2de790935f96fa67b9f811da838f6977c88dc0d646b3
SSDEEP 12288:3EP3RnKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:8nKfJ4yL/tNCJPXUQrPi
TLSH
T178E412AE269CB0D9D526917C4680C101C331F4A12B2723EF5AD1D17E5FBBAEA2D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 63a7a147032eabd69b668b23b56dd72a4aea4b9c6cdbae52a531800cb6f13701
MD5 9328917ce9691c13f8f329ded1cd6f7f
SHA1 f099f8a24f8817a4a3a12d432497b8a7271efc6e
SHA512 879972e268c41a0295f368071d6ecca551df76ceed555089fac3bf6b6e3de3cf7e4592a9070939b556bbb612bd2be17486c889f2b745b14d10f84bb640e460a3
SSDEEP 12288:pjkyRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:pIyRfJ4yL/tNCJPXUQrPd
TLSH
T178F4224A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 de1485a3a9d8615dde6617ade1b7a9eb1728a4b2fe152b0e60416f5b4ab6de92
MD5 404ade2e00c8dc7e0cc12134021db5d7
SHA1 05f0717b0fe163f42b06eedefe89a42fe0e3e9ac
SHA512 580ae428fb690ba3c554c0f6cd5f80a14b71a8c25cf17c3c338444b4b73950d5b1e8a854f59b10c9d7d17c87c6c22667fe6a19dcebe5d2368fe8474feffa2116
SSDEEP 12288:wyHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:NHfJ4yL/tNCJPXUQrPN
TLSH
T1F6D423AF2194A08ADE2687F81648E000C3147ED52B2B62FB9DC2F4A17FFD996157C791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6f9612a18f9e1f26807fb3d6f92821d04afabb2b1b17e990f613197ea713d45f
MD5 ccff43c0a1e523608430bea7aa44c477
SHA1 d47fd1cddb4e15a1d71a304bceb14400a889b581
SHA512 1b232765464b5bbc9f773892f881d3c86ace85807dc964b1d6127c492ecd28e84b0b7ac0a8076ca74db6df01a1b9dae19c8c5f530abb1169c114bdec5a91c97e
SSDEEP 24576:ZQ9MxZKdcz9dw38fJ4yL/tNCJPXUQrP+:ZVKZ8fJ4klKXnW
TLSH
T19B558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 a513d76d82f53725b51f4fae4a7c60b04682cc8aa534941098ca64f753ca344b
MD5 a9b827d961f1619ec8814c7f50616797
SHA1 163a51785f173a3cd3af8b934bbf920d32df2068
SHA512 af489d0e35667e79b8fb86c398b3e75c0f34477c18906e671567c71ced4489d3aba78e1a276410593eb0b061b96e49bab6c8d468b44070990660db39a7a8115c
SSDEEP 12288:SyoKo2JRple9pFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:SyocDApFfJ4yL/tNCJPXUQrPI
TLSH
T1B1F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 db333bae18973d71ac4488722adee23b88b1ff7beb6f65cc82decca30b6389a7
MD5 0dc2bb372ecd6c3a0b3ee0a6541db536
SHA1 ae50df3b03c984d91593af900bda44fe7c235a75
SHA512 530dfa8bb04c76ac7f4daa26dccfc25e909243c7db54531753f92a616e4e3b1e96b7f0be49c10557bb334427c26ca53fa0a156aeb1d89b33d9d3e1e590e0608e
SSDEEP 49152:XWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKFfJ4klKXns:P0zuNIDfJ4k
TLSH
T154A57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a225d3fbbeebe36a3c54d4ba178ada90039115e060b77a44f69fd4f0c66d9a65
MD5 0816ee68ae3675ead9fef878c1649952
SHA1 b0149187a0812d35ebe7cfe13de7f42c25ba5ba9
SHA512 371ae661b463f7b00bd36d75e2aa4ac5624037f5e3b0ae5c6c5d4b249b7e31e0910b9a0fad305e315a021cb42736793357767a33e6fdf8bb9f363f3f7d1e488b
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYzjMqbKfJ4yL/tNCJPXUQrPe:1TDxR+N5YzTBjM3fJ4klKXnW
TLSH
T19955B02EA7F855E9D17E86789A23C502FB727851033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 e70a1afa7a7c7e64aad55e96acca888bfc684603cca15daab6c5ad5a3d00fb61
MD5 6e699095c6e18b9f4baa368f1f1fb95f
SHA1 46e825bd1d6fbf2aa7d96d02c976b51cf82803fc
SHA512 05ee06ac0bd2ac43ccc2076a37e53df7dbd4d0cd878213a6c3bececf4e55236448a0b49ce9a293a88f877e50a15281109986918175bf2851cb090c59814e31b0
SSDEEP 24576:STMdOz0FFS+UmSLefJ4yL/tNCJPXUQrPG:+0K+UmSLefJ4klKXnu
TLSH
T14315E17E63AD14E5E57BC27C9642D906E67238A6032266DB06D0C0793F9BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 c68dbdf142937beb9a06e5b2dbf9204788ff81b82cef2a5e2ea4379ba25399bb
MD5 2a33786ccf97f41b22b2d51f2bbfd4e1
SHA1 4640b6d9f4b0e3c28b237acf1dfa4e299975c39d
SHA512 50e5254d2a40f30981d7f4398ea45e18235563a6b5185f8e3dce304d444642a19984e66621bb785ef3f92c3b864fbeab250ef24cce0a10d47d295141c08479cf
SSDEEP 12288:U4KDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:yDfJ4yL/tNCJPXUQrP5
TLSH
T1D0D4125E23D870D5E87293B84B54D101C330BCA6272A62FF39C1D87A6FBAAD5593C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/868-1-0x0000000002100000-0x0000000002167000-memory.dmp

Download

memory/868-8-0x0000000002100000-0x0000000002167000-memory.dmp

Download

memory/868-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/884-362-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/884-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1236-366-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1236-169-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1668-114-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1668-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1668-168-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1812-380-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-395-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-384-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-383-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-382-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-381-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-385-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-386-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-379-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-387-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-388-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-389-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-390-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-391-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-392-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-378-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-377-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-393-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-399-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-398-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-394-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-400-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-396-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-397-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-416-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-415-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-414-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-413-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-412-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-411-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-410-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-409-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-408-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-407-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-406-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-405-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-404-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-403-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-402-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/1812-401-0x0000021778250000-0x0000021778260000-memory.dmp

Download

memory/2188-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2188-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2984-119-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2984-172-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3164-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3164-89-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3308-63-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3308-61-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3308-55-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3308-66-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3308-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3384-271-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3384-131-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3384-129-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3388-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3388-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3388-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3388-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3420-155-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3420-91-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3420-97-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3420-90-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3508-163-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3508-111-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3676-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3676-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3772-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3772-38-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3772-32-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3772-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3816-214-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3816-371-0x000000000CF30000-0x000000000CF38000-memory.dmp

Download

memory/3816-182-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3816-198-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3816-367-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3816-376-0x000000000D3E0000-0x000000000D3E8000-memory.dmp

Download

memory/3816-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3816-375-0x000000000D3E0000-0x000000000D3E8000-memory.dmp

Download

memory/4164-108-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4164-101-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/4164-159-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4164-106-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/4188-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4188-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4276-81-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4276-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4276-75-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4276-150-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4708-71-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4708-146-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4780-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4780-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4780-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4816-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4816-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4916-331-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4916-134-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4916-142-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4916-136-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5016-347-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5016-147-0x0000000140000000-0x00000001400E2000-memory.dmp

Download