dcff9ef541642a36da6c05ea7f670d627ff6e4530d6fcd323d13d03b8f689e99

Analysis

max time kernel
147s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 749KB
Sample260712-p5e7caas8n
SHA256 dcff9ef541642a36da6c05ea7f670d627ff6e4530d6fcd323d13d03b8f689e99
MD5 696cc8ee2136936add632c96639cded4
SHA1 2775b362684d40dbdd45126bf4941651debf23f7
SHA512 5d92cf06109cdd7de1dc170653c9a471e5f1f12a6f5c83d03f1dd65d871220142c99fd562d6c69cf8979b3294a1b1793d49e57253c073d398fd74804530addf3
SSDEEP 12288:o93G6vHzwA3ubviBNDYa37RZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODI:oVGGTPBZuW5hXSHg/ehHeRqh9zS
TLSH
T111F4025072C0C473E5632A304AB19E71A97CF9302FB95D9F2399162E4E712C3AE29777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4824	alg.exe
1928	GameInputSvc.exe
244	GameInputSvc.exe
2816	elevation_service.exe
2648	elevation_service.exe
5596	maintenanceservice.exe
5572	msdtc.exe
3980	OSE.EXE
4536	PerceptionSimulationService.exe
1192	perfhost.exe
2520	ReFsDedupSvc.exe
3420	locator.exe
2088	SensorDataService.exe
5504	snmptrap.exe
2412	ssh-agent.exe
2376	TieringEngineService.exe
1500	AgentService.exe
3068	vds.exe
3920	vssvc.exe
1328	wbengine.exe
5808	WmiApSrv.exe
4792	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\973dadd4c618523d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000016c6eb0fd11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000655cb3b2fd11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000087f5c8b0fd11dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000555ee5b0fd11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4ebb2b0fd11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b924eaffd11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
244	GameInputSvc.exe
244	GameInputSvc.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeTcbPrivilege	1928	GameInputSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2376	TieringEngineService.exe
Token: SeManageVolumePrivilege	2376	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1500	AgentService.exe
Token: SeBackupPrivilege	3920	vssvc.exe
Token: SeRestorePrivilege	3920	vssvc.exe
Token: SeAuditPrivilege	3920	vssvc.exe
Token: SeBackupPrivilege	1328	wbengine.exe
Token: SeRestorePrivilege	1328	wbengine.exe
Token: SeSecurityPrivilege	1328	wbengine.exe
Token: 33	4792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeDebugPrivilege	1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1132	2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 244	1928	GameInputSvc.exe	90
PID 4792 wrote to memory of 4836	4792	SearchIndexer.exe	111
PID 4792 wrote to memory of 1848	4792	SearchIndexer.exe	112
PID 4792 wrote to memory of 5228	4792	SearchIndexer.exe	114
PID 4792 wrote to memory of 5440	4792	SearchIndexer.exe	115
PID 4792 wrote to memory of 2824	4792	SearchIndexer.exe	116
PID 4792 wrote to memory of 3256	4792	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_696cc8ee2136936add632c96639cded4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4824

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2648

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5596

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2088

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5504

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2852 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2932 2912 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2852 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2932 2912 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 98939c8a35005c5cade389ca765dccb68187f6ff6ac890d98b170f8444058b2b
MD5 94f1a001687d0529823ce2eaf3fb49b2
SHA1 80c328f32f423a4c7886392b93482e8daf54bb84
SHA512 016b65643961580a9c5c004d8d99b6597fa5c328ea43b419479b6f9b5b6906b95d422e44259be2def02ae02274300280d62206f35feb55fcdd9a1486ccbfe256
SSDEEP 49152:0we632BuPkFKRrdE6oh7stBhuXjfS4LWxnQ3F/el4q:53q6gjBC5
TLSH
T1C1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 31a3bc5018f40257eeb891fc28c24ce9d1a4b6c5c4f24c937e2ee8e8541bf92a
MD5 5595c40c41ab52de05cc85678ed9a9e0
SHA1 730b1202f1aed6589ba3d2b059c4e8c8c0602c51
SHA512 76b8e4be1fb9b2af88be52d8bde4fde1c50e0f5b4e1f8129dff25d9342a966cc4e5fb3a20cd074f93787781c4c49565c61961736318fefdc8718b469dbe5459c
SSDEEP 12288:T1XLsRre0x8VP5m2czAUZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNln8:JXY9XcczA9W5hXSHg/ehHeRqh9zS
TLSH
T11505022463E448F9ED67927DCDB28901E672785147A4EB8F03F499260F332C96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e580a826e9cb76e1c213521a8866f040c9750f4d6bd5895bfda07ea7e4f31103
MD5 205a49fe560a8d8df9e5499f401f4e1d
SHA1 e45e51912c51b82969d97364a9aea933502562c4
SHA512 396429d7dd9805523532e8aed79ef5b4c95a58809b27f2455e62d6c66f82d166e0f3016b215b796e200651d087226f13352f2224902c5925d77e0dbc256ca45d
SSDEEP 24576:c0JeMpu0qfxOrMQ5W5hXSHg/ehHeRqh9zS:cwpu0YoW3F/el4q
TLSH
T19545AE55F6748735D073C0B9C5D2A68EED7130821B308ACB4296D77C2F67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.1MB
SHA256 5cc432bf1c691ed770188471fe756eef30710936945f2a93f6ded1cd81227fc4
MD5 6f24744b2d3eef26ee4a7c33eec6e417
SHA1 62b8a65c0d4ff29c4a20036f99ef56f5e5cdeba6
SHA512 e6c300a31809543a9c895440ac8b9338141aaaa148ecf47c36635f7c88c3c4e24e37c1cedcaf2dd7ba7ae9da005900b1a1ba78c18ef0e01fad4d7946693fff26
SSDEEP 24576:qRrnezSC6vUyD/aqgrvW/6q8wyu0hW5hR:anezSC6vUzPvuHjyAx
TLSH
T1BC350A15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 832KB
SHA256 37bb9f6e4af01a328151bf8b8463fb17cc9b8af812deafd0aecc1306522b9850
MD5 6a585815790d4ce2d220551e79cc4c61
SHA1 07f4095e101cf569eefe784ed6d91c4135df636b
SHA512 2a4e9f73739939fbbe2be168b8207d382dde5144716887542e747393f34e7b4a982f59180a3d48fd3a8cc13ada2513993391309877c60b0e6c75580ebbce5262
SSDEEP 12288:gaJjBD33vYhRl7BHid0/wsEBoW/lx4jf0Im98CWZe0IvIZPXhonJ85j:gabDPYrluv/l+dCvW5hB
TLSH
T171054B66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 7622fca304cb25842fabe8d6753af34ce8944a1d623e3fedd3b8d76f2b69a5d8
MD5 7bff7f802b741c037db363ca868b2c45
SHA1 b83b1d69c311fecb42795318ce9909017c940c2a
SHA512 8deefbb617cbdcf34f48abed5303b3faf66e82e1ed6c99da3fa5827f535404c989813450f1b1d9d409919ed6549526540defc784b5afc5f0d47941a399d271ff
SSDEEP 12288:AtkYRZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:AtkhW5hXSHg/ehHeRqh9zS
TLSH
T1EBD423C08794C826F350BEB24BF78F45B55878412DAE6E8F037AB85A4AB70C7F645168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 384KB
SHA256 a06d8d583d34c64648be88682b8e34dbefcc7a1c27aa09584de4079212e73cf8
MD5 3597c13c6967d91874742813235bfcbb
SHA1 0606ed1b92f8818b7709ff38724c32f656baba73
SHA512 79a07fe32f15dfbb73db22342df3bd8cc3a19019599a0c1030df6321d36fcc0ecc0e1c73107900ac48ebc9920d5600aa1e72d62017a1729a58ac0d25a4838b11
SSDEEP 6144:QOOr7BJ/GKWWBNU6ITLBi0qttclOKgU91BayrNz6loDtouC0Ivc9ZXfXhoLDJ8D9:XeBNUbTVO86UM0Ze0IvIZPXhonJ8h
TLSH
T126844B3BEE28FCE2C27E9DB856918640D77278304F62A3CBD175820E9E235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 192KB
SHA256 2a390b9f74dc3c57ab86b5f17a246898d77859831773c841bbd68188d495ae59
MD5 07909dd5ed72697a606a0e21baa474d5
SHA1 85d283bf98f03d75a75892c03fd9cb9370b53566
SHA512 e8809f88da293f900160c7009b8211b2be83f906715a5de08a8550c541a8262d9f67027f8126ea6f2184eba9078e2064b4d08c1efda4a741cbaaa914f6459496
SSDEEP 3072:QgvG8uTTvLkvL7eQ2hc98qihCtlXx2Ili/GVZmVX+G/ANPsI8S7IITGZPTEXBpsb:QgO8u/LGL7eQ2hc98qgCbIIlQt/kT8Ss
TLSH
T199142C5957A451F4E15BE0B9DA2E9932F7B1380601703B470FA1CA133F7BAB09A2DB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 128KB
SHA256 6e85bc76ec7f51646c1ba585f378790540fe56fd5b722f6902aa1de4ab862f7e
MD5 87152753fc33162aa39d1523614fac7e
SHA1 c15f789a43ae94e302a4fdf0cc2c1e9d6d76244d
SHA512 3b5c61080ab26a9ca0543c3bf030daa3bf4ae3d2ab2f3d6ea7e9b42216a4ffcb355fd903e529913379b82044a50bb90774336054c95383e4391a36ebc184b34e
SSDEEP 3072:d/jIqD6B7r8KDvfxL/2DgP35OYPfDvuEXI:d7I3r8SfxL/2Dc33Cf
TLSH
T160D33920F6058667D96266F14A3E9B1F507CAE150B6C6DC7E3DC5CA92AB42C3373324B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 42KB
SHA256 d38e8c6418ce27763781641f698a5c6c7f0f34c79b181b8ca8052be75ee9ff8e
MD5 6c9532bcb7072b895d3c6e23e32f9eda
SHA1 2e6b77cf0f817964b627693db37a8f53feb76ed3
SHA512 cc34f5eb8b4e83be4da979351f82573660c6f0fc46db597c32c41bc88a040781cbc65220b8d39576c3e83c9965e6990ee3baedb3f43647cf9fbe1c4874e5f9a5
SSDEEP 384:w8TqraJg/N3rLm0JhOTJtXQZqL03+gr5y4yrQlmDCXSmtJ45rieJ1BLJFXoPAcXH:/TmqgNLmxTJtXfrgrLlmmQ5rRJXK+Hi
TLSH
T13B13830D279624FAD363ABB4E29D3632F33876198630295B9D27C1015F7D2A45E3FE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 512KB
SHA256 feb1feedde370f3d301335cf50d07bd9ca4423c187ba4b2926417ab60fcf1301
MD5 8a14f8f503d262682e112d3dfef55a94
SHA1 708fd081cd9df0fa13e12756a70a2c58d746efcc
SHA512 3725cfcba845d242ad8387dc4353ce0b88c4a44fbcc135272f5794f2099ae1b5af45a36c25638440b3b55090e897adbc868b8798a709b60f34f185ba913ef062
SSDEEP 6144:QfYHFs9lpgExLOylocNO4rWH5cfZFWGbXqqZSt2LcMjUZOl9y8U6BMUANdhR:QfYlgskg2gMjoKU6aUANzR
TLSH
T1DBB4F70A727402A9C1AAC1ED9B0BE907F7B5780A17307ADB9AB546571F37EF1613F210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 39fb4c5c58a9b892b6df7729fc3d340eec42dc6dc19f22eeea12c2409560bc89
MD5 47b3a43ef5888533dcca67e6f9910664
SHA1 4d8ba79b93a709dafe6a9cacc83f9eab16e0a05a
SHA512 2e8ee6484531a3e4e85128d8724f4bc030f529ca53b554742d6acb4cb491c64059d54578b286912256ad308f097b3fe3a6a3762a7aea55212a541baf07bcc786
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CGZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODI:QwuuOWmW5hXSHg/ehHeRqh9zS
TLSH
T1CB05F18573A44CF9E56296398697C536F7F2B8022A25DB1F0370C65B5F33252BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f56a7c9fc9579879804d9b6fbc1eff40e63ac1191d07cf7a7faa31c18f6b22f1
MD5 6e1003ce5572d755eca5be3a1d2d4347
SHA1 4b6fece5798fe32365ceadc88f75552b710fdbc3
SHA512 4763191fba6cb701d08de2e4a1a3897c416e2bbb3a0b7958635d49880ca8254d0623eb64ec5129cae5b808cd5d296f2a867613b7f718537cb56e2bcdd69d5c47
SSDEEP 49152:kr+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl/3F/el4q:Mu6JmTxd2dg5
TLSH
T121D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 8257532a29f33451dcc73bfcc4f5a1336fafbcbd930ec2aa803d1329786d3015
MD5 02add6bb25eecd079eb271bed80a2f65
SHA1 b46f80a3b1b18ebac4a404f626c2dc8ed54b1884
SHA512 03f1c9861ec19a9656814d9b7a69f1ead569abd5bdf16454fa47e6d39cfbfba537e8b114db8b1764c3be9f255bd58f130b3ae837e3ff8ef08b31e0a6ed80e511
SSDEEP 24576:r3wvtk9RX6wkyAIyGW5hXSHg/ehHeRqh9zS:gMnYIU3F/el4q
TLSH
T12135D029EBDC44E5E177927C89B3460AF6B178591B31C6CF025A536E0E33ED4AE39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 1.8MB
SHA256 d0ba4461d7d24b1f5b7431a066235966f2ca3c5b3f3ea96d103b0e4f15f562ec
MD5 0eee49967b82f806e4a305fa2d4aa112
SHA1 04c7cef110d1bcec61f980e0e666853e16d2e4f5
SHA512 d99812c685099297e5956e86d0dd57f9f2a6856bc2a2a0329a73a47193f5dfd72e9f0fbf923ae359c5cdb5681fa6d4aadb8560d09e80a0e763765d1491e2d807
SSDEEP 49152:KYFkNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBD:eySj
TLSH
T1CB853A5651A801D9C6BDD1D98F0BDC1BEBB1340D0335AAEB03E546931F6BAF0AA3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d7fe97522a74e125735e6d8a75682ceaf78f63108860e27d07d66d8236b10fff
MD5 910b1e9b337ab6a01fc18d180c10267e
SHA1 d7564b14f69404d246b8407b07023e65d56e796f
SHA512 4524108ead663a0fa7eb2350f0b5a363ae9662e3e56a7f732308004873538251d793dc57f242d38d889bd51e4a4abde6b1ee1c1d747acc1b4d0b03f36df1634a
SSDEEP 24576:0R7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYVmW5hXSHg/ehHeRqh9zS:0R7JUQjXirIhCnDHUPfF/v3F/el4q
TLSH
T13E65AE1DA3EC01E5E1BAD27885154A5AEA71742E1F32CACF1270827D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c31572c77ecfe343a72648c97dabc7144015e7a679992abc61e48ad04dd4545a
MD5 f3efcb5001b7cd3342b179a6bdf4fcf8
SHA1 2a94c640c93f0923bb7b76f24a26704e18582ae4
SHA512 a8a4f88b14a594190b2674530b8c21f46b720106c8f7f0f8577e5fdfef5742f7c2e7f8a347e3ad58080d333b4301384bab7922e5fe85faf1ce91222f157ffdb5
SSDEEP 12288:Rg7WZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:6vW5hXSHg/ehHeRqh9zS
TLSH
T191D423808398CC16F270BEF14ABB8F14B51C74512FAEA9CF532EA45A0A735C7BE4556C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a31c10e1819db8ad81de18c5488a8133508aac88c9a8287f0ba8164c33a7b2a3
MD5 4e96cb2cb4b2d1875ca70e6c7688a647
SHA1 4f2629e01de880cc8221c1614e0b8a2d33e39d19
SHA512 44f9a654e2a911adb6e1a78d62ff985910e0e2764428481e66b688cb13c694372f6a743ef27922462edb188560b813e9c582e8bc99169333430c8c3d59117202
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYPW5hXSHg/ehHeRqh9zS:ygb4mBIBhGFL3F/el4q
TLSH
T1B665AE1E22EC02F5E1F5E2B8CDAA4417D6B278161732D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 b16d808f1ad8b57a69cd3c06992219f88ac9795a3ee660f10fe6cd883e1e266d
MD5 ce3e05143d0d6b84897b3309c762fdf6
SHA1 346593051be54978ff092b5e58fec9514a5000d6
SHA512 966b239ac14898bd719fb54b1a999ecfef3d22c59fce698de14221bb4c4f4f8f0064ff4ea183e7300f2a38707434cd7ce0bc6cf8dc3d0a4a411132666c4683e7
SSDEEP 12288:XBGDZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:xG0W5hXSHg/ehHeRqh9zS
TLSH
T131E4239462E5D854D131FBB589B38A56B4B430502F2D2AEF02E9E43A8F725C3B739C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 e132d6aa09078a079dee334720fe87c4a744f2f94fa6a04071c9629b6ce50d78
MD5 dff2f080c1fb48800f3e6d456f50d405
SHA1 bca9309dfa35eee4a9565f7276cbf1ce2b687bde
SHA512 2fe37e9e2638ecb961d60c5b6c4b608c24132637cd8c3be3b448150182b130535925ca0169375388ddeda99b356c424e70dbbd42c226ba62c3eea6c5ac5ac95f
SSDEEP 12288:TSWZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:ToW5hXSHg/ehHeRqh9zS
TLSH
T103D423C09395CC16E250BEF54AB34F05B54C70023FAE2ACF136EA41A0BB74C7BA755A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0d74bae8de58b637c9d0417678707ae3f3282eb7efbde2bde49ecb3f190aba5b
MD5 fe68e43e9da19360bd84c2a5dcbc2e45
SHA1 871379ae669fc338f7f87adeec67f6542e95df30
SHA512 0eaa6ae304b9e558452473c45b40d07d5b51a3af05c88eb88bdbe12a324c84b6846d9edec405ec3be3d2ff72a40a8d5d09f8b7091780fdcf6cf0ff491ab14e68
SSDEEP 24576:dOK8E8FpJqH1wQria7/mJW5hXSHg/ehHeRqh9zS:Q5LFPqVoa7/p3F/el4q
TLSH
T1B335F16167E101F1D077E1388A824A63F6B1B4251364EFDF07AC8A561F23AD65B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 9fa658bb263e863ccbd143c75c1a4a4497b602a401e232b4a1f4eb92b612619a
MD5 b08d3cf2150c6d4b1fda18e548305415
SHA1 1f74cf846ea0f27918427890fde7af4cfe0cad29
SHA512 972b25c17d4705782f6a48a6a7125bb44fb17d7605bcb40969573775b1140fd12abb92cdd5df05ed427375a5544d845d936930be936db69f30a991b9df5c67a9
SSDEEP 12288:gHvUrBFrEjwaQSZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:gPUr+NQLW5hXSHg/ehHeRqh9zS
TLSH
T17B05F15E22E81CE5E676F17D8A828709F771B4521712A2CF02E1817E4F63AD9BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a199b4b3e7c82dc5aa15453f9e5c53c42f00dbb59c126efa40295d207485f383
MD5 71c3ea884d3159c4fcaa599b1918109e
SHA1 0542ff28ae9d562056b154f65d74b2b882461d6f
SHA512 4634f5d218ab0b1fdc4968eeadfe47c0d485b83510db173425770b9d42972d1bc77990ec2e0c590244062e4d9391fc88403fb93bdd1fc39a5e5f8ed552748cdd
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf3F/el4q:5G05lO43bv5
TLSH
T1A8D5C06A62EC01F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF5A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 960KB
SHA256 e011bcd0c29a028175b2303e04053c84fa3c5b3eccaa29c1848d56f171ce1180
MD5 909bbd70c67bb782b8941687f474b3db
SHA1 a687e7d7efe6d0d6fe7b8b97fcb641e4b6712aa5
SHA512 02074e6c9c19069e3c0a743a2a89cffb1a1d9e5a512c31187eeda7fbe05aad7127bc107eac9694a3c5efed881c319b5aacbf623ecea362a883f6bdd856f10496
SSDEEP 24576:oZxLMhbo6KHgFPThMOrlANeGe+z6bX17BHpV6g:WBCKAFbhMY4eGe+GbXzJcg
TLSH
T122256B6D12B801F9D0BED17CCA878A0BEAB134255335A6CF02A486B94B37FF5613E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 16b9066d3c399a3e0f9f46dddee76d216212d13f03bcb4565168377f1301033a
MD5 97d6d9c0c29b801e0e8fcd4965708f60
SHA1 6819331cbf28f9ff71f877cb70754d93ac340aa5
SHA512 abcc528e096edd55b4211383005a7cc5f4315974ff7753bb8acdd3472234266914fbfb5b676a1d06012ab2299aa4a598f535b9d532588d4a12de7041ce2e72cd
SSDEEP 24576:hla5POZ3dpbWVM50JicR2hG0lasx2+47eidnwbW5hXSHg/ehHeRqh9zS:La5POZ3wJt2pasx2+m93F/el4q
TLSH
T13865AF5DA6F801D5E175D17DC5838A1AF5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0683538f98dedd10d461f0b60d9d8b021da91ffa52be44437e270fdf67615586
MD5 850178647d3ea131d28de473347cc5f1
SHA1 911a7df7eb6fbb0e2488da296f577abe8ef66961
SHA512 490cc2986b19705282e2267027a81441150fe834ff3a70bd96332373f6eaf187d1a82d4f5373515dca6e8e881b73e8016018e844c70e9f89df494e5752274a18
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkgW5hXSHg/ehHeRqh9zS:INc/zEOVHF83F/el4q
TLSH
T161858C1623E901E4F1BBE1BE89779946FA71786517348ACF0291811F1E73BE46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 3463b98e8d49f5876ee374dd04a99a83dfc96b0e06192c0238afb737fc830861
MD5 2ae3171a58dd21d8009c320ef34032c1
SHA1 8ac3ecad2b81192aa4b07f9d5bd98f09badd8d9a
SHA512 0fb4760621feb4713672890c79adba271b2d1b68b814c7d24c7786c76103e4856cb23081ebae8054bccb059fb5d31561cb09ab5be0a3c49e86e94a8770b3d2da
SSDEEP 12288:2QHPJnJP6szeCs6Rl28dOZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNl8:BJnJPbzB4SHW5hXSHg/ehHeRqh9zS
TLSH
T13715E06CD2A810E8E4B3D2B4815A1B5AFF31346D2F2669CB15B4D4353F12ED0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 12f8a630937d6e2d615baacafda6e933c973ae3ddaa9f10bd14f9fe032b0c0d4
MD5 d4b13bdb4c34b1c463b92e9d3ee7d1ea
SHA1 5c1d277c8eb5b9c7a02ab55fff1573a7f5cf19c1
SHA512 ed06dbfaf24054a8bad6cd23f174c863e0c8ea7244d2281baac91a6e63380dc5b244f0a7aff317df7882cabc6ab21a77d5c34ab153b4733ee61096d938bc37cd
SSDEEP 24576:hCLHGL0MoeVtFumTijCmlKQWDkiW5hXSHg/ehHeRqh9zS:hCLHGeeV5ijCmlDWDkn3F/el4q
TLSH
T1E0A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 e39c40a393597db2c20dbfc0b709f13680f345f43ef8c5c1cd145f82ae7d7e7c
MD5 adb15bdbaa740cf9db294a78eefb96bf
SHA1 8e9c3b069baa4c9d8fb598b71fe9cad5c1084e41
SHA512 c0f9526ad8092bdffbac5b500f03376229c5ce49e60f96dedd1e6d00f9ecc118a1e179220fdafe95ebd3692edc6100c6216ebe66ee4b57d9081b8da9c1f650b1
SSDEEP 12288:XxHEk/j5ZI7YZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:b/DI9W5hXSHg/ehHeRqh9zS
TLSH
T1BB05025C637A40B5D167E07E86930502E2B1B0719B665ADF07A8C47E4FB3EC9B93CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 24d45fe4b52097ab8ec324d40ad7e6fc54b91cf8047dcefcc22c45edcf630451
MD5 c5760ffc39b7417dae21fdd2cc9c62a5
SHA1 e3cc3389bdd6fda9ffc06751a67e0c0c6ef9a657
SHA512 1dcf69b717aa22153f15223532149931d648421869e838d54fab9a371ac92e4c70a41022154a1c96ed9279f9ce0e4e239d696e7997114a91609032ae77a35353
SSDEEP 12288:NG6kyPZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0tyAW5hXSHg/ehHeRqh9zS
TLSH
T1E4F412405394D495E2716AB88BB38694EA38BC206F6667CF12A1E53F1F337C6BD30B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 04802fb54d3d2dfbc8303c2eeb697477aa4fec7621a6d6f732d4b66b6ba7c1bb
MD5 a91baee04996f2b6122758ad9fc94da3
SHA1 385d3e2e30cdf6437e794460d0d300be9f6d2bd4
SHA512 91d9166b1f5b06cdac4eca0dfe0f2246a8ae8d07665154cb7d8062b08fdb34c08e5a3cf800fd8148c20d159dba80d02a1ad5a98ce8c5b83a6185ab5c10b170dc
SSDEEP 12288:duSOQZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0SOZW5hXSHg/ehHeRqh9zS
TLSH
T18BD423C09395C825E210BEF546B34F45E15870612FAF29DF13AEA83A4FB70C3BA75958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 c00648ef4b86cab9460b0e7db0637efdd067f9e3b95dbc57c7be700f9297ca42
MD5 4cea1bc37e39e6ee4eb4fa98f10e5266
SHA1 a5da5af90607018c16053c88503db1da8f388184
SHA512 4aeaf006c177cb7639451dc8fe8dbb1ec0ca5ef1f56e7ba56c223c2e9257000a575437ae1896b5954f45f2b3b6a06da1e86360c079503135598ebe6ca774c919
SSDEEP 12288:nlgl/ZyFDK3tT5Tr7aVLIH9lH3cHZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu37:nlglsoTfaidZPW5hXSHg/ehHeRqh9zS
TLSH
T161558C1DA3EA05CAE2B2D675D9721493D633B4311772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 42611a2149c49f75256e7b279b5e07a765bb299fcb3a0ff287269cef175659af
MD5 2916b10f645768a912bf5ac12f8a3a80
SHA1 6e2b7f5df991801fbd81c266a8e36a754e1bfd5d
SHA512 e23fbd81d1cc7df55d40cb538106ca374e8231208fd8d799d62444909913c31ea83bb5e5bbc2c7f71c952608b00505eda60a6596504229d578a1cbf3a89c97f8
SSDEEP 12288:RpJcm8CNDy7Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:RrcmRDbW5hXSHg/ehHeRqh9zS
TLSH
T1F305F14EB3AE40A5E1B3D17C89824605F6B37031276267CF02A5C77E4E679DA7E38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1b672e6d11ccd9b319b21690645ed3d349bde453e4b3c1e8cc4b4398809ebbbd
MD5 f609cd05fcc6b90e851b19ca1a82eb6f
SHA1 d82347a6ee62cbaecce3966c6b16b0dfc7507e19
SHA512 8ab3186d0edb8b4ee3b977d1fbd340e6c25bc110aa04a2f0f217ab58f9c403e4464869e4873d7e16d813a91af78703bd69992e9a7919dac4700da824308ccc1a
SSDEEP 49152:QDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3z3F/el4q:93Upow8sBT5
TLSH
T1EBA58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eb7775bbf87290cb605013baa3eaa367f2593321f1a7202038701a59478e6e5a
MD5 d62a81020b54bd2b7c1e5399f2c391e6
SHA1 962b82cae329e0896a41e2d665eea502a353ae79
SHA512 d7c837339c411021f64dc5762a6c3eb2ac898a8e757520294b437ddffafe3788fd0afa03ca655423606c9c027ca2f822b2f47eb0acfbe9b8a574f18898a48c3f
SSDEEP 24576:iTkNvNnaFeYhJNtmZBmWW5hXSHg/ehHeRqh9zS:iTMwBtOmL3F/el4q
TLSH
T13655AF6EB6B846E4D1FAC6B48E238512E6727461073293CF5390C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 e7c221213fd0b65415a482aad35297aa95349e2708b4cdf1403905e889c9664f
MD5 6ef3d9e0518c55834f480aab0c98c289
SHA1 36b218c8d927bd8e40c490c8c7df02f2dfaa2970
SHA512 41d099dcd3ad77b2a82c5ba2112ae5a4621c768550e6a1d0555ca6b840c033900c0872536d6e06cb004f094eaf440c18a89754b1b947f9fc49d2ffdb55222398
SSDEEP 24576:zD3FHshBIYQgAPW5hXSHg/ehHeRqh9zS:zDVHeBIAA+3F/el4q
TLSH
T16025E17DE79C04E4E576D1BCCA638A06E77138A9072266CB029481BA1F6BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 c3fc9489625213ae5369a59b3aa792622ce3114050b71e6e998d03d457818ff5
MD5 b51de148d1009d0c873ed5d6bb7d996a
SHA1 b73e385bbb25a93f1b440a2a62ed15d272fbe4a1
SHA512 c49aae4ff5de646140c08fbd758e4288b76d4a4727c4ee9dd73f2fd7d55e5f1112512c2bd044ed5e4ac191e7632116301b412d7a4a125924b334a6b94e8e394d
SSDEEP 12288:FyA6b3IkxjbBzlZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:96Uqjp+W5hXSHg/ehHeRqh9zS
TLSH
T18FF4128853D498E5E034A674CAB286159174B8321BBA69DF32DCD53F4F339C6E53EE20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-39-0x000002DE093D0000-0x000002DE09436000-memory.dmp

Download

memory/244-89-0x00007FF63DB20000-0x00007FF63DBE9000-memory.dmp

Download

memory/244-38-0x000002DE093D0000-0x000002DE09436000-memory.dmp

Download

memory/244-35-0x00007FF63DB20000-0x00007FF63DBE9000-memory.dmp

Download

memory/244-36-0x000002DE093D0000-0x000002DE09436000-memory.dmp

Download

memory/1132-0-0x0000000000800000-0x0000000000917000-memory.dmp

Download

memory/1132-37-0x0000000000800000-0x0000000000917000-memory.dmp

Download

memory/1132-6-0x0000000002790000-0x00000000027F9000-memory.dmp

Download

memory/1132-8-0x0000000002790000-0x00000000027F9000-memory.dmp

Download

memory/1132-1-0x0000000002790000-0x00000000027F9000-memory.dmp

Download

memory/1192-111-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1192-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1192-107-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1192-155-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1328-203-0x000001EE689E0000-0x000001EE68A46000-memory.dmp

Download

memory/1328-247-0x00007FF70ACB0000-0x00007FF70B1B7000-memory.dmp

Download

memory/1328-201-0x000001EE689E0000-0x000001EE68A46000-memory.dmp

Download

memory/1328-202-0x00007FF70ACB0000-0x00007FF70B1B7000-memory.dmp

Download

memory/1500-181-0x00007FF7D6050000-0x00007FF7D6371000-memory.dmp

Download

memory/1500-179-0x0000026B89940000-0x0000026B899A6000-memory.dmp

Download

memory/1500-174-0x00007FF7D6050000-0x00007FF7D6371000-memory.dmp

Download

memory/1500-175-0x0000026B89940000-0x0000026B899A6000-memory.dmp

Download

memory/1500-173-0x0000026B89940000-0x0000026B899A6000-memory.dmp

Download

memory/1928-62-0x00007FF63DB20000-0x00007FF63DBE9000-memory.dmp

Download

memory/1928-26-0x00007FF63DB20000-0x00007FF63DBE9000-memory.dmp

Download

memory/1928-28-0x0000018705620000-0x0000018705686000-memory.dmp

Download

memory/1928-29-0x0000018705620000-0x0000018705686000-memory.dmp

Download

memory/1928-27-0x0000018705620000-0x0000018705686000-memory.dmp

Download

memory/2088-135-0x0000022A959A0000-0x0000022A95A06000-memory.dmp

Download

memory/2088-241-0x00007FF64B130000-0x00007FF64B547000-memory.dmp

Download

memory/2088-239-0x0000022A959A0000-0x0000022A95A06000-memory.dmp

Download

memory/2088-136-0x00007FF64B130000-0x00007FF64B547000-memory.dmp

Download

memory/2088-137-0x0000022A959A0000-0x0000022A95A06000-memory.dmp

Download

memory/2088-207-0x00007FF64B130000-0x00007FF64B547000-memory.dmp

Download

memory/2376-236-0x00007FF7F3580000-0x00007FF7F3715000-memory.dmp

Download

memory/2376-164-0x00007FF7F3580000-0x00007FF7F3715000-memory.dmp

Download

memory/2376-166-0x0000026E206C0000-0x0000026E20726000-memory.dmp

Download

memory/2376-165-0x0000026E206C0000-0x0000026E20726000-memory.dmp

Download

memory/2412-234-0x00007FF73D800000-0x00007FF73DAA3000-memory.dmp

Download

memory/2412-156-0x00007FF73D800000-0x00007FF73DAA3000-memory.dmp

Download

memory/2412-157-0x0000018A3D160000-0x0000018A3D1C6000-memory.dmp

Download

memory/2412-158-0x0000018A3D160000-0x0000018A3D1C6000-memory.dmp

Download

memory/2520-117-0x0000019CC3DA0000-0x0000019CC3E06000-memory.dmp

Download

memory/2520-129-0x00007FF77BDF0000-0x00007FF77C534000-memory.dmp

Download

memory/2520-172-0x00007FF77BDF0000-0x00007FF77C534000-memory.dmp

Download

memory/2520-259-0x00007FF77BDF0000-0x00007FF77C534000-memory.dmp

Download

memory/2520-257-0x0000019CC3DA0000-0x0000019CC3E06000-memory.dmp

Download

memory/2520-118-0x0000019CC3DA0000-0x0000019CC3E06000-memory.dmp

Download

memory/2648-55-0x000002943B300000-0x000002943B366000-memory.dmp

Download

memory/2648-54-0x000002943B0E0000-0x000002943B228000-memory.dmp

Download

memory/2648-56-0x000002943B300000-0x000002943B366000-memory.dmp

Download

memory/2816-46-0x0000023504960000-0x00000235049C6000-memory.dmp

Download

memory/2816-45-0x0000023504810000-0x0000023504958000-memory.dmp

Download

memory/2816-47-0x0000023504960000-0x00000235049C6000-memory.dmp

Download

memory/3068-186-0x00000242BD330000-0x00000242BD396000-memory.dmp

Download

memory/3068-184-0x00007FF73D390000-0x00007FF73D61B000-memory.dmp

Download

memory/3068-244-0x00007FF73D390000-0x00007FF73D61B000-memory.dmp

Download

memory/3068-185-0x00000242BD330000-0x00000242BD396000-memory.dmp

Download

memory/3420-130-0x00007FF6C3A10000-0x00007FF6C3ABE000-memory.dmp

Download

memory/3420-124-0x000002E30F410000-0x000002E30F476000-memory.dmp

Download

memory/3420-125-0x000002E30F410000-0x000002E30F476000-memory.dmp

Download

memory/3420-190-0x00007FF6C3A10000-0x00007FF6C3ABE000-memory.dmp

Download

memory/3920-193-0x00007FF749160000-0x00007FF749631000-memory.dmp

Download

memory/3920-194-0x000001D31EE70000-0x000001D31EED6000-memory.dmp

Download

memory/3920-195-0x000001D31EE70000-0x000001D31EED6000-memory.dmp

Download

memory/3920-245-0x00007FF749160000-0x00007FF749631000-memory.dmp

Download

memory/3980-88-0x000002287BA10000-0x000002287BA76000-memory.dmp

Download

memory/3980-87-0x000002287B770000-0x000002287B8B8000-memory.dmp

Download

memory/3980-90-0x000002287BA10000-0x000002287BA76000-memory.dmp

Download

memory/4536-99-0x000001FAA9EF0000-0x000001FAA9F56000-memory.dmp

Download

memory/4536-145-0x00007FF7F6240000-0x00007FF7F638A000-memory.dmp

Download

memory/4536-96-0x00007FF7F6240000-0x00007FF7F638A000-memory.dmp

Download

memory/4536-98-0x000001FAA9EF0000-0x000001FAA9F56000-memory.dmp

Download

memory/4792-250-0x00007FF7471E0000-0x00007FF74751F000-memory.dmp

Download

memory/4792-221-0x00007FF7471E0000-0x00007FF74751F000-memory.dmp

Download

memory/4792-223-0x000001F6A2200000-0x000001F6A2266000-memory.dmp

Download

memory/4792-222-0x000001F6A2200000-0x000001F6A2266000-memory.dmp

Download

memory/4824-16-0x00000210D8EF0000-0x00000210D8F56000-memory.dmp

Download

memory/4824-15-0x00007FF6B1F90000-0x00007FF6B20B3000-memory.dmp

Download

memory/4824-17-0x00000210D8EF0000-0x00000210D8F56000-memory.dmp

Download

memory/4824-18-0x00000210D8EF0000-0x00000210D8F56000-memory.dmp

Download

memory/4824-51-0x00007FF6B1F90000-0x00007FF6B20B3000-memory.dmp

Download

memory/5440-269-0x00000230A3B80000-0x00000230A3D4A000-memory.dmp

Download

memory/5504-220-0x00007FF63F7B0000-0x00007FF63F864000-memory.dmp

Download

memory/5504-148-0x0000024E4E2E0000-0x0000024E4E346000-memory.dmp

Download

memory/5504-146-0x00007FF63F7B0000-0x00007FF63F864000-memory.dmp

Download

memory/5504-147-0x0000024E4E2E0000-0x0000024E4E346000-memory.dmp

Download

memory/5572-76-0x000001E5A9220000-0x000001E5A9286000-memory.dmp

Download

memory/5572-134-0x00007FF7B31D0000-0x00007FF7B32EA000-memory.dmp

Download

memory/5572-78-0x000001E5A9220000-0x000001E5A9286000-memory.dmp

Download

memory/5572-75-0x00007FF7B31D0000-0x00007FF7B32EA000-memory.dmp

Download

memory/5596-70-0x0000019427770000-0x00000194277D6000-memory.dmp

Download

memory/5596-72-0x00007FF61EEB0000-0x00007FF61F018000-memory.dmp

Download

memory/5596-63-0x00007FF61EEB0000-0x00007FF61F018000-memory.dmp

Download

memory/5596-65-0x0000019427770000-0x00000194277D6000-memory.dmp

Download

memory/5596-64-0x0000019427770000-0x00000194277D6000-memory.dmp

Download

memory/5808-249-0x00007FF71FC20000-0x00007FF71FD4F000-memory.dmp

Download

memory/5808-213-0x0000015C3B9C0000-0x0000015C3BA26000-memory.dmp

Download

memory/5808-212-0x0000015C3B9C0000-0x0000015C3BA26000-memory.dmp

Download

memory/5808-211-0x00007FF71FC20000-0x00007FF71FD4F000-memory.dmp

Download