Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/07/2026, 03:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 749KB
- Sample260714-eftckadx7n
- SHA256 c8966ac88629865e4baeb7c97844efabb66f6cc194a86dc21d100a0fc0d5837b
- MD5 5cdb9650fee9ef8469d576c8ceba50f0
- SHA1 ae40340be620a29db441f967e51c84f28ce83cfd
- SHA512 7cc67257366d8f6a5a409a9ea1f073cad4e248caea470536c6e176dd1b57a469801105ba93b755252b15600e6fbe14ede4b9f76756fbc4c0ef41293e220b2ce5
- SSDEEP 12288:z93G6vHzVACubvJBNDYa3cflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YTh+:zVGGTQBZIlsfNXzsQoQs/dNoQu3oSgTe
- TLSH T1EFF4121171C080BBD5230A3045B4DA71663FFD311FB99EAFB384172A5E706E29A39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4660 alg.exe 3828 DiagnosticsHub.StandardCollector.Service.exe 3416 fxssvc.exe 3468 elevation_service.exe 3640 elevation_service.exe 2884 maintenanceservice.exe 4076 msdtc.exe 3248 OSE.EXE 3320 PerceptionSimulationService.exe 3548 perfhost.exe 4460 locator.exe 836 SensorDataService.exe 2832 snmptrap.exe 4092 spectrum.exe 3448 ssh-agent.exe 4248 TieringEngineService.exe 3416 AgentService.exe 4692 vds.exe 4016 vssvc.exe 4840 wbengine.exe 4440 WmiApSrv.exe 3592 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c11da8c72d44b5a9.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006f4eb764413dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070831c6e4413dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcedbe6b4413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000484f866d4413dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aceca26d4413dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe5df66d4413dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd24176c4413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc0ecc6f4413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeAuditPrivilege 3416 fxssvc.exe Token: SeRestorePrivilege 4248 TieringEngineService.exe Token: SeManageVolumePrivilege 4248 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3416 AgentService.exe Token: SeBackupPrivilege 4016 vssvc.exe Token: SeRestorePrivilege 4016 vssvc.exe Token: SeAuditPrivilege 4016 vssvc.exe Token: SeBackupPrivilege 4840 wbengine.exe Token: SeRestorePrivilege 4840 wbengine.exe Token: SeSecurityPrivilege 4840 wbengine.exe Token: 33 3592 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3592 SearchIndexer.exe Token: SeDebugPrivilege 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 3268 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3592 wrote to memory of 2520 3592 SearchIndexer.exe 120 PID 3592 wrote to memory of 4780 3592 SearchIndexer.exe 121 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4660
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3828
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1092
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3468
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3640
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2884
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4076
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3248
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3320
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3548
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4460
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:836
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2832
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4980
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3448
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4692
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4440
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2520
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
PID:4780
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 a49e0ddcace5e70efc62a6a17c415fcbe6768e14edc37e359ae9329245e491ad
- MD5 c75cd2038d424aa96ff25159a5adc8c7
- SHA1 291b660ea3cc6c4d44dbd4d13c30dacf3359a0bf
- SHA512 4250a9129bbc182c25a47ae58aa9c1f5250078301666f9f39bf1edc81015ad19067d72876409d83f8e3a10aec39cfb21211900ea9a3957e562a2529aa2dd9e9b
- SSDEEP 49152:wVX632BuPkFKRrdE6oh7stBhuXjfS4LWxnIl6ND9mat3fo2uZM:j3q6gjB3sJ9I
- TLSH T1E3D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 3b1f17886f29fa8b193fd704cbd862948e9c1384118bb03a418cdfe7960247ec
- MD5 28b14b1c1e1db9854b65dab6d5d702d6
- SHA1 04fb8b9b4261c02fa0ae1b20f04b0198777c6f73
- SHA512 b95c80c5a428babdab2523cda5ca36266d19f9792f5d1d817b71d04b1d620f0c98a13ff535419b7eeae9b55acb81eb3e6a4eb4f3bda45a407b2c140db3d01a98
- SSDEEP 24576:bXYuACczAdlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:OCcsl6ND9mat3fo2uZM
- TLSH T1B805F128B3D409FDED1B823CC8A28512E773785547A4EB9B03E49A251F137986E3EF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 5641c0e1c278e7f7ef0a9b0d9c4662e67c1f8f795273f7d8d1e6c085627c16a2
- MD5 d20a3e425633963519f6741e82b34ad6
- SHA1 d28697c92a4bb5ce90daa7bb588e891c159f55a5
- SHA512 4a6f161953ef35b236475655d01464370e5e94d82961e0bcbf78498abfcc0ee9749ac176b70c0401836d8983b83dbeb52c78f307028e378d4c5f1872d6639108
- SSDEEP 24576:s03ewiN0VcxOrMMlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:s2iN0+oVl6ND9mat3fo2uZM
- TLSH T16245AE16F5788335D073C0B9C5D2A68AEA7230865B308ACB4286D77C7E57BE6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.1MB
- SHA256 71e7b8cb88202f5366cd9b1be5a14fb91480a6bbe9c07fd0feeb5a0ecefb6391
- MD5 0ca69c59462b570d5284460c16dcfaca
- SHA1 43a35a0c0e0440bc8da5642f4cff8470db06dc5d
- SHA512 db493432b01839bdcf2b2490ccb793a0730c8d4653385baba0e058b1c535ff20573c46b7321a8e3599b06f1657ca23d8d2716bc605e7e033c7f17345980d2c2d
- SSDEEP 24576:pAcoezSC6vUyD/aqgrvW/6q8wyuAlsfNXzsQoQs/dNv:VoezSC6vUzPvuHjyLl6ND9mB
- TLSH T1D5451A15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.1MB
- SHA256 48047ce15997af95c8dd7978e5c9fa161a1b0a7751a6103e17c2a962c396808d
- MD5 c89f4ac57363147579b2f6b9783a2bb1
- SHA1 e5b34775e33a12ee90807f5f424fe653a15e0aab
- SHA512 bc4e3cad5e196321a4aac9bc342183d158ad6278b952eae3662f1aea4cbc038840605e6fcd11a5af1c64a5f303661ba81383bfe2d54f9c8b129c820cd29e1023
- SSDEEP 24576:tab6PLWxtv/l+d2lsfNXzsQoQs/dNoQu3oSgThk1:taWWxtXl+ol6ND9mat3P
- TLSH T1DE357D66F5748331D073C0BAC5D2AA9AEE3230425B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 5140a30c73da087f89f3e6b8b5f5eb1452803afbc73707049d1e22dd422e081d
- MD5 b3b84f4cb065cc48f610b194305722d1
- SHA1 780c96b5afb477c686efb76eee0aafea77ff62b4
- SHA512 6ea3d2710346036c025abb4b1211bf2d62075512a2f249277f499c87acf036a097f0f158f30cd87bc42f805b4a7002fb992d1e26961d4ca4591c98b7737a8fe0
- SSDEEP 12288:A7/flsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLz:A7XlsfNXzsQoQs/dNoQu3oSgThklXo9m
- TLSH T1DBD42301914C1ABEE70F97344049E653639B39575FFDFE68D884BB202888A72F2B2F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 3b751ff9e90ac9369d9e120e50ba48dc103347e029c171c282593445931cc131
- MD5 130c230d576db9b69d76ab505009ae15
- SHA1 27f90e8dc09595dab15bae3501af4e8f00cfb170
- SHA512 2bda50ecc9ef6527d3eae2aa375d2e4dbaea667d513bced46a7e49fd030cf2d1bb808f4209064c752557172e997f130dc9d3f80a957ab530a2255d1c75fd1c6d
- SSDEEP 24576:TAIUSlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:TAIUSl6ND9mat3fo2uZM
- TLSH T1D915CF3BEE28FCE2C27E8D7856918600E77274714F62A3CBD165830E9E135E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 832KB
- SHA256 e68e643feaa59ba0af01359478ab2526885e4738e1e17a500f412a18814e800b
- MD5 e6e01f9d470c10562102ed0658aadeb9
- SHA1 644332424225d4d88b9fa8640e523120b597e7e1
- SHA512 1a58ffefe9f635e0f081adb549ebe4e15ab8ffb77e6de650f6d7270ac0d163851e386803df5bf9a9bcd4b5c38b6ce1f0d42b0af98a20d8aaafb28b4411a38865
- SSDEEP 24576:VbXt2hcMcIIlyEQTY3WPwWnFgcihNOqY3IGaWCh5OAJhbs5CPM1ea5946EsHCysh:VQIlquu1Gn1jKm4ptlU
- TLSH T15E056C5647A841B9E55BE068DB2EC972F7F2380602307B8B07B1CA773F77A60692D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 768KB
- SHA256 06f80e0dd03b79fd88a9a01e1462858a1a1a4d3c5e921f923a98ab20a7cc0f33
- MD5 d6dddf61f0ec911144865e038eee7cea
- SHA1 a65a16105fb8175626021eabebbd71c4df65285e
- SHA512 ea781ea4f0b6b36ef7c7388cdf6ac6002c14678d78ea442adb62d9ae963f7a3474082f17de1400ec1d52b4cfbccc960822a607834e27aecc61dba41a67f7a008
- SSDEEP 12288:GzwSfxL/2Dc3bDLLmt0LDQewsAj97flsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4F:ImewsAj9LlsfNXzsQoQs/dNoQu3oSgTW
- TLSH T12BF4DF31FE74E036C3BB0DB61B26D716146D79204FA11AC3E3E88E9E59602D26376E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 704KB
- SHA256 ec3e6f576f566143aec4c1636292ab5694bc2df2cb4bf151486c57e8cfe928df
- MD5 7d272d9a262fb9c9a4021eaa786728ea
- SHA1 70d95b1fc531c01a8646149df58db9b4b4d41c29
- SHA512 c82bdf25d92c580eb2b506b75b53ca47399643c0c1e2de8e4571a3beb0b4c31e12f7260509ee504a4323b0d6b6fb52da0c76dab3666b9709b18b1d5513228cb1
- SSDEEP 12288:Fgw0PYVKfacg8aLFd1d5FWsmhfqeenskOyC52R4fTX1:wYVsdaFd5FWsAfqeeTOyCkaX1
- TLSH T187E44C4A5B6802F9C577D198D64A9637F7F0340449356A9B8BF2C7872F3B660AA3F700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 896KB
- SHA256 c54aadbccd70de6099aa959aa2aea7482362347ae595a19fa6fce40283b11248
- MD5 ebc338205ca34d597253dba5139cb23f
- SHA1 ff78a8794d08e42073aac30ef65f08797f020a4f
- SHA512 8ac1726d1e7b27d8e05e293933e1c423afa4898c44b3eaa1fd88ecba0a62eec8764660942b8194577326dac6aa725623b8b3216c7c53549cf08f67b47c486a39
- SSDEEP 12288:rfK5Uskg2gMjoKU6aUANzA/vu2L95o5YgDa4ACTXfKqx:O5HRquA/m2z+L5Z
- TLSH T13315090A727403A9C1A6C1E99B1BD907F3B0780A57307AEB9AB14A571F37EF5613F211
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 640KB
- SHA256 0b7388fae020c36cdde380672c0c596b4c76eb90b85c80c084e7e2fc23ad5893
- MD5 bde1428c361b0124fa8b57882b348a43
- SHA1 3eff96a07c4b022d71e343a22b3c1a7c2ee478c1
- SHA512 485cba3191c7fcde7acc75152206679832c76785cbff8f5c46aba89fe1eab9250b187c0407e8b600f718f94ffa1adf636f9ca5ab5fd758b7d17ffabf82200fbf
- SSDEEP 12288:RAZ/GLvyFoiwtA5qy97S9uaYFLq3O0flsfNNh82F:RAhGLvyFoiwtA5l7S53xlsfNXv
- TLSH T188D42981E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2160C21F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 830KB
- SHA256 bb0b5920cbb86d1ca42e45a8c4a889ff5556574994dea389c609cfa667c4d282
- MD5 0e23a8687a1d68d5d5cf527f98561f2f
- SHA1 c426b80f3746c8ae2748b0741bedfb909c0d9ac3
- SHA512 1eee4b4a0220a22c536e34f559fbf589310f6d16d90eca18eda8e1e432f0b51e992d0c4f176d107bf013d464422385a2b65a01f098cf4ab79e7db7f0d22d45c6
- SSDEEP 24576:QwuuOWhlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:QwVOCl6ND9mat3fo2uZM
- TLSH T1D805F14572A80CFDE96782388547C136F7F3B8022A75DB1F5760C65B6F27361AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 576KB
- SHA256 510793e6b1320ecb728bb3d6d8fcb5fe48510fd9b0baf33c36db009e82866150
- MD5 93dff13c9a7199cd18b30d1227a06bdb
- SHA1 b4085a3c19eadd723f71f88bb286aab50185c142
- SHA512 260ba84fb8b254757d7c26bd29384dbb9a669359af422e67edefb4a12a3eba98887bf5b95bfbab43bf57acfc80f3eda5d6a771d7c6de3e4957368e762cee829d
- SSDEEP 12288:lVw1IvUflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDP:bwuIlsfNXzsQoQs/dNoQu3oSgThklXou
- TLSH T1FBC4124532E820FDD1939238C9E59606D3B330A317B987CF5564476A2F52ED2AE3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 256KB
- SHA256 0d1f9f3614fa0ed518ef87c3d950298172091bd035570f75c1c27af04ff66d1d
- MD5 1b819855900515fc1ad1d863fa13227a
- SHA1 a956fa1163435cdbb4ea18c7743e71d83b1f88e5
- SHA512 39c6d052253e86f79ed58f4239a48ba91c25987ff7605da235e1190fa24afdcb91daab806d469b3adf25d6253a1a25bc84d0144760d0658e3a94be8aea00022e
- SSDEEP 3072:ofUfOdrArk8kukm46TTWGBtrRV7HjTjQETijYx1WA/zaQK4xt/:rN7/75BZRlTjbiJ4xt/
- TLSH T128444AAEF0937492786FECF0D69A7CB25A0C547F11B490A610CAC2DC49A73CC9725D9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 448KB
- SHA256 60a1c4b8ec6a96e568451f2c08e8c90f52e72ae62159ec5b7c35317e712adb91
- MD5 0287fcd7033e003b7c4930b1b45bc9f7
- SHA1 326aa9095747392c73120fb48a58ab3b0456d9b7
- SHA512 f30b2489161f56cac73f1b4d570f2f5f9aca89eae91108c25661e45d3bb327ec3eda910d862fbfbccc2bfa62c34d24c6bbe3218684f57322f920001f13a27154
- SSDEEP 12288:9G2wvhBz5yf6SyXQWdFg9Brn/fDboL6lH:jwvLof6SRQ+rn/fDboqH
- TLSH T172A48D23F2D900E8D09ED4B9974BA132BD62B85A0B21B6DF0690C3651F6BEE4773D750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 192KB
- SHA256 5f9da824ba7aebbe627c3089ff3614f2e7b232e2714a27f69e9f04558c434444
- MD5 267fa8d814e1f835ad0ccd3bc8afe8c7
- SHA1 e8e02f6437541327c8dd9a91f8b73ecb3fee134b
- SHA512 cdeabca56cdf9df9a0cd602782b24eec87e8bc0744af5858ab477dd82d914c08cba7737edc1ec38b637085f44a3d3fc91bcb233c92a8c0f3c9ad4db5d0b97e82
- SSDEEP 3072:jZUxxdi6zk8kukm4MTnF8T9/RLjRz7zQ2SdjyzU5vfbEnvId2sUyiszx65Jd:iR7/7YTVRN7zpuYwvfQvIoWiXd
- TLSH T1F7149F3BB5E510ECD0AED0B4C34FA136A951B43A1B6065EF0680C1A51E6BEE0BF7D751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b4d4c8cb42998620db45edd79b04359b68a05b2890e02abcdb2236b38a074d30
- MD5 53f95eab7853f34b0c8db2b2ff48e66c
- SHA1 da1b5709f1f5331b0ee97dea43b863b050e70a55
- SHA512 18e158be233d8afce88b668f5d9c32b11fc3ae0baf96521fb7afdb91850a0dfeeebc3aebadc21415ef2a9285dddf11e73b13913922cbf52b0718189e4a17fbf2
- SSDEEP 49152:oR+taZ3usBWOBr4tEGp0bqx0z+n217aau1glkl6ND9mat3fo2uZM:uu6JmTxd2dksJ9I
- TLSH T154D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 128KB
- SHA256 af696f82629f7fb41b487d84cc6d444781e4965f545329632c181a872845d745
- MD5 ae9f738fb955bdefd59bdc1abb51a4a1
- SHA1 644cda00d6337bc08ca65f3076f045d6c322f79b
- SHA512 df742eaea9d540985270b0fda2561b07f4b55e37e2513666704d5e5299b5a94f05625774c164c05048395d9ae0ec7dc20767d6c2229a1e4615b9832c61f7f301
- SSDEEP 3072:rIUzed+WVmk8kukm4GTj0CVtgRhLD7z9QYSjjk:J3h7/7zV+Rxz9fSnk
- TLSH T105D39D3EA9E111A8D0AFD4F4C2AB607A5541743E1BE055FB0280C1E51D1BEE0BF7EAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 62KB
- SHA256 c4aecaca20f321c2a391839e283cbb289c35c7f3a937350723c37e83370b2391
- MD5 f6b84d37b34d4eafb19dc58902438ebc
- SHA1 a9577ee1e5aac6371a55d04667b8a6df29b6d6f9
- SHA512 9c76644c6bf99d409ce2236272c0b9b29c28835db88dc8cfbeb113d9f0692e2e2fe967ae7b9fd8032da08958501eb3a3f9af7ec42e4ff835c1f9ffbed75c147d
- SSDEEP 1536:6IwU9QGdawIp6pzjn8Uk8kuk8P41TAVqxhfu:6dU2GdX0Uk8kukm41Thq
- TLSH T1BA533C7D6EA51098E0EFA6B4E2AF61391191F83F58502AD243C4C0924D17FE1FEB69C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 14KB
- SHA256 6396f9dd4460ac7e2c4e75dfb39a9c2d7b3c2a9883b372047f954f4f54cd23da
- MD5 f8c160325fa9a9f4d50e38feccbcbcf4
- SHA1 cf42b7a2f26d7bbf59c9080f07a36ec6cc49478a
- SHA512 09baf73a1bcbf10d8accd07f0297edbc258c325f72ba44a61c889c1df37fe373b4887305745ae326e852f7d41011d262e720a6a82335342beed69861da7f62a0
- SSDEEP 192:Vv/X27wpezuQC/3siBhEd7R9VBDbK1FS5tfeCIL7efZ6:p/XJFQC/3DkKF5CInef0
- TLSH T10A623B06EEE746EAF24542B1D9B712CAD8BE7D17F682521E376C02052F327403506BED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 a8ba7e43569cb05b44e0bdffd77b6a3cb8787cd97f40234f2dce0e5305016a89
- MD5 c0c6b00cf6675d8fed6035b20b1e44ca
- SHA1 815f9d65f1f59d55a8a1a7f310a919826b94f18a
- SHA512 8a2b68f29a4ce978903444aac96265b4350868781dd8947d812c79e8752c917485be03ee84a4a378c39d6b2131f03a4264ccdffd2c8258bd45ff246679a233c3
- SSDEEP 24576:FcP4mcvIjkGOxhKP2l71zNKbrh/8KBFlsfNXzsQoQs/dNoQu3oSgThklXo92L6DG:KP4m4IpOO6768KHl6ND9mat3fo2uZM
- TLSH T1C675AE2DABDC0096D0BB917885658A4AFAB1742A1F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 320KB
- SHA256 efcdda53384e919f556711f9f44c3a85bd4b213e98cbf3ac525f45d0bff67c30
- MD5 f9d7438236a281a9ba81554129b1ae23
- SHA1 f0c659759d419e95f6efd24a1a6a3a5b4ee9efc5
- SHA512 2cced15946bb61099f0d607edc474db719a4c60bc6a33cc487038081570db29ce72de672eafd2ed74b5044eb929da1ee2d29dabefbbaef766547f531e4dfce0f
- SSDEEP 6144:MWpsmQI/XQFqTzfcMAe6+uNqQvAQq92Z2HQoTdnQidJi+LlS6mReNNi:8CXfzflsfNNh82ZsQoQidJi+LdNi
- TLSH T12764BE1AD29802E8D06E6135CB568A41F3377C2587E1D3CA63D0F53E0F766909EEAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 b0e0879cae2c06feb8b8d797aa09090459737eba19bdd4083f6528a771cb4dbd
- MD5 7904b33d926e42d6327c9375d665ec5a
- SHA1 674d8a70f9ca838133e7b1daca8fb2d33e89885a
- SHA512 d84a9e193986ba982569f9ff7d23271b5e351d30f28a189af7d738c269c1fbdc9de03ba0e542a5c066b75c2bd8aa9777c7a7b83f85b33421120beae2811e1bdd
- SSDEEP 12288:7GflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:7ClsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1FED42311E28D1A7FE50A97344019D222731F316B5FFDEA9BF448A7202984DB2F672F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.8MB
- SHA256 e0b2823398192ea229e987b03192f46f3e35fbec428c496309ee29e909d75211
- MD5 80d77518744e1426e844bce34e78c9e9
- SHA1 7e68f34243352fe6e2c978d1ec35f0ccb4daf04b
- SHA512 a0c1b0f2a4db439bd3072acd873aa4d68f102115f9a82046a35caa2b4b70e6748236fa5c88abdf55ef95d9732bb23d0f4f39df1d06c6f68b0fa5d10bc6f67a3c
- SSDEEP 49152:pa0h2GEkuAe73q3ppt6zwwQrl6ND9mat3fo2uZM:pa0hNYGtJwosJ9I
- TLSH T1C085AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 681KB
- SHA256 1c56fc2cc9cd398a38d53575e5fc21b28ff3528d2d3ecaaa3a2c89f09962d827
- MD5 9c6ef3cdbc03ca4bf9751d97d83f41f9
- SHA1 0f99f61cff3d900542225fc3286b5c968679a764
- SHA512 107affa39d7686f13c0204109460ab78c5a07b65612cc757df64b4f06bfcaca0822291c6355e90bb1bf5e5bcbf27d136a0a0b63589f0fc03c53cee24e3531112
- SSDEEP 12288:ghbHjfXfflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6o:ghbHjP3lsfNXzsQoQs/dNoQu3oSgThkl
- TLSH T1ECE4127E22AC21EDF126E27C81568607D33278261B75A7EF62C182390F1BEE59D35F41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 11bda0ff75198c76fa5e87fb7ed93b8f63632aeee9c91a07ad57e16a5650cca7
- MD5 654dcbcf38852a51d10545159240602b
- SHA1 f822048bd5da46d6ff35a83759e419163917f2cf
- SHA512 0a376695c0a5086e607efdce17d8339d7347b295ee367c53396b70b7bbcf223f212a8fc3d01706fa338a50bf193801717be0b5bc378cfea28f0f06d9c2287229
- SSDEEP 24576:40IgyacRTk4yti+R5dUR/XlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:4LgybTk46pUR/Xl6ND9mat3fo2uZM
- TLSH T17F45BF2DF2B910B9D8AAD236450147B5FB71782D1F209ACB0174C538AF0AEE89F35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 600KB
- SHA256 fa533b14d816891db89efc29fd4908673cbc458b375eaa8f4a2cf980bb13f30d
- MD5 f6edd0c3eef958a496b730833b818183
- SHA1 9072afcd8703b110bed71f989a7db24d488c86bb
- SHA512 38269de9ca0e6d3103bfc4daba5d2bc73b421e44ef186b0f17fd97a8eea5ad59abe7530e2a591232d2ffe5291934a929653ae0b98e5ac871a5d3608dd458f2a6
- SSDEEP 12288:aFflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:aNlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1CBD42340904D1ABED50A9778410AD352734B32575FFEBFA9E488F7211A889B3F272F94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 963KB
- SHA256 82a3f4b5bf82e5de93ab8e75f35134d8f65ae061182af80afdda8531576343d8
- MD5 82ade75452e37cc6bab2369868338a52
- SHA1 46d75d2a9a4aafa54b3f786382b3f5afd6189522
- SHA512 994438b1e566dd4263651f98989e2bb3e66eddcb680f095223f8fef11b23703f964992e34e2b75cfef92d06e263819725dfcea7b088e90bcf35785151b8a2b10
- SSDEEP 24576:azL6UTulsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:azL6U6l6ND9mat3fo2uZM
- TLSH T1A725F155F69800F9E92BD23CC9668616E372745D0764EBDF03A88B651F437E28E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 693KB
- SHA256 1fb91364f33ca2a888840383a0d0134dc524525826edeb62a0a861a0afb342c4
- MD5 07c44092fe80b30a7afedb403fa97cf8
- SHA1 f1cefba4cf09df2b1b676be91f3c1c412e886a07
- SHA512 975818cd643853419b14a6ff9fcf31bb7556e9b9bf10a4d5d11ed3fbdc8be991d1e6917190a91aaa1ffa1786c53e7799e5fb3bd3e941eac5bd493105aa5e58c6
- SSDEEP 12288:ipFtzOAflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6DM:mOklsfNXzsQoQs/dNoQu3oSgThklXo9m
- TLSH T18FE4021932DD10F9E12AA23C8546930AD37274660B6667EF46D0827E1F87FF4AC3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 5702b91fdc5cd7aa3071fbdd107ec73e04aaa87feb7443fcd8f53a5201c39041
- MD5 fd8b4a46c7bf59ce862eb68eacfcaa02
- SHA1 f1e6783265a2d5253574b5ea2ab2d94d2acc629e
- SHA512 fa155026d573297dfa143b32fda0ebd8692540a67dbaacac6bbe2709d4dfada9fb6e4662768fe1ab6a1a0df25c3668762d50b709b63444fd9c72f71bab8e58ae
- SSDEEP 24576:57NM9YeZqmWMUkPjZM48Mv6bEhs4lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:57cBWMpPjN8DbEh1l6ND9mat3fo2uZM
- TLSH T17F65AE2E6BEC81E5D477D13DC9928206F2F2B4611B318ACF5152833E6F27AE45E35B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 76e68550d1df5eb403edfdc9a6dac24155f94615ae6a6e55da5ceed25c210923
- MD5 a5e50c3898a6604db4370ecf46b605ec
- SHA1 6c4085e7815dad881a7b8b9062a14c0e1cff1043
- SHA512 d25afc7b1c827d77cafa84774f94ee2b4c5d9ae5df24c5d4f1dff400cc17b82f7dee9559db170668e6bd8cb17456bc3cc2bd0641e2419be2f93a0d17621d717a
- SSDEEP 49152:CF2YuHNETovIvNYf8km9l6ND9mat3fo2uZM:L6ZCf8kusJ9I
- TLSH T182858E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 6bc41712222cf1aa1aad175d53a642f622103cbb1e34bf73f31f6cb56370c27a
- MD5 659169e19f2cefb181c6a68d4c49aa08
- SHA1 2fab8ae909c549dc69de0012c809f899012e602f
- SHA512 d923cc7a9f7781d62e8ab22e6f236cf9668cafe2d0920244a2b47466922993102c16c8344d6b6ff875581cfca851ed16c6f7a7f2bdcd0bd1adfc797f7ebec229
- SSDEEP 24576:FAFs06+OmlfzNXEbTo0lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:KFs060lBXupl6ND9mat3fo2uZM
- TLSH T11E65AF2F62AC00D9D07ED17D8997C91AF3B1746707256ACB0160863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 907KB
- SHA256 8e2756e0c658fc8a912f5a07a5b3dcd9dc3ddf0ef27b614e2e60bc990dcafe08
- MD5 205e9f683fd2652df9aec9708a784754
- SHA1 4fd4b8885853669d1d716c15f85361b68847f87a
- SHA512 90aedb16a7d97b29544a75c29586d5488b76ea3ac19c60115a7d3f128db556e1ad859152c161a279024d4bbee21a392d0154a395b96dcaee68b9c6d32e1d25e4
- SSDEEP 24576:VJnJ5D3W2alsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:VJnJ5DG2al6ND9mat3fo2uZM
- TLSH T15415D02DD2A810F8D4B7C274815A1756FF72342D2F266ACB68B4D5353F02EE0AA79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e2f5d9be69a87f789b7588b775f9c5d7f1e39c3685fac7325c5d96c086336a09
- MD5 cff8b6d68211475446c5aa1dc29ff449
- SHA1 45a29ab6fc922e2fc696dff2df97cadf66b30824
- SHA512 9e7fc68b03287971a0a8be2c8d0affd441f8e60b55c189f67a043eaa9441cc8ecc0672275d3b9f8bc55864943b9c701a9ffafed5f27e4404cdbee38f1d5258f2
- SSDEEP 49152:eF06DIKdwc+eQnSt65aVil6ND9mat3fo2uZM:ugsJ9I
- TLSH T19CA56C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 682KB
- SHA256 ec1641f6ae5430a6a70d29bef4ff717e0316d2231f2f8737a87eac9d908f910b
- MD5 46bae5be2ff400de5e79d55330463230
- SHA1 936374e3620b5e954a4c42f9654730986ac386a4
- SHA512 4f2c815d3218870a42a096fce2a846664d9414562b3e6ddd78e581342ae07df44cd52e2ff0021e7f60931462b71f35dc268060b4b24b53ccdf45e708c94389dd
- SSDEEP 12288:4EP3RizflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6DM:TiDlsfNXzsQoQs/dNoQu3oSgThklXo9m
- TLSH T17FE4126D669C20FED11A913C81918205D3B3F0722BA66BEF56D0C23D4E57AF66E39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 734KB
- SHA256 04de35436be4275f66b31e0ffb1a7e2f33c363d4d97d2612eb2d3eb982d2695a
- MD5 2a58964b637b3702119553f201dce6e3
- SHA1 d01f011911f12f3758d310b56826a905e59fa3dc
- SHA512 7eff0ffd356267ffb3ff81aa44e88178bdb56dd09856c0bddc92ae265c0acea9235f4452efc8642d556e41c065c35194cdf99ff32bbfa009d0e5e5063ab43d2d
- SSDEEP 12288:kjkybTflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1W:kIy3lsfNXzsQoQs/dNoQu3oSgThklXoc
- TLSH T13EF42204638C20ADE66A473885638291973A7C215F75A7EFA0C0F73E6F75BE1A931F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 605KB
- SHA256 f18cd40f35a255b6b1d9d3ce842c1e1f4525d275826a080f328e4ffa4874827b
- MD5 eebfc1f1a469c3cf96faee0642e75379
- SHA1 9f3d2524266851205ad8a3714f7a67dd06463856
- SHA512 f55af7af8df34b84933897776b1780b1cb48660097912943d29d2342666698c1252114df6c47c24b159c442861ca7e55e44e3b9072dd5e504c216e8463b4701c
- SSDEEP 12288:SSXflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLz:7PlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1CED42308614D25BED50A873841199752636B30671FFEBEBFA4C4F7315A84AA3F273E84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 fedfd55572f8c9ed612ac8e84e5ebbd81c65a582be62454ba8e7a4aee9259264
- MD5 e8cd74373ace9c52c3d741c800b65c7f
- SHA1 5f8b43baa52a3a71eb566cb173c20b4177b20cf6
- SHA512 37d90fe92869ff2002a1008f8007e3a7a9c2317037858ec7c0b6b525dc36dcc5b0029dc74a3905fdc9b187d4e8b9b2734755fab4e68d9a561fda93b7e73d995c
- SSDEEP 24576:9Q9MxZKdcz9ew3qlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:9VKiql6ND9mat3fo2uZM
- TLSH T1A6558D2DABE9059AE177D239D4A250C3A633B4311B35D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 794KB
- SHA256 d1a1130278ae8a339ddeed15c830505b1eaec3eaf386acbb6c6857518b1e756f
- MD5 5ccbd52b9e71076c1e174ff1ae68c479
- SHA1 c9ac6f9379f6969082ce51d3801110e1877f0a69
- SHA512 1dae055c526dd180e642dccb2a7dd6baf500b58efb9e01fb47a54ea11f7b19aaf1fdde6eef63811fce6bf54620b4246d9887be46618b368b3911f9dfeda0fc61
- SSDEEP 24576:8yoc8ApKlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:hoc8ApKl6ND9mat3fo2uZM
- TLSH T16405F01FB76E00E6E126823C89858345E7B370311BA267DBA591C33D4F67AE9BD34B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 439bec17339cde01be187f9e2b0afa57df6a8c4c7cf44afb45f0064da62c59f6
- MD5 77a84037ce7abc7c50b1f45482be41a2
- SHA1 4829815a9ce496724797b17c599794fe552ca337
- SHA512 69a5355b941578f7d2c7ae2700e77792b3d4c6d4532259fa859c24652430ed9cb729b8fd2d3b5e334056165455e7a44f487486efd004a92c0da801ee501a0bf4
- SSDEEP 49152:64cnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKal6ND9mat3fo2uZM:m0zuNIasJ9I
- TLSH T1EDA57C3DA2AC00ADD8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 342d8d276473acd64b7a5f1fe3c39e8e1bca74e06538683d3f99d8ae4332d2a5
- MD5 e87d1ad302e598071e8eb1dab361f546
- SHA1 f109e7736c1bd32d5b99fc371422a3501ffb34c6
- SHA512 84fa8277c3614128e4ae243a9e9671fe5463315e9b29ea356f22197868273126931fc7ea6c69d0030483a3b6025e96163276fc9213bfc2327f4325f1d9fbd7c2
- SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYhjMqbEwlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1M:STDxR+N5YzTTjMSl6ND9mat3fo2uZM
- TLSH T13555B02EA7F915E9D17EC5788A23C512FB727821073193CB42A0C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 899KB
- SHA256 5b4a9229d348fb44f8813318807be52ed9b164c851b8170da0a4a6693e679205
- MD5 0a1cb23816753ed5beee8337947f6467
- SHA1 05700a43bf75aa704a67003c45209876f057c0e3
- SHA512 c93106d21302ade4b5d651b61f9837c81cd5d8bf7eb49e640ef353aee7bd0eec3f236b9afdfa9f9880d7d30d2d76fa23eafc4cb4a65ba495aa370f30d121ccf5
- SSDEEP 24576:hTMdOz0FFS+HmSLulsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:L0K+HmSLul6ND9mat3fo2uZM
- TLSH T1D615E13EA35D14F9E53BC27C96438906E67334660322AADB06D0C1792F5BEE4797AF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 657KB
- SHA256 bcec0a069c4ee74d7c49bb44730cf015f5fba31afd052f72b610d814d839bc45
- MD5 c35aa6b0af6012ffeff53a89968a61ab
- SHA1 ddfcbbcdf9ff6694174d921afc277f097b8eb931
- SHA512 b2fb2ab1348d484674a3eda8df92a81020a5fec41cdd9b4507dfa50331d98d2463685dc45858f9f8fb76d085aa6724022b2a05b798c56674180e2a5d05b9e093
- SSDEEP 12288:Sh72flsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKf:+ylsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T12EE4120D63DC30EDE416933886268212937278361BB9ABFF34D4DA3A5F56AE1E135F11
- MD5 SHA1 SHA512 SSDEEP TLSH