5a2f9904e75e6a81269de78842e2e46b8d72f886b6d06daf9687dd8126f1aa1c

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 747KB
Sample260511-pd2w2acw6j
SHA256 5a2f9904e75e6a81269de78842e2e46b8d72f886b6d06daf9687dd8126f1aa1c
MD5 28e5c5c2340fdb3f47726026ff0bb9ce
SHA1 56cd1ceee52a5e5179b54c1f6b1a875c4cb30eea
SHA512 8855569292761dd68caed487565f839f0f16d221aca64d3a08217912695989dc9a4a19047602752893356232e037e653c3bb347243fd2ed143de39357c8576ed
SSDEEP 12288:HYPrGxzQ9TA1ubv6IQ3J2+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTS:HYzGxmsrSGS/bvF/wwrmAGNSanjh2hAz
TLSH
T112F4121235C08076D667093068B0D6B12D7FFEB14F2599AF63A41B2E4EB43C29D24BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5620	alg.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
4208	fxssvc.exe
5380	elevation_service.exe
3832	elevation_service.exe
5436	maintenanceservice.exe
952	msdtc.exe
664	OSE.EXE
5536	PerceptionSimulationService.exe
3120	perfhost.exe
4492	locator.exe
5000	SensorDataService.exe
5236	snmptrap.exe
5632	spectrum.exe
4788	ssh-agent.exe
5944	TieringEngineService.exe
652	AgentService.exe
4776	vds.exe
4240	vssvc.exe
4300	wbengine.exe
2552	WmiApSrv.exe
1632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3226cd94c682cdf5.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_166656\javaws.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_166656\javaw.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073963a8445e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3b2398545e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fb5fb8445e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f0b508445e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4208	fxssvc.exe
Token: SeRestorePrivilege	5944	TieringEngineService.exe
Token: SeManageVolumePrivilege	5944	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	652	AgentService.exe
Token: SeBackupPrivilege	4240	vssvc.exe
Token: SeRestorePrivilege	4240	vssvc.exe
Token: SeAuditPrivilege	4240	vssvc.exe
Token: SeBackupPrivilege	4300	wbengine.exe
Token: SeRestorePrivilege	4300	wbengine.exe
Token: SeSecurityPrivilege	4300	wbengine.exe
Token: 33	1632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeDebugPrivilege	3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3448	2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 5348	1632	SearchIndexer.exe	104
PID 1632 wrote to memory of 3712	1632	SearchIndexer.exe	105
PID 1632 wrote to memory of 2380	1632	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_28e5c5c2340fdb3f47726026ff0bb9ce_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5620

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5504

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3120

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5000

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 960 2820 2676 944 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3712
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 960 2804 2812 944 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d3deb4a320da4cd4b2d5249738d397a6feb994b09396c7b3303b463524f3d464
MD5 26b55cf08e7185df539d3cd45215aa6b
SHA1 8c20375109f6a081736a6cf8253560d6c4fa19b8
SHA512 24f102138e9d820861db330f0b9a920a144a1ab26d760e7e5dd2e79282b76c1eb5089fddd7c5efd54c791e5f3af16031e47f2cc0789551c60f256f76ecd8dd5e
SSDEEP 49152:Qb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnPtrF/wwNGNthqU:63q6gjBGvwwNYPqU
TLSH
T193D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 1d36b4fd2ff2b78b2b86f8b5137731f02524046681225b2af875e108360dc95d
MD5 52ba25b77a1e2c1759c6c9bbe46fbe0f
SHA1 5324a4bb5d9979263165cae68abc2b8104ca53be
SHA512 78e45df5783b4fea7528a02f7414244b97820b8d93999f7bdd9b7a94cb778ce77f51e362a33a2b5e7d511d632aa9e8a4bb4b3cea8e688e1ed853053c3a4a3633
SSDEEP 24576:FXYor4czADSGS/bvF/wwrmAGNSanjh2hAVJ:Z4cBtrF/wwNGNthqU
TLSH
T19305022967E008F8ED5B813CDCA2C511EE73B8914760E79B03F49A251F677885E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 3aeaf476b0b5f79d85593329ca5ec1ee3a81cf9f8ea57b78a85cf93cc44478c3
MD5 53b17c0d45fedd9b9687f0b2fc343cef
SHA1 71b22c5d0934be99bbc6e67275020723449079f6
SHA512 109d534d12fd30794466620d18eb0da26a2a324b58978a72cb312d6ae497462789f2cb6af1276a7c29dc9501337874a554935b0bdab2bb612cf91ead54270285
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+Cr+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9r:UwusOWHSGS/bvF/wwrmAGNSanjh2hAV
TLSH
T13405F14A36A40CF9EA6685398943C136FBF3B8522A21D72F4770C71B5F77311AD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b65927c1e490ee26ac799abfd5ffcee2f3dc649b43f0a33b809f31886fa46ce0
MD5 d35dbcf00c6fedabdf5e473ccba5fd62
SHA1 d5ce6f3563f84b63407049fc440d7d69285399a6
SHA512 e66f13b141eb7565e796dee6e9c1a2a183d1d19f74f225bfad504436db15f1ce64b885774db2d1d84a49f392c29d18f9ae3a79f53c52abb2ecbf1a2a9c4c4c01
SSDEEP 49152:iO+taZ3usBWOBr4tEGp0bqx0z+n217aau1gldtrF/wwNGNthqU:bu6JmTxd2ddvwwNYPqU
TLSH
T12BD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 4ef91eeb230c9c5b1496060f413bde08093f361da6fcc3ae5079edb359816f22
MD5 46ecd3f475e1cfce9d09f67e1387287f
SHA1 50162d222c940b09928734f4b058c4705cb7b454
SHA512 012c96d79bfbecafd8fb7f65b7ffdb0a349438604cc1e84fd05d7bd0b55609842942af40a074c57cbefcb496a0e55fd62cd8608a56e0bfb46ef42f1b50d75a45
SSDEEP 12288:tU+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:tXSGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T115D4234B0DA44908E75C9A34BC41C1203E5FF5F28F02E1FADB606B195EBDA84AD51BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 63ac2058dee00f49ae881314fb7cf4b729f6888e9f9a185a789aefc15db1ba0a
MD5 d9f896d4bd705c9b835bf597dabf5b0e
SHA1 377922b46f6dce16ea37d22d9e7f7f387e141113
SHA512 6e9f4c52eb7dd876b4d978ba1d389b2f2ee157dbd592435eefdc7efce0620f418f4c4c13eaf5b48b459f83552a92962939c8a48ce30e2b4e1f617f131adfc197
SSDEEP 24576:WaVMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCGSGS/bvF/wwrmAGNSanjh2hAVJ:1VZwQCyiHiQEaTPnM0trF/wwNGNthqU
TLSH
T13185B01E62DC46A5E0BAD278CD674407E6B378165731A7CF0290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 d873459d99b3d083e8881c2e76fb048bb71cf46cd55e8a7b82886d5edfbd4293
MD5 39237eca359de1804e12969799e8d1b4
SHA1 a136e7e49502ad19a74f6b534289dd7027c3eaf4
SHA512 0660f1280ae12510c5cce7f408de8334a8360d447b03f6624205188037adbfa6186669c502e845548ef4fa0630f3cafe54c08027afdd1a5859c0884686a26db5
SSDEEP 12288:MKxA1U7K2+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:MKxA1UGdSGS/bvF/wwrmAGNSanjh2hAz
TLSH
T1D4E4026F19AC04E4E269953D9C818105EB73B8A35721A3EF56A0833E0F6BED45D31FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a6fc656119e464e2bee02f8237a12001bfc8c54112b1df8ba9079663835c7ff1
MD5 e90ca8ff2cb54eff4814564ad7066bbe
SHA1 19388b46f47174dcfb9780636fb69fbf142e9a33
SHA512 5b950001147924e828658287bf67d8c73189259dba998f9db07d27a6b9bce96b2fe972920d55b80572db8af001c8742141939112198f95fc8d411e1b2a7059dd
SSDEEP 24576:krsmPLyHaqrVqHra44KDzM+rnpSGS/bvF/wwrmAGNSanjh2hAVJ:krRPLyHfVqzlA+rn0trF/wwNGNthqU
TLSH
T11E55BF2EF2B910B9D4AAD136454107B5BB71B42D1F219ACB0170C634AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 25c0ca031a5bd43679d7ff9508cf4256e30196342e3a7fd6bd61b5bd1f97e08a
MD5 b80f1f9331270ed27582bb2f9c2b6283
SHA1 4e04de7bf1977d630e300387e73b0f6698c4fcfc
SHA512 ccacbde37d049c5b512993aa3728b04e8db8ac1e7a256b6bb6a16c849c85782587a51a49e2bf0270a02906eeda0ee98d4357dc1b4383ab96a715f3fd06ef6da3
SSDEEP 12288:cz+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:cqSGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T11FD4234F0CA4454CD70C8E35BC41C1513E9BF6E38B17B2B88B70AB194FEDA49A9526F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 154b6027438c69c56876d521b6612da79e25a3ab10559092e4f9cdcd8df55fb5
MD5 da60f29fb20a8538a5f4628f3df996a9
SHA1 9356820710559dc4997509f2b671c239caa7d2bf
SHA512 d2a4e27b921bc334a0b8bef7ae9c13d2275c1bedd64ce505ffea7b721bf55e009ad3c6887097bc12ece0f58db14165a398ef9db45caf0ac07a10ef3977aa3b93
SSDEEP 12288:AN1zA4LWO+vAYFTi+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPj:KHLBUT5SGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T179250256E7A400F8E96BC13CC8628512E6B3B49D0724E7EF07A84B651F537E14E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 e4c02db52a88d1fe8816d5f7b426b94226603c457aae0fa1fd7e0af0c35f1802
MD5 c41a954f21c58ef6829465be04cd00dd
SHA1 64e40a5fca02382aba955580588e65c7007065cb
SHA512 6a95ed5ad19c5c01d5982952f4805681178f5b9b268994ea5b278e6f5a7a3a27d0f84b55f25fad10c2dee3309a852f03f1eb524f9412c33517419d208ccdc6ee
SSDEEP 12288:/uvVmzIYNvUyBpn+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPlJ:gTYNH8SGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T1E505F11F56AD08E4D63F917DD9828205F673B8A2171192DF06B0827E0F17EE8BD3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 6513385aed18011f9a08903091ab130e6aac9c207e3a19bdddbd505cdab8c59e
MD5 75b10fe91bcec509b29b9ddd940bf0a8
SHA1 e261084b3dd7de9141dbad44a5d933ad97fdb061
SHA512 a645af3f1e09af77073bcfb806561e85807438b29b6840a2ca71eb4351ae03103d94558ca1c2be1733367efe9d0784315605bd0aebcced8900e09e4ce9a947fb
SSDEEP 24576:f2XR7jNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKT:f2XR7JYH84VVS6AmEFJas+cHBjSSKHPD
TLSH
T16765BF5EA2BC04D8D5BBD17DC5C24506F9B278621331C6CF026182BA7F27AF5AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 504a01aa01775dfd5fc6536bf5dde9d21fa70a40c81f3f00e9a2a3f4ee990a4d
MD5 c1b56664dab1b0de48a0d47832ba396b
SHA1 ae788e8d1388d97ccdc8ba76d7e8fcafc72599a4
SHA512 7097752552d64933362e67924e7bd79ce8798ee38fe8532970f7a0e6789a818c5a871c105187c5b28c4355f7d2936bbdf9036d59cf7d1c816b7829dfd48773ee
SSDEEP 24576:rV7Xbxd9Tuycf8M/TYlSux/r2PCQSGS/bvF/wwrmAGNSanjh2hAVJ:rdLL9TuJ0M/TYn2PetrF/wwNGNthqU
TLSH
T1EB858D5EA2EC42D8E07BD6BD85B79146FAB2B895173091CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 822c40ab01c24f2b4703b832a7d0cac0489e8d196cc374199fbd748ac0470410
MD5 20ce1f08787ff02a405eb0282e14b42f
SHA1 974f8ce49125cff25b9c4f97c98a76c387f3bf49
SHA512 d18d3a5c63a8691456f400913df1ad8426a31f366d548ff8df59f28ac5ce801844a2bcd9d102588c0c45884a95d86569c110184fd609bf57dcace6ec39738ab3
SSDEEP 24576:qegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wcSGS/bvF/wwrmAGNSanjh2hAVJ:qngOJOmPOHFttrF/wwNGNthqU
TLSH
T17E55CF3FA7BC05D5E03EC13DC9928916F6B1786203259ACF0660827E5F1BEE46E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 2c45d68e0d48c92b52dc87fefff248b910c2080ea28f67357a3741f8592c9956
MD5 9d6df4ac01a8a0f7b552a97782e33d9a
SHA1 47dce56f65843075a1f4911857b86323c6b30633
SHA512 92c9d3022a5900d381568ef7bc721ecb6f47efc2525fbe43703706ddb525eb0184b11fbe079954a7e55130ac0c9a2e60e5ab30322201bd04522c786108c5c5f7
SSDEEP 24576:C4JnJbRk3R3waE4JrO7ASGS/bvF/wwrmAGNSanjh2hAVJ:C4JnJF8R304lMtrF/wwNGNthqU
TLSH
T19615E02DC2A800E8E4B7C2B481561756FF32347D2B2269CB5AB4D5353F12FD0AA79F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 04ce5a1c4691019d59ede9766e968ea9037522298cffc549437cafe2312931f4
MD5 77ebd25d7e7ca6d9d838759e6396ceea
SHA1 c3fd237cd20a25229e523608d25f059ac8560f67
SHA512 40f96287064bf8b952eb28fc3a4fe1b70064142befc9d8c37b30563a364eefa2617be0fedebae209bbaae9ce34bf9c429035a6af6ac3529516ec8c9dc7453f9b
SSDEEP 49152:k9EqCzDScAZmlvTcFg8Ph6itrF/wwNGNthqU:4jvwwNYPqU
TLSH
T1BDA55C05F7EA5298E8B3CAF1C96294159B337C509B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 b4ebfa01f711f3ad44fb4455e68a6bbcff6f56faffbbade068c0328f25ec9787
MD5 1f23bc5bacb67b98a6c0bc9bd29187e3
SHA1 043c6a169338cfce174a35e4d230879f94bb6817
SHA512 2375f8105f5042ca0217651cbad9deb32e32b37366c499d852c2365865b6f277a1b38cf7c78a38b793a057b554c17c7365c67b434eb573351566880fb7e194bb
SSDEEP 12288:IlYJeXm8lkcUuEv+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPlJ:IlYJeXm8ZUuEGSGS/bvF/wwrmAGNSanj
TLSH
T1B5E4124E29A810D8E21D8539A8528550EBB3F0F21702A3FF47F0C63D4F9AAD56E35ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 e37b1d5bcd8b310fd835b3036002d00b33267e34816041aaf5ef51070c212318
MD5 1a400ee88fc92293e114629ccf61d30d
SHA1 7ac420f69e0af86bcbc86397cddf137aa1b44a5e
SHA512 33f158a7aff89edbeb762888a405a279bd5922f1a1cd43e55edde25127138a9ec52eb1d8ce27f0e03b6abcd5f06ff13ed7d0b895043789939e5f86dc21017d6e
SSDEEP 12288:IH16kyy+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:IVtypSGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T118F4120A16944598E76C4A38EC5381906E77BCB14F1193FF47A0F73E5F7A784A930BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 0809a812a0d59ea78b87483d2e3ecce2da90346582b7669421f0566dab2702ae
MD5 0b22b2df570fb4f5b49cd8647f91be42
SHA1 96600b332c682d33cdcef3cc61c9af169ff23e1f
SHA512 4b221a75b483f9770b59ace651b9a0117d6ea3cb47bf339e1ec7e2ae86bed35f51fbd2dc611ca744cb786da857b23876e95bfa0b2df6067d64bae41aa9632bc3
SSDEEP 12288:bNad+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPln3bt:Ja4SGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T191D4234F0D60454CD70C4935BC02D1513EABF5F28B16B1BE8BB0EA398FED605A952EE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 76e810f24b749ef672da7a7d70c05f5eb5af63e13db3d6032cafb0b684599a63
MD5 8dbbcbc39268819c5af848531c4cd004
SHA1 331b636f54b9b097c457b5e02bd3c9d7cb2dd85d
SHA512 089069f968cb5fc49f2b6db607e5e4c35a318c5d0acc84759e2c1461ed727cdf846a51f113348837d69d48ec79013ad98f08c494326fe9080928f32864c1cfaa
SSDEEP 24576:AC+TyQIu93VAumZrHjmJSGS/bvF/wwrmAGNSanjh2hAVJ:A/TfIq+AUtrF/wwNGNthqU
TLSH
T16C558D1DA7F91DCAE276C675C8A34493EA33B472136186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 989c9c2196c2fd0c198ea5794c01b3616d677896cdb80bb4850e579a0e5b80ac
MD5 f72709d47731aa459a9bc95cd9be1689
SHA1 aa14585d9b625ab684650ec8fd8b3054714bb0dd
SHA512 036a9848d3da758145abbafd3978767d269a0b4c32f19265ca8bdee6267ebd4238c37fb0232e5403748d414e6a71f03dff379be6ec8dd37424df288c204d7f28
SSDEEP 12288:ER1UWCstaa3kcsT+0FJGS33fbvFpFwwrWBGGbAQ94sSak4csPB0ALZ9wTrlAfPlJ:KnQikZKSGS/bvF/wwrmAGNSanjh2hAVJ
TLSH
T15B05F10F76AA0095D16BC13C88418152FAB3B4B15712A3EF47A0C77D4FAB6E9BD34B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 467ba273fb06347bcb8e83a6f53c2c22b00cb05eac0e9ad92b7040d676fd5923
MD5 3292802374be31a08673d348525b986d
SHA1 bee28020e53eeb4fc687737741791a95797b6212
SHA512 0c7a0f961e8e217134a0089fa101751f197ee9b732b44813e0f558dc6b90634c51c63c16c33cbfd4c47aff51cf66b55055f530c96bfd5df961ba4a0833474a21
SSDEEP 49152:tbJRwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPptrF/wwNGr:YpC7b4+80GTLEvwwNYPqU
TLSH
T17FA57C3DE2B800ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-177-0x00007FF7B4BA0000-0x00007FF7B4F8F000-memory.dmp

Download

memory/652-172-0x000001808D480000-0x000001808D4E6000-memory.dmp

Download

memory/652-181-0x00007FF7B4BA0000-0x00007FF7B4F8F000-memory.dmp

Download

memory/652-178-0x000001808D480000-0x000001808D4E6000-memory.dmp

Download

memory/652-180-0x000001808DA10000-0x000001808DABF000-memory.dmp

Download

memory/652-173-0x000001808D480000-0x000001808D4E6000-memory.dmp

Download

memory/664-90-0x000002B937170000-0x000002B9371D6000-memory.dmp

Download

memory/664-88-0x000002B936F70000-0x000002B93709F000-memory.dmp

Download

memory/664-89-0x000002B937170000-0x000002B9371D6000-memory.dmp

Download

memory/952-171-0x00007FF75EB70000-0x00007FF75EC86000-memory.dmp

Download

memory/952-218-0x000001EF9BCD0000-0x000001EF9BD7F000-memory.dmp

Download

memory/952-76-0x00007FF75EB70000-0x00007FF75EC86000-memory.dmp

Download

memory/952-78-0x000001EF9B750000-0x000001EF9B7B6000-memory.dmp

Download

memory/952-77-0x000001EF9B750000-0x000001EF9B7B6000-memory.dmp

Download

memory/1632-222-0x000001C4C3E40000-0x000001C4C3EA6000-memory.dmp

Download

memory/1632-246-0x000001C4C5080000-0x000001C4C5090000-memory.dmp

Download

memory/1632-230-0x000001C4C4E50000-0x000001C4C4E60000-memory.dmp

Download

memory/1632-296-0x00007FF78AC00000-0x00007FF78AF3E000-memory.dmp

Download

memory/1632-223-0x000001C4C3E40000-0x000001C4C3EA6000-memory.dmp

Download

memory/1632-263-0x000001C4CD640000-0x000001C4CD648000-memory.dmp

Download

memory/1632-226-0x00007FF78AC00000-0x00007FF78AF3E000-memory.dmp

Download

memory/2552-213-0x00007FF79FA90000-0x00007FF79FBBE000-memory.dmp

Download

memory/2552-212-0x000002341A730000-0x000002341A796000-memory.dmp

Download

memory/2552-290-0x00007FF79FA90000-0x00007FF79FBBE000-memory.dmp

Download

memory/2552-210-0x000002341A730000-0x000002341A796000-memory.dmp

Download

memory/3120-111-0x0000000000870000-0x00000000008D9000-memory.dmp

Download

memory/3120-106-0x0000000000870000-0x00000000008D9000-memory.dmp

Download

memory/3120-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3120-186-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3440-28-0x0000020D963D0000-0x0000020D96436000-memory.dmp

Download

memory/3440-26-0x0000020D963D0000-0x0000020D96436000-memory.dmp

Download

memory/3440-25-0x00007FF702330000-0x00007FF702416000-memory.dmp

Download

memory/3440-96-0x00007FF702330000-0x00007FF702416000-memory.dmp

Download

memory/3440-168-0x0000020D96DB0000-0x0000020D96E5F000-memory.dmp

Download

memory/3448-44-0x0000000000BC0000-0x0000000000CD7000-memory.dmp

Download

memory/3448-6-0x0000000002F30000-0x0000000002F99000-memory.dmp

Download

memory/3448-1-0x0000000002F30000-0x0000000002F99000-memory.dmp

Download

memory/3448-0-0x0000000000BC0000-0x0000000000CD7000-memory.dmp

Download

memory/3832-55-0x000001C2C64F0000-0x000001C2C661F000-memory.dmp

Download

memory/3832-209-0x000001C2C70F0000-0x000001C2C719F000-memory.dmp

Download

memory/3832-57-0x000001C2C6740000-0x000001C2C67A6000-memory.dmp

Download

memory/3832-56-0x000001C2C6740000-0x000001C2C67A6000-memory.dmp

Download

memory/4208-43-0x00007FF6D1450000-0x00007FF6D16DA000-memory.dmp

Download

memory/4208-34-0x00007FF6D1450000-0x00007FF6D16DA000-memory.dmp

Download

memory/4208-35-0x000001AC186F0000-0x000001AC18756000-memory.dmp

Download

memory/4208-37-0x000001AC186F0000-0x000001AC18756000-memory.dmp

Download

memory/4208-41-0x000001AC186F0000-0x000001AC18756000-memory.dmp

Download

memory/4240-192-0x000001EE49060000-0x000001EE490C6000-memory.dmp

Download

memory/4240-196-0x00007FF7C7240000-0x00007FF7C770A000-memory.dmp

Download

memory/4240-191-0x000001EE49060000-0x000001EE490C6000-memory.dmp

Download

memory/4240-283-0x00007FF7C7240000-0x00007FF7C770A000-memory.dmp

Download

memory/4240-285-0x000001EE49A20000-0x000001EE49ACF000-memory.dmp

Download

memory/4300-201-0x000001B8CCB40000-0x000001B8CCBA6000-memory.dmp

Download

memory/4300-202-0x000001B8CCB40000-0x000001B8CCBA6000-memory.dmp

Download

memory/4300-206-0x00007FF7BE830000-0x00007FF7BED5A000-memory.dmp

Download

memory/4300-286-0x00007FF7BE830000-0x00007FF7BED5A000-memory.dmp

Download

memory/4492-119-0x0000020327D50000-0x0000020327DB6000-memory.dmp

Download

memory/4492-118-0x0000020327D50000-0x0000020327DB6000-memory.dmp

Download

memory/4492-190-0x00007FF6DD440000-0x00007FF6DD4EA000-memory.dmp

Download

memory/4492-117-0x00007FF6DD440000-0x00007FF6DD4EA000-memory.dmp

Download

memory/4776-282-0x0000023CE26D0000-0x0000023CE277F000-memory.dmp

Download

memory/4776-278-0x00007FF7D7EF0000-0x00007FF7D81AD000-memory.dmp

Download

memory/4776-185-0x00007FF7D7EF0000-0x00007FF7D81AD000-memory.dmp

Download

memory/4788-219-0x00007FF681060000-0x00007FF68124F000-memory.dmp

Download

memory/4788-154-0x000001717C800000-0x000001717C866000-memory.dmp

Download

memory/4788-153-0x00007FF681060000-0x00007FF68124F000-memory.dmp

Download

memory/4788-155-0x000001717C800000-0x000001717C866000-memory.dmp

Download

memory/5000-197-0x00007FF6C2FC0000-0x00007FF6C33EB000-memory.dmp

Download

memory/5000-265-0x000001DEC3C00000-0x000001DEC3C66000-memory.dmp

Download

memory/5000-267-0x000001DEC4650000-0x000001DEC46FF000-memory.dmp

Download

memory/5000-125-0x000001DEC3C00000-0x000001DEC3C66000-memory.dmp

Download

memory/5000-268-0x00007FF6C2FC0000-0x00007FF6C33EB000-memory.dmp

Download

memory/5000-130-0x00007FF6C2FC0000-0x00007FF6C33EB000-memory.dmp

Download

memory/5000-126-0x000001DEC3C00000-0x000001DEC3C66000-memory.dmp

Download

memory/5236-200-0x00007FF701460000-0x00007FF701510000-memory.dmp

Download

memory/5236-136-0x0000012AC40F0000-0x0000012AC4156000-memory.dmp

Download

memory/5236-135-0x00007FF701460000-0x00007FF701510000-memory.dmp

Download

memory/5236-137-0x0000012AC40F0000-0x0000012AC4156000-memory.dmp

Download

memory/5380-49-0x000002155A140000-0x000002155A1A6000-memory.dmp

Download

memory/5380-189-0x000002155A680000-0x000002155A72F000-memory.dmp

Download

memory/5380-47-0x0000021559F40000-0x000002155A06F000-memory.dmp

Download

memory/5380-48-0x000002155A140000-0x000002155A1A6000-memory.dmp

Download

memory/5436-71-0x0000015F00860000-0x0000015F008C6000-memory.dmp

Download

memory/5436-65-0x0000015F00860000-0x0000015F008C6000-memory.dmp

Download

memory/5436-64-0x0000015F00860000-0x0000015F008C6000-memory.dmp

Download

memory/5436-66-0x00007FF6FBBD0000-0x00007FF6FBD38000-memory.dmp

Download

memory/5436-73-0x00007FF6FBBD0000-0x00007FF6FBD38000-memory.dmp

Download

memory/5536-98-0x000002682AA90000-0x000002682AAF6000-memory.dmp

Download

memory/5536-224-0x000002682AF40000-0x000002682AFEF000-memory.dmp

Download

memory/5536-184-0x00007FF604D70000-0x00007FF604EB6000-memory.dmp

Download

memory/5536-99-0x000002682AA90000-0x000002682AAF6000-memory.dmp

Download

memory/5536-97-0x00007FF604D70000-0x00007FF604EB6000-memory.dmp

Download

memory/5620-14-0x00007FF711400000-0x00007FF7114E6000-memory.dmp

Download

memory/5620-15-0x000001ED64E00000-0x000001ED64E66000-memory.dmp

Download

memory/5620-17-0x000001ED64E00000-0x000001ED64E66000-memory.dmp

Download

memory/5620-63-0x00007FF711400000-0x00007FF7114E6000-memory.dmp

Download

memory/5620-161-0x000001ED65900000-0x000001ED659AF000-memory.dmp

Download

memory/5632-145-0x00007FF79BC90000-0x00007FF79BF53000-memory.dmp

Download

memory/5632-272-0x00000233F3DC0000-0x00000233F3E6F000-memory.dmp

Download

memory/5632-211-0x00007FF79BC90000-0x00007FF79BF53000-memory.dmp

Download

memory/5632-144-0x00000233F3460000-0x00000233F34C6000-memory.dmp

Download

memory/5632-143-0x00000233F3460000-0x00000233F34C6000-memory.dmp

Download

memory/5944-277-0x000001D3E9290000-0x000001D3E933F000-memory.dmp

Download

memory/5944-164-0x000001D3E8760000-0x000001D3E87C6000-memory.dmp

Download

memory/5944-225-0x00007FF612350000-0x00007FF6124E1000-memory.dmp

Download

memory/5944-163-0x000001D3E8760000-0x000001D3E87C6000-memory.dmp

Download

memory/5944-162-0x00007FF612350000-0x00007FF6124E1000-memory.dmp

Download

memory/6140-273-0x0000018905200000-0x00000189052AF000-memory.dmp

Download