9ba288eb4983c43b0a8f06fede646c4de3831824749bd50949e050c12a073c1f

Analysis

max time kernel
150s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 748KB
Sample260504-n2j6fset6n
SHA256 9ba288eb4983c43b0a8f06fede646c4de3831824749bd50949e050c12a073c1f
MD5 ad5c7aa13cf03a2e8c6d62af7899dd1b
SHA1 ed959332a371f6153634fee24fcf609bbf903bcf
SHA512 010f200bd40e9030f16b92d70cde121c44e98c16ff1c9949b91a23279eb8051bd73db5f278e1cd2ebc0cc8e53f9f3ff4dc00380488d7e485a9f32dfca925c3dd
SSDEEP 12288:T93G6vHzOASubviBNDYa36TwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:TVGGTWBZq0a1aytr3keO/nJNv03
TLSH
T109F4011173C188B3E4B6197406B08AB1353EFE713F2095AFA3941B699E30BD25A357B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2548	alg.exe
2504	DiagnosticsHub.StandardCollector.Service.exe
5648	fxssvc.exe
1144	elevation_service.exe
3092	elevation_service.exe
5640	maintenanceservice.exe
488	msdtc.exe
1644	OSE.EXE
2988	PerceptionSimulationService.exe
1836	perfhost.exe
4540	locator.exe
3960	SensorDataService.exe
2708	snmptrap.exe
2356	spectrum.exe
384	ssh-agent.exe
5200	TieringEngineService.exe
4036	AgentService.exe
1620	vds.exe
4952	vssvc.exe
1708	wbengine.exe
3440	WmiApSrv.exe
788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\55904aa3da180f68.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaw.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbc67fc0bcdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006479d9c1bcdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e76ba7c1bcdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072c0fbc0bcdbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068f2b3cbbcdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e6345ccbcdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	5648	fxssvc.exe
Token: SeRestorePrivilege	5200	TieringEngineService.exe
Token: SeManageVolumePrivilege	5200	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4036	AgentService.exe
Token: SeBackupPrivilege	4952	vssvc.exe
Token: SeRestorePrivilege	4952	vssvc.exe
Token: SeAuditPrivilege	4952	vssvc.exe
Token: SeBackupPrivilege	1708	wbengine.exe
Token: SeRestorePrivilege	1708	wbengine.exe
Token: SeSecurityPrivilege	1708	wbengine.exe
Token: 33	788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	788	SearchIndexer.exe
Token: SeDebugPrivilege	492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	492	2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 928	788	SearchIndexer.exe	103
PID 788 wrote to memory of 4804	788	SearchIndexer.exe	104
PID 788 wrote to memory of 3556	788	SearchIndexer.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5916

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5640

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3960

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:384

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:928
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2864 2876 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4804
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2856 2840 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 30c9f72596c67834d968454aa122393ea2cebe352dddc5d7d77106fa75ccbbcb
MD5 c2a7f564136dcd1b7a1c67c45aa52f3e
SHA1 15c485f4a567359a264d7fd06486ac780810d54a
SHA512 d9543dc8313c7b6c431faa4be81bbd1b8a89ddc92ced26263995a7c4816a219142676f9e3882a03c1b8254804feaf69002eff567c8bd76200b73c7ff76a5be2e
SSDEEP 49152:5b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnSetr3mJh03:P3q6gjBt0mv03
TLSH
T146D59D03F29900E9E06DD1B8D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d47a4b012ca1f0a970c67691f369dfcbb2f4cbfbcc5ea52e6ad2228397516726
MD5 3cb8685777700f0448a1f5b0012dd428
SHA1 9d9a9838d6d9f4fa8eab221213a03627fd31b9f3
SHA512 85685d3f7f79eb8afcbee10e6978a0d9fcc62d1441e45155c72ce1bb82c6ebce1e5a882cc851c148a682b1fd9d64603c388bd615d3231aa42a518c6d860a3a15
SSDEEP 12288:w1XLsswWkxy2lRq2czABTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:mXYfDtczAB0a1aytr3keO/nJNv03
TLSH
T1AF050128739109F9ECBA81BCC9A28515F633BC915360F35B03E489655F237D45E3EBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 9ef9edc4ded82265b5b1b6bb7400c3631dbe7102e91691fe01176f677523bdab
MD5 de2c91fd48838a6064ebf09451a6524f
SHA1 06354bd08eadf4148c6b2357afbc101bdd33ca6f
SHA512 e283ad08e39be3c7768bbe5b9e4af8ffda6def4db2fce32f24499a52b4598f82b6655d427fc7e219f5e87f82770ca442b8866e17553895e8e3c69d46b9d2f0d6
SSDEEP 12288:Smw5HEjsChNYBFgl0WSm+CJTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:LwuROW30a1aytr3keO/nJNv03
TLSH
T1B005010973A40CF9E5BA857C86978536F7B2BC123620D71F1760CA5B6F273E1AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dca30750914fcb37853a8ce953e0039812ab9478f2f49e37bb268f236df377d6
MD5 9442b45fcf3cd0bfaa55eb88d9fa023d
SHA1 aabc2e7b7fefdec91668ff30b5fa5e3e933e055a
SHA512 62ef05695c3e0cb9f7f0c8b0bfa948dbadc1f22fb3fc9ce3cc15af2eca4fce0099334ac53a177282004277fab3bb11eb39f7f421236bbca483cdced5a72733bc
SSDEEP 49152:TB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1etr3mJh03:lu6JmTxd2d10mv03
TLSH
T1C3D59D13F2DA01E8D06DD478974A9233FA62BC491B34B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f4defb87ee985b2b0854f9161041ccc498fb336031b394a0d733d542961cb414
MD5 336dedaf3a6809c1e7853dfc64fc393e
SHA1 3f906b6570cd61ce23ac67b2790ac1e33778b407
SHA512 bc772c3cfa67351cae8d040b857daf9b31482310cd553e49145f05aba68fe06e5792208489c82258d33076a2f2c1d435dbc4b5559b72d6f76e7bdcb0a164117a
SSDEEP 12288:JBTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:JB0a1aytr3keO/nJNv03
TLSH
T189D42305B3158ECAF0FC69FC16B6066D313EAFB27700A12AF8540DA4A616FD166713B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1c490b5a735b535debdd60d3f64d2a167153bb5aba61b1d725f31d1762f138b6
MD5 53fb0f923e43c3b89a9c1a3e798cf1a0
SHA1 f5a366a647f674b642f65abe1f793d329a2e63d1
SHA512 a2793b62c0471670ee09e65a4dd30a77ee1d6e2af9dbb67d8d7fd57aa3064d95d7e7bfc74f4ca5bae480443324eec2c4cd79347deef08205045a4351fab6fdd2
SSDEEP 24576:jlRMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCA0a1aytr3keO/nJNv03:xRZwQCyiHiQEaTPnMsetr3mJh03
TLSH
T1FD85B01E63DC46A5E0BAD2B8CDA74407E6B278165731A3CF1190C27D1F27EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 44e39b15111f83b0bfa1eecfe767b94572e62cc350b9fb85da4886ac819ede9e
MD5 677ee3cc99edb64195b9ca00a7bdc9b0
SHA1 f5dd35b6eda57cd5cd5b24185f972af8578fe4df
SHA512 ebd4a979797d658175bcb49df069081abf22dcf2106d0bb66cac72f2ef6486710fa8209f9325418b6a516070c813da522a071b3fde2d071ebc61d3308c0e3531
SSDEEP 12288:2RxA1U7KSTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:2RxA1UGS0a1aytr3keO/nJNv03
TLSH
T1A6E4021E635C19D5F0B8A5BC89E24209F332BD663310A3EF649086794F27FE15D31BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6492490c3f1924750558c5ccd1f463391b667dd62e6ac769b97014acd3b22f58
MD5 60dc228087c5bf3ae748401e3aab9bf6
SHA1 b9c72f880f6f5eed103554846d6fe2c059a0dfb3
SHA512 1a9ec43e39ea6c6c8c84fce725643198c467a81ed4eea300c12413265e14cdb79a724ea354dd7837cfbd99d05ca314dbb2f8a1e3e5df6bc05cf6e5787d8c9f31
SSDEEP 24576:cjsmP0yHaqrVqHra44KDzM+rn90a1aytr3keO/nJNv03:cjRP0yHfVqzlA+rnCetr3mJh03
TLSH
T14755AF2EF3B910E9D4AAD176454107B5BB71782D2F209ACB0170C634AF0AEE49F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 f73ba480e74869f538a91dbe5537eae310bac27e0555d853364a5ec4f265a2eb
MD5 ae7cef645df15f06c63877a5c4470fb1
SHA1 036f5892bfcc15ebdefc184bb6e2193b032e29cb
SHA512 a6d16de8b1665b98d64f318195683711965b228d02e450adfb17d33de342f21ad274be2e556fa6bdc85d12ec67fc71882e8f7d9df6e359bbd741e9793c9223ef
SSDEEP 12288:6WTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:6W0a1aytr3keO/nJNv03
TLSH
T1A4D42309B3168ECAF0FC6DFC56A50B9D313A5FB672007129B8A41D64960AFD262612F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 1362a2e1c4a492d579215744a3578523596c44f570ba1ca31950b5aa24d69851
MD5 0ea7beb4b32c154dda0936d41dd6992c
SHA1 4ebee18322766028e5b78990dffabc500a642910
SHA512 42ca9f69bc5d76a1a72992e8522c60af9e0ad43c89b4efb5bc2c98758674e425d9993a274de1ad7d2d552db673b4d3bb27a6d11bd93982c15f555f1349890301
SSDEEP 12288:tObzA4LWO+vAYFTSTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:KHLBUTS0a1aytr3keO/nJNv03
TLSH
T10C250215F79504F9E87A917CC9B28A16E232B89D2310E7DF03A84E651F137E24E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 bd5a2c1706176326d95202be83965421ea12a6aedbd069242adaf76664d2f5fa
MD5 13fc144a65ae690621658609340f7971
SHA1 2ee9521cb44380f62f67a8776fd8db455a78a4a7
SHA512 20291011cf31b0e765353e06d6ec493166739894cb2961a3a42e6c80f81683cbdaf10deeab44834f824255b2f62e819e2382d9e10d3097d6fc2acc12c5b9e9fd
SSDEEP 12288:J0VmzIYNvUyBpOTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:2TYNHk0a1aytr3keO/nJNv03
TLSH
T19A05F11E636D0DE5E57FA1BD8AC28609F23378A62311A2DF04B0827A1E07FE57D39751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 2c2843e2c81a11292d2e16af5bb17436f11fd4cc09d2d1a07b3e38c9d5747906
MD5 cd8d226ec8a115b267872793114879ef
SHA1 0bdeb757d1275390b5eade9c955961c6986c1d5d
SHA512 fbc2a3053cb43974d6986bdcaef663d7c1bab961c361961a8e4a60fc92a94a016b75436545be09db62914e2efaec6e3ca00d3b56b00b16536ec9d19e7c75e40a
SSDEEP 24576:enXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKd:enXoJJYH84VVS6AmEFJas+cHBjSSKHPt
TLSH
T16765BF6EA3BC04E8D5BAD17DC5C24506F5B278622321D6CF026182BA7F17BF16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f5ac649017cad012952315fc8aa333cafdddd20bec02b1c45b05af02abe6d227
MD5 682f14f9b52029ebb2924492729d31bb
SHA1 af3d177cfedb6f324d37dc33fd076b05833fb0df
SHA512 e2301c38d4236742acc1fdea24df53618271196be8cbc7878684946b6fde3ecdffb4c3d41156669a64fe50e3feb09186ccbd18af9512a55db442c71e5a2673c1
SSDEEP 24576:kv7Xbxd9Tuycf8M/TYlSux/r2PCa0a1aytr3keO/nJNv03:kDLL9TuJ0M/TYn2Paetr3mJh03
TLSH
T1E2858D1EA3EC42D4E0BBD6BD85B79146FAB2B855273091CF1250856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 25135063e19a2201d7776a2fe749a0915d4e0c25c6681fd894552d1bd7db3506
MD5 c82e8c3e9540873fa9e2bb97ffeebadb
SHA1 8a21d18352fa253e61357db884cfbd4e0c479ecf
SHA512 79cf224c2096a10dcdd25bbf6cfa9d7172d14c3c6c18ac1471951ec08e2cb8f37fb6f435e69d33b52130c312d5e3bdc68c7d91c9bb431ca65f1fa2117b9c6ec8
SSDEEP 24576:RegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wOXp0a1aytr3keO/nJNv03:RngOJOmPOHFletr3mJh03
TLSH
T16855CF3FB7BC05D5E07EC17D8A928916F6B1782213255ACF01A0867E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 3d21b674592f3ac13588edc9e1841a16399808843e1e3b7ca5b46816b01e1fda
MD5 3188ba1f8c7404c6a974d8eede99fac2
SHA1 193ee52327a1da67401a2d61c1f65429501eb602
SHA512 9bb2fd0ccfede2bfb3b1958a8d8b334d73699efc3e3e8fb611dcba6977ea9a4328726ce59451f7862c2fe37580ae41512d4012490d9b04d99d258ec6a20fdba7
SSDEEP 24576:eLJnJiTk3R3waE4JrOZ0a1aytr3keO/nJNv03:eLJnJK8R304lFetr3mJh03
TLSH
T1D015D02CD2A810E9E0B6D2B4825A1756FF31347D3B2169CB59B4D8313F02FD0AA79F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6abcd9e10bc004ef63b7e80c895908514ced7d19af5865d2bb62972df0a89b1f
MD5 75edbca1503a0e6aee97240336e8fb29
SHA1 d115d155d13411d861cd86ee009d41dfbd95305c
SHA512 4976116b4102e5ed2ca59ede5e56af280e1d1eb9af618102c8b022db0b58aca29726b19302dfcea87f099a290692868a2df4a6d67da3fbdd564f70faa54a5eed
SSDEEP 24576:zA9EqCceDQncA/BmlvLto8cFVr9og9P/Z6pi0a1aytr3keO/nJNv03:M9EqCzDScAZmlvTcFg8Ph6petr3mJh03
TLSH
T11BA55C05F7EB5298E8B3C9F1C96294169B327C509B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 8716bd5d137c017d6599e234ccaf66d9f56ce42e8ba3f4ef62aeb87e6f762d21
MD5 b0f944ad08db84bafc8993cbddbade8e
SHA1 e92657f6c4e0836c6a5967736299715a8659e186
SHA512 6e1cc038ac45304c0f70a73ea2d206bab49ca78e46fbeedd92bf04f050f84a449b3e5f467fae506dea8ddab29bd044ab67258fd892bd33aef223b5588356b84d
SSDEEP 12288:dlYJeXm5nkEUuEUTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:dlYJeXm5jUuEU0a1aytr3keO/nJNv03
TLSH
T175E4020D731965D5E07C94BD96A20A59F332B9B2330163FF94E089798E07FE22E35B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 72910421954ce393e1771a2a2975b9a99a76a7c628f35a0c2eef379284ee5b9e
MD5 a4b6f48e5a2cc898141d04f62458854c
SHA1 901fd3963093defd107204ecb329e799b69dec7d
SHA512 575125f9f7a0557906bc5719e9fed52f9cc3ffccd26f22099d716fb1027b8b5d623dff6433719b33fc2c2954ff942fb4e1dbb58adb4a5fe8f117b35e088a7361
SSDEEP 12288:tOi6kyYTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:tPtyY0a1aytr3keO/nJNv03
TLSH
T1ECF41204735159D9F0FC19BC9AB302987A39BD317B0092EF64D0AE3E6E36BD16530B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 c92f1335369526e8dd9d78f46e9fff5f9ebcac62636a96c2b2af89b4d2fbbc2d
MD5 0e3a8bc8c8281fc5669fb91c647320d5
SHA1 bce609b366c20d29c9f582ffe930cf310c7637a6
SHA512 46cf9114e5eb0ae3e890c03654fe4133c50fd88b6f3afdd1bc4ca3c516eb494b0e4e567a048d7ea48a3cbccaeb9701a7a17a541e29c9739b5054307972caa49c
SSDEEP 12288:lpaTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:3a0a1aytr3keO/nJNv03
TLSH
T1ECD4230973165ECAF0BC68FC56B60B99313A7FB27100713EA4E45C74DA0BFD262616E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e31540f76910a5f3bc19a5301561df9c72e634f54f6d38eb7ec7fb3a4b570ec2
MD5 8e34fad26dd1cc93c97e4f51423e50df
SHA1 56676053b2ea22737fde28f61a5c55641f938aa4
SHA512 37480772b576e22f081fe6516c43e6db69a7dcdf413ed6ac7b8ec48806d1df360179a97a0e814d6ad26f4142fcda77e111dae03eac0e8ae48ec62cd3f114705d
SSDEEP 24576:8C+TyQIu93VAumZrHjmE0a1aytr3keO/nJNv03:8/TfIq+ARetr3mJh03
TLSH
T1BB559D1DA7E91DCAE1B6C575C8A34493E633B872236196CF2044C07D499EFE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 ec5a22144606dd8952016c76ac492b1e05d13332e5c335eb9d33f50e0bb50433
MD5 8e4e1d7665fb6c480ac7f735ed72bbd9
SHA1 fe1c7bd91551e90e57e16a1ea5ccd74b12eb2d97
SHA512 d89add50fe01b28e4f88f4b501bd37848403a55df1796b4413936b8398efe5bffdafc9a1aaa58782971d013ff63306f4f061470fa3311b2bc39bf96ea6ccd822
SSDEEP 12288:icyrWOstaa3kcshTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:TLQikZh0a1aytr3keO/nJNv03
TLSH
T19805F10EB36B00D6E0BAC1BC88950256F6737871731163EF45A0CB794B57AE67D38B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 28ee89912a4c6a1645dd41971e9729cfc9d271925717073e5977d69b11cd6696
MD5 22bb5672410f9080408966bff7b23442
SHA1 fac8bb748319a3cb7df9ab2e3ff4165787afbb6b
SHA512 9b748a1c37734531b2f8c73a8caeaedd30cbff457693e72d0c59a1e419611dbf1f2ff569460078ba8aabff98c31dbc4ff8921eb30a7f54db9637c823ce7549ee
SSDEEP 49152:apJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPletr3mJh03:3pC7b4+80GTLS0mv03
TLSH
T12DA57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/384-159-0x00007FF7B7BE0000-0x00007FF7B7DCF000-memory.dmp

Download

memory/384-158-0x0000023170990000-0x00000231709F6000-memory.dmp

Download

memory/384-157-0x0000023170990000-0x00000231709F6000-memory.dmp

Download

memory/384-225-0x00007FF7B7BE0000-0x00007FF7B7DCF000-memory.dmp

Download

memory/488-76-0x00007FF624C20000-0x00007FF624D36000-memory.dmp

Download

memory/488-165-0x00007FF624C20000-0x00007FF624D36000-memory.dmp

Download

memory/488-77-0x000001CD0BF80000-0x000001CD0BFE6000-memory.dmp

Download

memory/488-194-0x000001CD0C000000-0x000001CD0C00C000-memory.dmp

Download

memory/488-193-0x000001CD0B7D0000-0x000001CD0B87E000-memory.dmp

Download

memory/488-78-0x000001CD0BF80000-0x000001CD0BFE6000-memory.dmp

Download

memory/492-0-0x00000000000D0000-0x00000000001E7000-memory.dmp

Download

memory/492-111-0x0000000001360000-0x00000000013DA000-memory.dmp

Download

memory/492-43-0x00000000000D0000-0x00000000001E7000-memory.dmp

Download

memory/492-7-0x0000000002BD0000-0x0000000002C39000-memory.dmp

Download

memory/492-1-0x0000000002BD0000-0x0000000002C39000-memory.dmp

Download

memory/788-231-0x000001AAB23D0000-0x000001AAB2436000-memory.dmp

Download

memory/788-239-0x000001AAB32F0000-0x000001AAB3300000-memory.dmp

Download

memory/788-232-0x000001AAB23D0000-0x000001AAB2436000-memory.dmp

Download

memory/788-255-0x000001AAB33F0000-0x000001AAB3400000-memory.dmp

Download

memory/788-235-0x00007FF6BE0B0000-0x00007FF6BE3EE000-memory.dmp

Download

memory/788-300-0x00007FF6BE0B0000-0x00007FF6BE3EE000-memory.dmp

Download

memory/1144-47-0x0000024A9ACA0000-0x0000024A9AD06000-memory.dmp

Download

memory/1144-46-0x0000024A9AAD0000-0x0000024A9ABCA000-memory.dmp

Download

memory/1144-48-0x0000024A9ACA0000-0x0000024A9AD06000-memory.dmp

Download

memory/1620-189-0x00007FF68F250000-0x00007FF68F50D000-memory.dmp

Download

memory/1620-281-0x00007FF68F250000-0x00007FF68F50D000-memory.dmp

Download

memory/1644-90-0x000002CF26020000-0x000002CF26086000-memory.dmp

Download

memory/1644-89-0x000002CF26020000-0x000002CF26086000-memory.dmp

Download

memory/1644-88-0x000002CF25E00000-0x000002CF25EFA000-memory.dmp

Download

memory/1708-208-0x0000023344530000-0x0000023344596000-memory.dmp

Download

memory/1708-206-0x0000023344530000-0x0000023344596000-memory.dmp

Download

memory/1708-212-0x00007FF7FE0C0000-0x00007FF7FE5EA000-memory.dmp

Download

memory/1708-291-0x00007FF7FE0C0000-0x00007FF7FE5EA000-memory.dmp

Download

memory/1836-185-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1836-106-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/1836-113-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1836-110-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/2356-148-0x00007FF7693D0000-0x00007FF769693000-memory.dmp

Download

memory/2356-207-0x00007FF7693D0000-0x00007FF769693000-memory.dmp

Download

memory/2356-234-0x0000019EC6880000-0x0000019EC692E000-memory.dmp

Download

memory/2356-146-0x0000019EC6280000-0x0000019EC62E6000-memory.dmp

Download

memory/2356-147-0x0000019EC6280000-0x0000019EC62E6000-memory.dmp

Download

memory/2504-27-0x00000260C2410000-0x00000260C2476000-memory.dmp

Download

memory/2504-26-0x00000260C2410000-0x00000260C2476000-memory.dmp

Download

memory/2504-96-0x00007FF644EF0000-0x00007FF644FD6000-memory.dmp

Download

memory/2504-25-0x00007FF644EF0000-0x00007FF644FD6000-memory.dmp

Download

memory/2504-145-0x00000260C2920000-0x00000260C29CE000-memory.dmp

Download

memory/2548-15-0x00007FF6B7380000-0x00007FF6B7466000-memory.dmp

Download

memory/2548-16-0x000001FB774C0000-0x000001FB77526000-memory.dmp

Download

memory/2548-17-0x000001FB774C0000-0x000001FB77526000-memory.dmp

Download

memory/2548-75-0x00007FF6B7380000-0x00007FF6B7466000-memory.dmp

Download

memory/2548-144-0x000001FB77EC0000-0x000001FB78238000-memory.dmp

Download

memory/2708-136-0x00007FF67BF90000-0x00007FF67C040000-memory.dmp

Download

memory/2708-137-0x00000268D1800000-0x00000268D1866000-memory.dmp

Download

memory/2708-203-0x00007FF67BF90000-0x00007FF67C040000-memory.dmp

Download

memory/2708-138-0x00000268D1800000-0x00000268D1866000-memory.dmp

Download

memory/2988-174-0x00007FF63DC00000-0x00007FF63DD46000-memory.dmp

Download

memory/2988-99-0x000002F551BA0000-0x000002F551C06000-memory.dmp

Download

memory/2988-97-0x00007FF63DC00000-0x00007FF63DD46000-memory.dmp

Download

memory/2988-98-0x000002F551BA0000-0x000002F551C06000-memory.dmp

Download

memory/3092-190-0x0000020554CD0000-0x0000020554D7E000-memory.dmp

Download

memory/3092-54-0x0000020554600000-0x00000205546FA000-memory.dmp

Download

memory/3092-55-0x00000205547D0000-0x0000020554836000-memory.dmp

Download

memory/3092-56-0x00000205547D0000-0x0000020554836000-memory.dmp

Download

memory/3440-294-0x00007FF789720000-0x00007FF78984E000-memory.dmp

Download

memory/3440-221-0x00007FF789720000-0x00007FF78984E000-memory.dmp

Download

memory/3440-219-0x000001F220890000-0x000001F2208F6000-memory.dmp

Download

memory/3440-220-0x000001F220890000-0x000001F2208F6000-memory.dmp

Download

memory/3960-216-0x000001E9B0B10000-0x000001E9B0BBE000-memory.dmp

Download

memory/3960-131-0x00007FF7834F0000-0x00007FF78391B000-memory.dmp

Download

memory/3960-217-0x00007FF7834F0000-0x00007FF78391B000-memory.dmp

Download

memory/3960-213-0x000001E9B0610000-0x000001E9B0676000-memory.dmp

Download

memory/3960-126-0x000001E9B0610000-0x000001E9B0676000-memory.dmp

Download

memory/3960-200-0x00007FF7834F0000-0x00007FF78391B000-memory.dmp

Download

memory/3960-127-0x000001E9B0610000-0x000001E9B0676000-memory.dmp

Download

memory/4036-183-0x000002E83D550000-0x000002E83D8C8000-memory.dmp

Download

memory/4036-176-0x000002E83DEB0000-0x000002E83DF16000-memory.dmp

Download

memory/4036-175-0x000002E83DEB0000-0x000002E83DF16000-memory.dmp

Download

memory/4036-180-0x00007FF7832A0000-0x00007FF78368F000-memory.dmp

Download

memory/4036-184-0x00007FF7832A0000-0x00007FF78368F000-memory.dmp

Download

memory/4036-181-0x000002E83DEB0000-0x000002E83DF16000-memory.dmp

Download

memory/4540-120-0x000002086D1F0000-0x000002086D256000-memory.dmp

Download

memory/4540-118-0x000002086D1F0000-0x000002086D256000-memory.dmp

Download

memory/4540-188-0x00007FF63AF50000-0x00007FF63AFFA000-memory.dmp

Download

memory/4540-119-0x00007FF63AF50000-0x00007FF63AFFA000-memory.dmp

Download

memory/4952-196-0x000001F9A1160000-0x000001F9A11C6000-memory.dmp

Download

memory/4952-195-0x000001F9A1160000-0x000001F9A11C6000-memory.dmp

Download

memory/4952-286-0x00007FF6F8CA0000-0x00007FF6F916A000-memory.dmp

Download

memory/4952-201-0x00007FF6F8CA0000-0x00007FF6F916A000-memory.dmp

Download

memory/5200-227-0x00007FF698500000-0x00007FF698691000-memory.dmp

Download

memory/5200-167-0x000001B4B7D10000-0x000001B4B7D76000-memory.dmp

Download

memory/5200-168-0x000001B4B7D10000-0x000001B4B7D76000-memory.dmp

Download

memory/5200-166-0x00007FF698500000-0x00007FF698691000-memory.dmp

Download

memory/5640-72-0x00007FF7C9820000-0x00007FF7C9988000-memory.dmp

Download

memory/5640-71-0x00000236AC350000-0x00000236AC6C8000-memory.dmp

Download

memory/5640-69-0x00000236ACCC0000-0x00000236ACD26000-memory.dmp

Download

memory/5640-64-0x00000236ACCC0000-0x00000236ACD26000-memory.dmp

Download

memory/5640-63-0x00000236ACCC0000-0x00000236ACD26000-memory.dmp

Download

memory/5640-62-0x00007FF7C9820000-0x00007FF7C9988000-memory.dmp

Download

memory/5648-39-0x000001AEA3B60000-0x000001AEA3BC6000-memory.dmp

Download

memory/5648-42-0x00007FF77CE30000-0x00007FF77D0BA000-memory.dmp

Download

memory/5648-41-0x000001AEA31E0000-0x000001AEA3558000-memory.dmp

Download

memory/5648-34-0x000001AEA3B60000-0x000001AEA3BC6000-memory.dmp

Download

memory/5648-35-0x000001AEA3B60000-0x000001AEA3BC6000-memory.dmp

Download

memory/5648-33-0x00007FF77CE30000-0x00007FF77D0BA000-memory.dmp

Download

memory/5916-156-0x000002727EB40000-0x000002727EBEE000-memory.dmp

Download