Analysis
- max time kernel
91s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 745KB
- Sample260708-e2hsysbv8j
- SHA256 ebb21de9594ca3f211c484eef6233b0ba464aa7f83b1e8bd082e86e70704dd3c
- MD5 86f7077c571b069196ebb33c4b75d9fc
- SHA1 a776552bd7e90512d03323e307b4db42495a5bfb
- SHA512 54e9921a68d404bc917c2cc6c71132b4e2274c46ec9d444dbf1d90b1de3472bece81ca050d43545f5002dab90710693f535d554df62bc50352e871a1411fc4a9
- SSDEEP 12288:x93G6vHzOASubviBNDYa3A7t5EP8Wkg7FtCaFCrny+1Gw6dvnGdeMObGCT9bdNQc:xVGGTWBZY5EPnJtCaGybfGdeMeGC9dKc
- TLSH T1D2F4126175C08073E9731A3008B49A70593EFE311F2648AF73E5676A2E71AE29D35B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 22 IoCs
pid Process 3212 alg.exe 3156 GameInputSvc.exe 5796 GameInputSvc.exe 480 elevation_service.exe 2912 elevation_service.exe 2884 maintenanceservice.exe 5612 msdtc.exe 3704 OSE.EXE 4808 PerceptionSimulationService.exe 2700 perfhost.exe 5948 ReFsDedupSvc.exe 1684 locator.exe 5520 SensorDataService.exe 3280 snmptrap.exe 5168 ssh-agent.exe 1116 TieringEngineService.exe 1712 AgentService.exe 1380 vds.exe 3420 vssvc.exe 1940 wbengine.exe 3856 WmiApSrv.exe 3760 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\28912ac2b9871ed5.bin alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\javaws.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ccf3b03920edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac9d2b03920edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044039a10920edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{B7D0BC22-5E9A-4876-8C9C-6BC7A4CCB200} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{92C399CC-A6B3-4A66-87F9-D7F5020770AF} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5796 GameInputSvc.exe 5796 GameInputSvc.exe 3380 explorer.exe 3380 explorer.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4992 2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeTcbPrivilege 3156 GameInputSvc.exe Token: SeBackupPrivilege 5948 ReFsDedupSvc.exe Token: SeRestorePrivilege 5948 ReFsDedupSvc.exe Token: SeBackupPrivilege 5948 ReFsDedupSvc.exe Token: SeRestorePrivilege 5948 ReFsDedupSvc.exe Token: SeBackupPrivilege 5948 ReFsDedupSvc.exe Token: SeRestorePrivilege 5948 ReFsDedupSvc.exe Token: SeBackupPrivilege 5948 ReFsDedupSvc.exe Token: SeRestorePrivilege 5948 ReFsDedupSvc.exe Token: SeBackupPrivilege 5948 ReFsDedupSvc.exe Token: SeRestorePrivilege 5948 ReFsDedupSvc.exe Token: SeRestorePrivilege 1116 TieringEngineService.exe Token: SeManageVolumePrivilege 1116 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1712 AgentService.exe Token: SeBackupPrivilege 3420 vssvc.exe Token: SeRestorePrivilege 3420 vssvc.exe Token: SeAuditPrivilege 3420 vssvc.exe Token: SeBackupPrivilege 1940 wbengine.exe Token: SeRestorePrivilege 1940 wbengine.exe Token: SeSecurityPrivilege 1940 wbengine.exe Token: 33 3760 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3760 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3760 SearchIndexer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe Token: SeShutdownPrivilege 3380 explorer.exe Token: SeCreatePagefilePrivilege 3380 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1988 sihost.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe 3380 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5900 StartMenuExperienceHost.exe 3380 explorer.exe 4732 SearchHost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3156 wrote to memory of 5796 3156 GameInputSvc.exe 90 PID 3760 wrote to memory of 5968 3760 SearchIndexer.exe 111 PID 1988 wrote to memory of 3380 1988 sihost.exe 116 PID 3760 wrote to memory of 5248 3760 SearchIndexer.exe 123 PID 3760 wrote to memory of 940 3760 SearchIndexer.exe 124 PID 3760 wrote to memory of 4892 3760 SearchIndexer.exe 125 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_86f7077c571b069196ebb33c4b75d9fc_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3212
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5796
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:480
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2912
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2884
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5612
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3704
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4808
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5948
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1684
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5520
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3280
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5168
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1380
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3856
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5968
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5248
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2936 2932 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:940
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2948 2964 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4892
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:4604
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2936 2932 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4880
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2948 2964 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4696
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3380
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5900
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4732
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 98fe384c72158f50e36c46873bb285433b6a4d192055b1b5d456ca2660c76027
- MD5 4f560d653310a6f79dd7a632cf667242
- SHA1 8b3f563c21baee235442cd4bfb0206e1830bea32
- SHA512 773df59b4638b1602521e589707d14d43a3a6d84a5cea908cdf3e6c9aebc4451fd95684fd3832b9f99181243d6b12c3a57bfc8847f1cf8f5ae3a1ae95995e2b0
- SSDEEP 49152:Db+632BuPkFKRrdE6oh7stBhuXjfS4LWxn0EPnj+YOdeMcK9S:h3q6gjBaPj+QCc
- TLSH T125D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 de06278c9e0181ccd0c7c4040783a2cc7d1752c96edd7adc73e2d8de51c83454
- MD5 520e43cd03d003b480c5702d1385270c
- SHA1 c947e2c176b88899f1f70f04577b7bc7ec34e696
- SHA512 0ca03f24ec2604acb554e2cb23e51768a2d1e26e3482ff5170246efeae077b034f602fdac447776450a3b7d1bad50f263279a5060afaf796115e207534353f39
- SSDEEP 24576:bXYnKtczAA5EPnJtCaGybfGdeMeGC9dK9S:LtcJEPnj+YOdeMcK9S
- TLSH T1BC050234B7D409F9ED67823CC8A28511EA73B8824760E65F03F4DA652F237985E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 825KB
- SHA256 6c79de035ca4f9fe41413615ff1848b79b32b425787863971c67ee4d754ec4f0
- MD5 999ea57670c79881a6756414027bac07
- SHA1 003ffb3cd2cdb528d871cc5197769a152ee47f34
- SHA512 032fd63432477e759db34fb31269711317afe33836666482c7f38f534ebb8c224443d2aa25567cce265ab34679c227369bcea1ac218cd7a3ac7991702d654660
- SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+Cg7t5EP8Wkg7FtCaFCrny+1Gw6dvnGdeMObGCT9bdNB:Owu+OWl5EPnJtCaGybfGdeMeGC9dK9S
- TLSH T15A05F15676A40CF9E967523985578136F7F2B8022A22C71F17B0C75B6F37321BD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ba5d17ae134eaeda4fc566def4dd17a4290a4ae959e8ce53e5492d8af9aa87e7
- MD5 c92a6141b19df9130098f905699d1e47
- SHA1 dfc1e8dc4ae383d80f704b6ca798b64df7b4d660
- SHA512 df5f70c4c581b17a25dc89482a727948a531b1e5246befcc9e82865638cd8537d37ceba11264f6b985239a869175874bc40e948a80fdc79008a09bdcbf38103b
- SSDEEP 49152:cB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl+EPnj+YOdeMcK9S:2u6JmTxd2dpPj+QCc
- TLSH T12AD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 606KB
- SHA256 c360f8b5a133afa744615cff0492e8f48e35bddddfd1e4932063fe605b75f977
- MD5 e8ab9cbc5856bdf1b378e7f6802e5140
- SHA1 09892e3da84ef1ace14827dee8cfaab0d3f7d469
- SHA512 2a0551540daf4385a5f47399a12def3396bec623563edec0c9ef27a7d464254afc85daa287c7e57e6bea22e910e40ff25c62ea90c6e5a200a1c4277e59ed7732
- SSDEEP 12288:B37j7t5EP8Wkg7FtCaFCrny+1Gw6dvnGdeMObGCT9bdNQ9ep:9N5EPnJtCaGybfGdeMeGC9dK9S
- TLSH T119D423F2F9580B11F9672770042E0124A967B5879B03805FB9B6F7A13937E99FD32722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 409b7e8557f14e2c90f0ecc88aa65d05e5b4932291843aa399343bc2abe686bd
- MD5 d543e2b1c5050c94d322c5c611eb141d
- SHA1 678a2b96d4d7eb8b5ee243b346277d540f003828
- SHA512 55e83140dd52e2e1b6de2aaaefba2802579593b0c7fc8c6320be550c62a34a0faf224f81ced624794829dc93413acfc4446a0fe02846e954abecc596ff489c48
- SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bY/yxsNExWgWZhwK9p/r4TKh:Vgb4mBIBhGFQyKB/ZiG/4K
- TLSH T14B65AE1E22EC02F5E0F6D2B89DAA4417D6B378161731D6CF1251423D2F2BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 660KB
- SHA256 d350549831dd9b0405b68b4af88d247cebb4919922d7fb258c2b658c024c240e
- MD5 17b9c0d98fd1891fc833541ab45bca60
- SHA1 1dc7060564652893a45d8f0575911bba6572955d
- SHA512 0f4b0c35aa17a21e04fe4123e898f54a4f1e9ae850230176a855046253a377c83febd500bb838a3476779a79c0fac0c45436fc6d595d8820491d5ada37234436
- SSDEEP 12288:WeGV7t5EP8Wkg7FtCaFCrny+1Gw6dvnGdeMObGCT9bdNQ9ep:ZGv5EPnJtCaGybfGdeMeGC9dK9S
- TLSH T11AE422B6B4A522A4D93B933504390166B8B27182970250FF09F1E7747F27EF4BE36E61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 624KB
- SHA256 0a0e3930ecbecbafb4b02dd8a2b2ab546fe7e8358ac1ca212b75f001143fcd98
- MD5 9f3f174a658e2a5862bffa32081a834c
- SHA1 6b042909ffe67cc008cbdd08f0d2419c50b284df
- SHA512 89fd518beb9adb6e6bec90109b1db837bed033faa686a98c433047d79ed064d3643008a0d6f9cfbd3cfd0488f35b7389d0654e9e894c4f40b72deb51c8cfb726
- SSDEEP 12288:9O8W1Marq521AGNEzV4LSb1iRnuKRrrGnJ6MpC19pf3YIQydETQ/WtU3:9OyxsNExWgWZhwK9p/r4TKh
- TLSH T1EED42313D0A9E181F172C3B621AB480FA93EC2546FA57DCB1E0593182E8E9F37479D76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 e30f3dad2364eda9c72bbd07d2e4c4e332a69d50e384a1d02cc6c86a0cd0e9ac
- MD5 464c8d56038714cf0456ce0891cda953
- SHA1 3b9099fb6407c38210abba4b1ccf900b01fac5e4
- SHA512 6ff884becf06bc33f4cdf66b905aa8ec305944ae59afcd4239c2c0754d961fb1dcc9684d0f20c94ce221b9d88cf9d131a8b5160a4e09609b05a5b9d7039d621a
- SSDEEP 24576:I7n8u8FpJqH1Tzria7/mmyxsNExWgWZhwK9p/r4TKh:m8ZFPqVma7/lyKB/ZiG/4K
- TLSH T1B935F126A6E101F0E477D13889864667F6B2B4251364FFDF0BA88B551F13AE14B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 828KB
- SHA256 70f88f1404c33ed05a55fd51fc52bd5386a5553d7325ec03cfba90a21e06765e
- MD5 8a5afb98131a95f7d1ac56d3356e53be
- SHA1 11e81c8d194a73482767cd88521e8a4300153db2
- SHA512 9c11201d4664ee1d14674bb0d8a0dccb543805246547dd6907026ba3ee5b172a7d15ce18f2099c5ebf9bac6923d796aa79aa708d744868311da5195c99c352ae
- SSDEEP 24576:IPUr+NQV5EPnJtCaGybfGdeMeGC9dK9S:IJQfEPnj+YOdeMcK9S
- TLSH T14B05F16B76AC18E5E676A17D85464709E772B4531312D2CF02E1C17E1F27EE8BC3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 f211c2b42a89cd0f6989e7f6acda15b3cfc671beb76800135f1edc6c7c78888d
- MD5 df3910792540ce138089131e96d02883
- SHA1 7e4479f85480d559bc3ed9e163c6f79d340b893d
- SHA512 624814b32df602c7c1717afe30d668315bf35048691a98124f3891b99e0f6d4623eff55b37f296ccd5c082c9678d93807dfd675165a1237d413857f6715e7cfc
- SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuyKB/ZiG/4K:NG05lO43bLNzvw
- TLSH T16CD5CF6A62EC11F5D1BBC17CDAC64A0BEBB23415033556CF02A486A91F27FF4A57E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 d274b1232e689933563fa7b9398ca1198507f446f02acb8466d1bc0fa4452232
- MD5 f99620f8a81d27059b20a3e6486763f0
- SHA1 74d729cf34e34c50292f32bf9bf216063c180eb0
- SHA512 85bfe845b5d60a0454f0ce6041e06a3889778349dccd70839d7d102a5f72e233e6af373b06d4db1f68d1a3421a274d1ec31ff899ee5d17ae7e98c1fb38495e67
- SSDEEP 24576:PRa5POZ3dpbWVM50JicR2hG0lasx2+47eidnLyxsNExWgWZhwK9p/r4TKh:Ja5POZ3wJt2pasx2+m5yKB/ZiG/4K
- TLSH T18A65AF5EA6FC01D5E1B9D17DC583861AF5B1342553329ACF022182BE3F27EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 65ef44e97a71bdd132945b9298f82f6b168f8c621519bf28b90b78eaf9339f69
- MD5 bc35994a853d6396b214d6e2602292d2
- SHA1 f9e50444e8052fc5249ee0d3bc45b3f6f6bd2d4d
- SHA512 2cc88a6026938849a4c1b40d7749987815350872ca75b37433a337c94999a707938b980576b4afad99b33b6efe63069e5d2cd6a804080e3e3db5418a027ea777
- SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkGyxsNExWgWZhwK9p/r4TKh:ONc/zEOVHFNyKB/ZiG/4K
- TLSH T189858C1622E901E4F1BBE1BE89779546FA71786517308ACF0291811F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 932KB
- SHA256 20b0aeb3cfcfce2f1860979dff86bebeab6ee55cf83ba8e9293782ab8ae116e4
- MD5 b05341513227287a19cc16ca57e61d3a
- SHA1 d02be511e07db3086c327d567026d35edc29e002
- SHA512 53b087c72396336ee616db89dbc471b41aa0c2d2174aab3373ea03a6107e5b83f001b3e7d08c37a4ad0536c94767bfae06089b85681ae590e4d7608e87c9d9e8
- SSDEEP 24576:rJnJPbzB4SQyxsNExWgWZhwK9p/r4TKh:rJnJv6SQyKB/ZiG/4K
- TLSH T1D815D03DD2A810E4E4B7C2B4815A1A5AFF31347D2F2669CB19B4D5343F42EE0A979F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d906a0d898ddb32474bbbb3946e6ed21441d16335b9c8cc1e7f2b4c1b7d5f3de
- MD5 aa9d86d847881452ab8f752917f762e6
- SHA1 039694402b17be5aff8ed4935324a485ee852db6
- SHA512 6064d1258e224a290722ad2d6bf9cfab6afaad893be102f3046811caaff08f8b6abb59d5bea668f243f4c0a16b4c4b038cab7607ee5d646af1cc13c0e284fe11
- SSDEEP 24576:1CLHGL0MoeVtFumTijCmlKQWDkIyxsNExWgWZhwK9p/r4TKh:1CLHGeeV5ijCmlDWDkIyKB/ZiG/4K
- TLSH T126A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 776KB
- SHA256 f64bfcf6aca5b4a587e640f859dee771dd9101c7579f5d0a6443df14b03a8b97
- MD5 d215b2f967193452c23531044cb30a71
- SHA1 4e1b018b92db2638d5847176841cb3c056c81155
- SHA512 b8e6d39e46d578e315c754ea2bcab35b79c381d354645b1a7ab608a80bf168280fc802dd4a85f8d64db510870484a43cfa2b275e753edc080e909e32ab0f6590
- SSDEEP 12288:DgHck6j5ZI7E7t5EP8Wkg7FtCaFCrny+1Gw6dvnGdeMObGCT9bdNQ9ep:O6DIA5EPnJtCaGybfGdeMeGC9dK9S
- TLSH T133F4016D737A01F5E167E03E85830101D2B2B0A2871359DF0AE4D6B96EA3EDCBD39E51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 760KB
- SHA256 6d71fb11d47febc873a250cc913eb47361915f8b927ec1a37957a44dfcb4e50f
- MD5 a0615b6be46adeb95dc8b13d2acf4006
- SHA1 1240d5387fb2c90c2b959cde2cf6c172ad5803fa
- SHA512 6f3673b056904460fe7c11539197a6ddac2d4c7056fe32c98c098ec90bb5636853e4a77bc8977033bbb75f1b0c6fb794f409cf6223eedc618df899ea681a1d95
- SSDEEP 12288:6G6kyx7t5EP8Wkg7FtCaFCrny+1Gw6dvnGdeMObGCT9bdNQ9ep:TtyD5EPnJtCaGybfGdeMeGC9dK9S
- TLSH T16EF41261B2941194EA761234492602A49E32BC529B1292DF65F1F73E3F37FE8BD31B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 632KB
- SHA256 8a604f8ecb072f52b28960f1ca0b0242341064fe1bb42c15ad2b321d70e69dfa
- MD5 fac0e2d226f100b743e4c5f1251c20ee
- SHA1 790f0494da3017227cfde53afc65d263bc388e20
- SHA512 906625d521de531dba0a41afaab21c8923da7f91bbdda51f0293fb6345f570f2d90fddb0e63471563cd76e62f01fe3eaebf818193be33131029ee14fa07a61b6
- SSDEEP 12288:c5t8W1Marq521AGNEzV4LSb1iRnuKRrrGnJ6MpC19pf3YIQydETQ/WtU3:utyxsNExWgWZhwK9p/r4TKh
- TLSH T1BAD42317E0A9B181F462C3B521AB480B953EA2646F667CCF1E45D3385F8E9E37435E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 d7ed8f863f8d13c6fd0f83ac03568850fc5c7c84ef76760dea26052b8106151c
- MD5 8ccab60bbd26eb16280e069385e0c058
- SHA1 f6ea0f69559177a0837265d7dc948c5688048158
- SHA512 9478e0d52b06c4a8a06384bb2ab9b0ffddb81cfc272a53ec0147974854c880cbe265924f08ec63c815760589333365da7c66f274cb76ea99cdb45bf7d8c7b589
- SSDEEP 24576:gAg2LoTfaidZpyxsNExWgWZhwK9p/r4TKh:1glTrZpyKB/ZiG/4K
- TLSH T110558C1DA3EA05CAE2B2D279D8725493D633B4315772D6CF2448C03A4D9BED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 792KB
- SHA256 682538d8b3fd27840beb11b28d4ff9d43387ee208865af639bc8defd3f081c7d
- MD5 a7380f65463b6919e7e6ea7ce8edf7cb
- SHA1 31c1c502d029aa32b0c2f6af774bb56f0162ffc9
- SHA512 e82b0a27a732e88136f64b83e9f72090ae371375ba62fcb922159994c19ac838bb2c1f5e0dca9cd1ec09c81cd32c55d93083c9b257594b06148ddfca5f30e710
- SSDEEP 12288:fpJcm8CNC8W1Marq521AGNEzV4LSb1iRnuKRrrGnJ6MpC19pf3YIQydETQ/WtU3:frcmRCyxsNExWgWZhwK9p/r4TKh
- TLSH T12305F11FB2AE00E1E1B7C27C8886450AE673B030675267CF0691C77D5E5B9EA7D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 28166a437074613efea18c30d77f3491c702c720d6168a5413d2936afa9bdc50
- MD5 0d09c2664b54cdea23b5ea42b069b3ca
- SHA1 23d118ad4756918435b117732f13f15b220f87bc
- SHA512 04ee16496a0ab04b1f06329e4e81b18cb747568b8e2e55294577c8d92bc6de2ec072b8e6306a80cb702e711af7723eec3cb7b50dd2c760e35c5cc600e1380420
- SSDEEP 49152:tDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS34yKB/ZiG/4K:O3Upow8sBBNzvw
- TLSH T14DA58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH