Analysis
- max time kernel
70s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 745KB
- Sample260708-e1m2aaax9y
- SHA256 0ddf36d8cf1a16ab055a2976f5ec60b8ad4cc1bb047803e94c4935965d2a5d3f
- MD5 8e27ef340b5964e8202b012dd43cf489
- SHA1 b26ce94a98ca181114fcbe66f11106648dc66ac8
- SHA512 ee20749cb3e6c0285cc9e785c8807843ed4dc326c8a23d1c87f3184361a7b5ecd7b1f12f7ae76ef6991029c378c97b853c69ed115ce24cd59f48272c3844993b
- SSDEEP 12288:r93G6vHzOASubviBNDYa3srY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8Lqsu:rVGGTWBZUUpOdR36PkQnOcsxH8Ll4/05
- TLSH T112F4125176C1C0B3E673043089B48A61297DFEB00F558A9F63952B6E6EB03C25E39B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 22 IoCs
pid Process 4752 alg.exe 5888 GameInputSvc.exe 4136 GameInputSvc.exe 1648 elevation_service.exe 1320 elevation_service.exe 3168 maintenanceservice.exe 1932 msdtc.exe 3236 OSE.EXE 3676 PerceptionSimulationService.exe 6056 perfhost.exe 2400 ReFsDedupSvc.exe 1072 locator.exe 2292 SensorDataService.exe 936 snmptrap.exe 2656 ssh-agent.exe 1776 TieringEngineService.exe 3612 AgentService.exe 5080 vds.exe 1844 vssvc.exe 4564 wbengine.exe 4260 WmiApSrv.exe 4904 SearchIndexer.exe - Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe - Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1220a488ce3e03f1.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bab3d4c7910edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a600dec5910edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e27e10c5910edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{BB9590F7-E471-4287-B131-21BB97EBC700} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{456BA90B-70AB-4EED-B276-A8433877E196} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4136 GameInputSvc.exe 4136 GameInputSvc.exe 4156 explorer.exe 4156 explorer.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3736 2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeTcbPrivilege 5888 GameInputSvc.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeShutdownPrivilege 4156 explorer.exe Token: SeCreatePagefilePrivilege 4156 explorer.exe Token: SeBackupPrivilege 2400 ReFsDedupSvc.exe Token: SeRestorePrivilege 2400 ReFsDedupSvc.exe Token: SeBackupPrivilege 2400 ReFsDedupSvc.exe Token: SeRestorePrivilege 2400 ReFsDedupSvc.exe Token: SeBackupPrivilege 2400 ReFsDedupSvc.exe Token: SeRestorePrivilege 2400 ReFsDedupSvc.exe Token: SeBackupPrivilege 2400 ReFsDedupSvc.exe Token: SeRestorePrivilege 2400 ReFsDedupSvc.exe Token: SeBackupPrivilege 2400 ReFsDedupSvc.exe Token: SeRestorePrivilege 2400 ReFsDedupSvc.exe Token: SeRestorePrivilege 1776 TieringEngineService.exe Token: SeManageVolumePrivilege 1776 TieringEngineService.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2356 sihost.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe 4156 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2612 SearchHost.exe 1532 StartMenuExperienceHost.exe 4156 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5888 wrote to memory of 4136 5888 GameInputSvc.exe 93 PID 2356 wrote to memory of 4156 2356 sihost.exe 101 PID 4904 wrote to memory of 2408 4904 SearchIndexer.exe 121 PID 4904 wrote to memory of 2920 4904 SearchIndexer.exe 123 PID 4904 wrote to memory of 4340 4904 SearchIndexer.exe 124 PID 4904 wrote to memory of 4836 4904 SearchIndexer.exe 125 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8e27ef340b5964e8202b012dd43cf489_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4156
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4752
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1648
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1320
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3168
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1932
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3236
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3676
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2612
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1532
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1072
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2292
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:936
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2656
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
PID:3612
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5080
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
PID:1844
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
PID:4564
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4260
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2408
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2920
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2900 2896 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4340
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2908 2904 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4836
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:2736
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2908 2904 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2548
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2900 2896 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5472
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 34152e852036886481bb967211fda0bbf9777cedfa0faf08cbccd641054f9651
- MD5 f21a1cf0bfff926f85a94e4cab7514cf
- SHA1 a9871b9a1f9de2e815e96d9f406e7bfa3e550cc9
- SHA512 c70265a9c492bcc65259fc4adc9f82c6dfabb27d1a1150aae67075366cd0d658ffdb8e19803048d045bebf3d01a8987c6bce5e97471d6f2b9fc0c7c1e0c4891b
- SSDEEP 49152:qb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn5UpOdR3gkQnOZ8B4/s:c3q6gjBCfdR3+OZ8B4/
- TLSH T146D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 8bb64fb2b082a50d8c508c1d68f780a75074f45a903f819092f0434ab3eb48c2
- MD5 9725f1a8d218f08f8632562a2480d320
- SHA1 c0107155502cb340df5e4f74d4bd64ef2d2f4320
- SHA512 55ef1038010522bfe1cfc9e7177fa6c35b0693f44fc086c100f832db87e1570057ee14314eff3da12186b84313b397f20166a28eabc3370e29c81e8eef38bcde
- SSDEEP 24576:jXYtrcczAPUpOdR36PkQnOcsxH8Ll4/05:occKUpOdR3gkQnOZ8B4/s
- TLSH T1AA050128B7E549F9ED67807DCDA18506EA7378904750E78F03E4997A1F233881E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 825KB
- SHA256 64a8dd5c10b6d0ac4508d968b1ec4ea80205dbf268551f8e2ab2009b678b58a2
- MD5 3af339165705c6941990be4d3bcfc230
- SHA1 b6be5527cab45cffa4aca2ac1a92db889ea672d0
- SHA512 dcfee333df7e68037f430f5aa01a2327222f8f081ff7ff17511e063b48dd24d9236aa8bb88c2f663f857c1db3817add5f96d2934ddf503a76853e41ee4a26039
- SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C1Y00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8Lqsu:Owu+OWWUpOdR36PkQnOcsxH8Ll4/05
- TLSH T11B05F14A77A51CF9E6678039C6978136F7F2B8512A25CB1F03A0C65B6F373116E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 7923003016d19fbbb189025e1c5dd7e8ca874f982b24e399c0e8a40f8335b922
- MD5 48f9e9931a9da16f6d34b93303930054
- SHA1 b7b9732205b8723197ee5511397ffdcbb33d9cf4
- SHA512 125733ee964f8715273134736af784de0b50daa90c15816461cb9f3f3a972c3cfb96a9ed992df1b2eb30a74a5664f2a093c574b05343b9afd39f9705463cf79e
- SSDEEP 49152:2B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glLUpOdR3gkQnOZ8B4/s:Eu6JmTxd2dLfdR3+OZ8B4/
- TLSH T1EAD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 16KB
- SHA256 f74405d4e4eddf70ac96ebf5bf1bbb02ebb576ba8670792ad01898144295a7a6
- MD5 5b41645ca7cd61861ef6e9eac5333f15
- SHA1 560fbc4d725d7567923f9eb7d29c5d2086a9fcd9
- SHA512 0d92a4b4a224b238eaf3c0ef1ac2e773d49e942965a0860a0286226acf93ea1f1c0edf49089f553504dee3aae5a947cb3b59b64ee73ac36e34c1b28717585ba0
- SSDEEP 48:qRoukFyakFycqLXe6eiauB8tIVwXtIVwHIVwR+oukFG:Mouvak8cQe6RauB8tIVEIVEIV7ouN
- TLSH T1FD72DE4AFB60D8C2DE220C33C4CAE3D833A1F42E6B9043673389A22D5E14274CD6168C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 606KB
- SHA256 4cbde934967a33a3670ba696b84c56d78d88a6b51b93fff7237cd62fa3a58470
- MD5 ce25af51152234624c410e3f67083307
- SHA1 e3405e7daa9262bcb53a780a059cc8d295b9b346
- SHA512 cc76f1b3a6bcf760d937bc0c5e5eb2d1232d1118e653f7958f10d3e4aedffb1b1090876a7e2fb4d75b30a4e09f33cc1f81c37910e9ea838dc0c2c4743213e0f9
- SSDEEP 12288:BD71HY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:FRUpOdR36PkQnOcsxH8Ll4/05
- TLSH T161D42399EB999986F33A80B1C55C410939B57BE04B02C7CFA25779ED36B06412F34E2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 330e1314379f04d9b445756e1eb1bc76e562e38dd7fd163f425ff28dc2d36d07
- MD5 7edb1ff05b850c1b5a79e46f23d832b1
- SHA1 eb327c66f24911a219f3a33f80d5f2baccc9f440
- SHA512 4b195ecafde276a668e27371890039a3d9769aaa8ed24f8a9055c6c54e5a02b3111e20ec4d898564a28c90fc7511be3c4b0c356ae4888704e125bb28c3026a01
- SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYZUpOdR36PkQnOcsxH8Ll4/05:Vgb4mBIBhGF+UpOdR3gkQnOZ8B4/s
- TLSH T1F865AE1E22E802F5E1FAD2B8DDAA4417D6B278160731D2CF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 660KB
- SHA256 bd25be6a83065e308d135650b8df41e700f8b7929ce380e73c722f6c7a202e0e
- MD5 a6bb0d547234dc8693f225c26ef8f1c2
- SHA1 180d1188d249a6b3100cc7f411347070aafecd52
- SHA512 fb261a305a1fb2874b552b742df1f0c20bf9292d87a4c7cf3eb191ea3b5d26ff1c5600174215d839c3bb2a4e2af6ef3f0cce7c44ac6d87a6ae30986cca93ae31
- SSDEEP 12288:PfGyY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:nGyUpOdR36PkQnOcsxH8Ll4/05
- TLSH T12EE4236D76E675C8D23AC076C964400738F136E0470587DF45E6F8BEABA4AD03738D69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 624KB
- SHA256 d19d34cdafd4e5d36c14b0ff93d3fd2b65fce5d0a360c08e5ec6b133e57712fa
- MD5 b81d46f6f0f6e5edd8d84a1bcbc3b446
- SHA1 ba28fc9736404817734214d64698fa8ea465ff8b
- SHA512 b88222be284e2eb1d9c5b0c6b8371aaf5ff86f9d0f6142ac5a46a12fab327ed364e7ddb1023b5e1d5fa18a599cd0cce72fe73d0ea7efef6b2fb1e28f2fbd739c
- SSDEEP 12288:PsY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:PsUpOdR36PkQnOcsxH8Ll4/05
- TLSH T156D4238DAA55D5C6F33B80B2C558410939F07BE0470787CF91ABB8AE73946C12B35E7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 3d51909f0e85e1d6e7368d4d0a700b280ac4c8d50d335b6dcd5e22f0817b718b
- MD5 32cdeeb6d8af932c7ec28d2c6667bbbe
- SHA1 069cb5798d98f41481b1ad343e963d6713e3fcf8
- SHA512 f707c61bc2fd8c0ba6024da2e17265cff479f2965ad9e10ebb71eca5511185da30ff6f3f009d30d1e171fbe98ed21a19f3b5465d584e16a007e6a6a49ba46679
- SSDEEP 24576:I7L8B8FpJqH1dXria7/moUpOdR36PkQnOcsxH8Ll4/05:mQKFPqVoa7/TUpOdR3gkQnOZ8B4/s
- TLSH T18E35F165B7E101F1D47BD038CA864667F6B2B8600364EBDF07A88A551F23AD50B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 828KB
- SHA256 eceae19356d2bf5e871eaa46934ff3c6a2ee0ce29ddb9fe37ba4c677aeba9e70
- MD5 23849c5fa952a5964ff6b8d01c13e044
- SHA1 97e4455e4b60c08bc0ade0103dd3782ed4c42685
- SHA512 6dfd31c4c3e3f435cc974bbe615219ce9ee7573f6c1f8775c845315318e415d0dcb55f8bdfd73b207d73691b458749840848ec3918179df1c69397d76bff68cd
- SSDEEP 12288:tHvUrBFrEjwaQPY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:tPUr+NQPUpOdR36PkQnOcsxH8Ll4/05
- TLSH T1FB05F12F66A918E5E67AE07DC9868609F77174A10702D2CF02E1817E5F63ED87D3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 f50388faaaf12234a424d458f4ebd2bb3a92f0138d714bcfb42478aa547b92ce
- MD5 8e7e289ed29e2ac5d819059ee71ee0c0
- SHA1 41784b7d40afec2700ecbe05608b4de468e4127a
- SHA512 54bcee26d49f6383d92082eb7bf4047f89f70fc5b06a86df7ed3f581d0a5a5a72c21dc9d37e8c4ff725063b186fa9b12c8b29b8947406d6067af3b641b4d3f30
- SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2/UpOdR3gkQnOZ8BX:NG05lO43b//fdR3+OZ8B4/
- TLSH T150D5C06E62EC11F9D1BBD07CDAC6460BEBB23415032556CF02A486A91F27FF4667E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 a2b5c550eff5dbdd94c9f505cfe1c11d00cc8114fb740db77787fea3e3c8c91c
- MD5 ffd389ed62e5618fdb8aea83a66397da
- SHA1 4b8ab488a8567a7225440eb5be4609ce4e0484a4
- SHA512 9d68a5a2f0ee264b22a27ca4bd93adbb65f0cd2ceda236207e3e4c82702683e0058ca4d1e1e98ae93c24bbe37fa6da815c81af34cbad0872bfaeabcd4670c8b3
- SSDEEP 24576:PIa5POZ3dpbWVM50JicR2hG0lasx2+47eidnMUpOdR36PkQnOcsxH8Ll4/05:wa5POZ3wJt2pasx2+myUpOdR3gkQnOZS
- TLSH T1BA65AE5EA6F801D5E179D17DC583861AF5B1346153329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 e1c40180e3c77cf0c8bacce82ad486a761de8844fe11c4ce5b4ebdb6dc0642fe
- MD5 21ab792f113e82740b6123ddaac83041
- SHA1 0e063fa965cd4e99e7c97822e6ae8caa4ae02674
- SHA512 aca18b9bd872d214eab73889cd70977a65edf8abd2878de20d62c762fc98ec5a3d609c25d3b215edc4409793fa2f516aad4ec10b8b50bf9aff309857dfe81349
- SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkgUpOdR36PkQnOcsxH8Ll4/05:vNc/zEOVHFrUpOdR3gkQnOZ8B4/s
- TLSH T186857B5623E901E4F1BBE1BE89779546FAB1786513308ACF0291851F1E73BE45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 932KB
- SHA256 68b3eff633dedc4cb24ad3bf3d01eebb5040a46e4bd49f4e605de28384bf7fb9
- MD5 3a715552c4a2e33365c6ef89d2d05236
- SHA1 9b16ad7e68a53ea0582031350cf24f8c5a089dda
- SHA512 efd6f3c7d7b47b83ebc177eb3d3030e997e3f60e49d0eddb913d969ea90d3c76156979b423b6931429dd916dde329c3f6bd9f2ceb97beb86ca63708ac2a479e7
- SSDEEP 24576:SJnJPbzB4SoUpOdR36PkQnOcsxH8Ll4/05:SJnJv6SoUpOdR3gkQnOZ8B4/s
- TLSH T1A815D03DD2A810E8E4B7C1B4815A165ABF7138BC2F1669CB19B4D4353F52FD0AA39F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 21c7a84a43ce9ed50fc1bcc669882e3b8450b1aeddd55dca8f56a050b5b5dcd3
- MD5 0493a5f3085340c81e8943d426950058
- SHA1 944593fd1615f71db1e635bc17820ca21c69c5d7
- SHA512 ef3e5955ecbcb98f669e9313f4783976aa70256624dab707a578c3a2056175e382c5baa194dcf2d8a379c4b4c9e96cad438435e9e09ab0e4bc24b07ed3a2a06b
- SSDEEP 49152:gCLHGeeV5ijCmlDWDkEUpOdR3gkQnOZ8B4/s:7mfdR3+OZ8B4/
- TLSH T167A56B05E7EB5184F8F3CAF5CA2694169A327C509B34F7DF4A80C96A2E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 776KB
- SHA256 e7c41431f30f0a475105be9645557e0d17b3235c83cc626ca7ea0513ca463093
- MD5 0c69185f78618b904ff33f1d48d0dc27
- SHA1 72733e1d81e01df1d9bd4a1af0edc6a1ef92606a
- SHA512 73cca64cbdcbd868ee6f0d041ef6e48bd9f93ae3b57328a57b08d93d5c65d3417024e7972aa856624da3b64be616d8b0151876426ecb0850635d62dd86137e08
- SSDEEP 12288:p3Hck6j5ZI7kY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:P6DI4UpOdR36PkQnOcsxH8Ll4/05
- TLSH T12EF4015D637A10F9D13BD03EC6820106E6B2B5B087025ACF46D5D9BE5FA3EC87A38E51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 760KB
- SHA256 5f3fad92e13a70c94eedf9a309e3d6eb747132c8511d5993331ebb1f2966b283
- MD5 900c13637aa368d56116eb1424038e7f
- SHA1 fc25d976b7c3db3fe4ad4cf9f76a3be9f80de7da
- SHA512 3e07978dae63026e3a957fb88a34a3862e83499afd36650cc43463ef51fc5c12071a80631575438644e5e59529b5238621d1f1c059c6952c0a2a24ef084b7ccd
- SSDEEP 12288:HG6kydY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:mtydUpOdR36PkQnOcsxH8Ll4/05
- TLSH T121F41249A794A4C5E73A4074CA6641552E71BDA04B0287CF52E2FA7E3F75BC07E30F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 632KB
- SHA256 468945f23946d87c4d2c14c67a428a1c086c1e9b04f70d588bff130a1562a7e5
- MD5 169455c1a264dd3904a35d103bda2942
- SHA1 11e117cb1fb0ad1473e800f58efce4cef6ab87a9
- SHA512 846ff306de5d6c736adbdc9a4f302aa09fcda5211d787327c7e10cb3facbbcbce38d03f6e2b8e55429c807a1834e9457ceddb949ac8a279f75d9682c2619fd5f
- SSDEEP 12288:SKWrY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:/WrUpOdR36PkQnOcsxH8Ll4/05
- TLSH T1F9D4239DA655B5C6E33A80B6C558010A35B13BF00B0787CF52E7FCBD67A46C12B35E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 b688f7d51703a6d7a2775075c491c1399be10f730c4b2cc3c48e29785d6916d2
- MD5 bbaaf1762e19c738f6aab3be5c1a88f2
- SHA1 b7b292c0fe9b68a38acf14fc6e583ba241956fd4
- SHA512 fda9257073c75ae72a77fee803e3b37f1446c087dd6390c5b2472341ff73d9842917c2a5cc16d7627bba0bcaf34a6e9aaf4bb7ef7785eafa5ce514e3df0884cc
- SSDEEP 24576:o8gMLoTfaidZoUpOdR36PkQnOcsxH8Ll4/05:pgbTrZoUpOdR3gkQnOZ8B4/s
- TLSH T173559C1DA7EA05CAE2B2D275D9721493D633B4315772C6CF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 792KB
- SHA256 69bbe37d53e0c8536954625daedcef6dc7a6b225d77e718ad60adb1420efdabc
- MD5 1aa0ecb87d978e5f7a7a0b1d2c2bc829
- SHA1 9280bbc0ecbf70c1dd99f52508dc70933b8a386d
- SHA512 335f3feee5d6f095e608b30149dd66bcb23e6cd221c880eea1d42a32a351bdaa11d5e606da73690def94e4a6ada91588cf9d48cd6c17d76bb1095914d1a4091d
- SSDEEP 12288:wpJcm8CNFY00pcNiZqdANH8plJ0bDk+NsBqFDj+6Tsx0i8LqsI1sg/qX5e:wrcmRFUpOdR36PkQnOcsxH8Ll4/05
- TLSH T12F05F14EB6AE00E6E27BC07CC9454106F6B374B0170297CF42A2C77E5A67AD97E38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 60fdc04fa6d28ca41e075a59a5d72be15b4b5606c448c28a5da71d6cf1d58618
- MD5 1051c6ead48b03a6402f123b63be3aae
- SHA1 4fbf3ebbb9eefbc9d23f5616578656b3b1c6a239
- SHA512 8eb93c12ffc683b3f132566285af670a8a83cf03bb7e618dd5967d2fd7afdb99419d5b874d96c41457aeaacc0ec1e5bf7e61abfeeaf19d12a8dbee300079ffde
- SSDEEP 49152:VDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3XUpOdR3gkQnOZ8B4/s:23Upow8sB6fdR3+OZ8B4/
- TLSH T12AA58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH