d3d7560d2774188c4b117dde10ccb0ebff9b8f967a9f9326fe2ae7bfb08df014

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 748KB
Sample260522-c7trasfx51
SHA256 d3d7560d2774188c4b117dde10ccb0ebff9b8f967a9f9326fe2ae7bfb08df014
MD5 12865e22a0ee260b1633734d68990994
SHA1 906f9bb612755b97c17f48743f2525f79f0dd4df
SHA512 603f02f4caf2886923a8547de8b5d7986db9e893d083ca6495c056c4f25b2dbe7087b8c028c9b42c82665684eca0c7bc4d2779e1a27d6de0f6c8a36faddf2881
SSDEEP 12288:893G6vHzOASubviBNDYa3TOlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi6P:8VGGTWBZsnKmRRWEl43MqpALDXmCS
TLSH
T105F4022172D0C4B3D5731A3048B5A978597EFD741F7849AF63981B6A0DF0AC28E387A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
740	alg.exe
4800	DiagnosticsHub.StandardCollector.Service.exe
2852	fxssvc.exe
3356	elevation_service.exe
424	elevation_service.exe
1744	maintenanceservice.exe
3936	msdtc.exe
2760	OSE.EXE
804	PerceptionSimulationService.exe
2420	perfhost.exe
1064	locator.exe
2128	SensorDataService.exe
3752	snmptrap.exe
4548	spectrum.exe
2600	ssh-agent.exe
3004	TieringEngineService.exe
2180	AgentService.exe
4636	vds.exe
1588	vssvc.exe
964	wbengine.exe
4720	WmiApSrv.exe
1996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c60d6df1c6cb3b6.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaw.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8914ddf94e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e2ba8df94e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf5417e194e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f538ccdc94e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058c05cd694e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000030a25df94e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073fdd0dc94e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	2852	fxssvc.exe
Token: SeRestorePrivilege	3004	TieringEngineService.exe
Token: SeManageVolumePrivilege	3004	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2180	AgentService.exe
Token: SeBackupPrivilege	1588	vssvc.exe
Token: SeRestorePrivilege	1588	vssvc.exe
Token: SeAuditPrivilege	1588	vssvc.exe
Token: SeBackupPrivilege	964	wbengine.exe
Token: SeRestorePrivilege	964	wbengine.exe
Token: SeSecurityPrivilege	964	wbengine.exe
Token: 33	1996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1996	SearchIndexer.exe
Token: SeDebugPrivilege	2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2380	2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 3488	1996	SearchIndexer.exe	105
PID 1996 wrote to memory of 960	1996	SearchIndexer.exe	106
PID 1996 wrote to memory of 1824	1996	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_12865e22a0ee260b1633734d68990994_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:740

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3772

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:804

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2128

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 952 2720 2716 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:960
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 952 2892 2752 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 829fc65632d97d88ac454a9ce0d0f883aec5f99a8fd5edc9cc0c1430ae97ed2b
MD5 0cef85e23dc42d727663f73d85495b4d
SHA1 26d40c1a5add572bef0615d9471da3d752e4007b
SHA512 3d247080ceb43d0ca49d138f145cb15a8ce5dd7fe4195ee88e2505adef01e569312cb13cdc65c2df348bad9733399ae96a27e7a4b55bf3eda9acbca4602b5152
SSDEEP 49152:eb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnDEutcDpS:g3q6gjB45
TLSH
T198D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 dd7bda055d3ef920f0c69f7262a073f64b6ed290342f55c35aa93132ac26d2e5
MD5 a5c2bbbefe2cded1903113f28abc24d2
SHA1 f6365df0ccf1dd12be2fd1bb319cbb62ea231f6b
SHA512 eaf2681072da7fde9aaf26ad4641e9a3dc4c9db50eb329dff34cfff06be744a8b5403b70192569085bbb9270c70c96430f84a7e6c33d9f4481862e4afcd19587
SSDEEP 12288:t1XLspwWkxy2lRq2czARtlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dd:DXYyDtczAR3nKmRRWEl43MqpALDXmCS
TLSH
T168050228B3E408F9ED678279CCB29409DA7378940774E79F03A499650FA37C49E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 1a815fe8188fc536004831b79aaef05c15c509ba23588f3cdade01615c436560
MD5 1d65b032f6a4a02f628d47902ca1acdb
SHA1 d9b7e3e1f379e3cffea93d6c7e1afda913273ab0
SHA512 65b0dab8ef34612107545e8cc537fc0fe29fa632aa252b8e2cbaa096216de5f403bfcc220b60f9750b4eec4e07a1ae403df667b677b6de2df45dcf2110da3d99
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+C7qlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi9:UwusOW0MnKmRRWEl43MqpALDXmC
TLSH
T19305014A73A40CF9E967823989979039E7F3B8452A35CB1F0760C65B1FB3791AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d178ed270bde8f4762a25a5645999109cf0b38ca312a7258920347eb7689c0e1
MD5 23496c68ca59241c6e528df8c1e55e54
SHA1 5cb6a718dfb7b397955b75fa35d4a8c59ab172c8
SHA512 f6c3fb72642a25e718f40c80cb65f2e51a8565b0ba396a0787749ef2ea514b79a5e7794e333ade27150c782ea683aab7360c1f3611674754e3f08c43b905a9b8
SSDEEP 49152:xB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBEutcDpS:nu6JmTxd2dD5
TLSH
T109D59E13F1DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 7afcbf939d2461bcfa5c58098f9a44f8f2f0f769f39868e9ea5e89fcaedc174e
MD5 ced8f65cfe5d6a23c5087d25014e8173
SHA1 e496f1326834b4f645e7cb1fce891c3ccc11d441
SHA512 f68c527979e611ca46133dfedf47c98e49d0eb159502267b3233346487e20d8ac8c1102acbcffca251914081fa964b0174eaed1aa4265f1f4dff735002a0d485
SSDEEP 12288:5wOlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:5w4nKmRRWEl43MqpALDXmCS
TLSH
T17ED4236AF7AD9C96E53A5BB158BF302C057F74EC2F78549F660C298108E0EC1DDB0689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b39fd3659e599af5c4bbbda998524bebaeef2e9ab35e3077fda0be3670a877f3
MD5 9aaf2bb0a5b8c5cb4748bbff5f0d3a8e
SHA1 916397e2a50894bc7c10f4ec3f38e10eddcc2e57
SHA512 7f9b9282b1241b668c366660feba00862360e8494ed209577f8dcb3c3a7f4b57453732eebee9a63065e9260eea47358bc3a87eac01ce7e7f19553ac7e5f7728a
SSDEEP 24576:TkRMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCM1nKmRRWEl43MqpALDXmCS:IRZwQCyiHiQEaTPnM2EutcDpS
TLSH
T10385B01E63DC46A5E0BAD278CDA74407E6B27816173197CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 6033beedbcfdf5734e97304e469d7917c4848b7206a7e5718fd5b98ef6b59338
MD5 2f1ae66aa44d1612a24b8b2da553811b
SHA1 c1c7c4d2d99e157caf7e8989ca334dab9f945636
SHA512 0f6a96d810c7ebdbe45397e043dc4fcaaaae64b7bd7917957642b33fade8a98944794e3b1c3eff1946d88900e0d94790c30a0db9356d0a97aef55946f8b42cf4
SSDEEP 12288:NhxA1U7KullnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:NhxA1UGuvnKmRRWEl43MqpALDXmCS
TLSH
T17DE4122EB6AC18E5E13A96798CE6100CC7727869273557EF1294827A0EE3FD4DC35F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9cf8753c0d104ac5652fad87fe78e967e7494a08ee02556f4342056c0e1c9781
MD5 55150715fd94e54302be1946a8d4d124
SHA1 a03b41c9a66fd4628d392dd1e3ac6e771d99ddf8
SHA512 d7eabb231492ed59242574c80cd544ff49aefd6d7aad6d2a164917b8d143dca177a2ad05d28f2056294c42a7a309e4dfe208711b6ff438deb1edfd3e760401e0
SSDEEP 24576:JjsmP0yHaqrVqHra44KDzM+rnC4nKmRRWEl43MqpALDXmCS:JjRP0yHfVqzlA+rncEutcDpS
TLSH
T11255BF2EF2B910F9D4AAD236454507B5AB71B42D1F209ACB0170C634AF46EE89F34F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 c22ca25858e3194c03fd4aec1e23c1a23716704720d190fecda6f1b33baee39b
MD5 4727d36e07d687ffd67765c3e4dcbe54
SHA1 26882237c2fa028b25b7f027a9daae3bfeebf9f6
SHA512 fd39bc931368e4ac2e3221bb1f383a2a174f6cca3a8f6c098e7c3c2a22a9b0cacb7ecf377e6fd10c86d62fb286a5b8c95e6228ddee4c3fb2f6e384325106144d
SSDEEP 12288:X4GlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:X4QnKmRRWEl43MqpALDXmCS
TLSH
T143D42369F6AE9C96D6395BF14CBF304C09BB74EC2A7D159E1A1C6D8208D0EC2DAF05C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 67044e2791db3db7e1176be89836985152acd9c3b248d3422cf9171b62306c19
MD5 1abce2f7361ee8a1aefe608655151e7e
SHA1 bd44706dab8a48180fe2a02276f63a8acdb90db4
SHA512 270bf59af2ee87a49edc64abce42145c055bfc672031cfb05686b70f4692c5147af774891c3a90734c4fde9768f15af9a468332addf371016b55e168d9a342ef
SSDEEP 12288:CObzA4LWO+vAYFTcnRlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQEN/:zHLBUTcnDnKmRRWEl43MqpALDXmCS
TLSH
T18F250155F7A404F9E93B823CC8B6991AD2B2749C0764E7DF03A84E551E93BE18E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 6523341f23aa4acb1bac7f01d8053dbb9aa59365fccca5f8688bb130f26560cb
MD5 2b2d527f3aca462cd11a78b3101216d9
SHA1 9a8fb90370e5c1316e5e2d0c17d4bfe40685aad5
SHA512 706725559a432beb53cd7915fa527496f6d06ba002ab04bdd7bf2efc6b4c40f808f03aeae5f657b516f0ad1864275f9b5dfdb4da98d13da9ab9561da0c214be4
SSDEEP 12288:wjVmzIYNvUyBpFZlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:qTYNHLrnKmRRWEl43MqpALDXmCS
TLSH
T16C05F12FB2AD0CE5D53B92798DC7510DE27378A6172592CF05B0827A0E93EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 f720d65749df07913d5eb8886a47a97836bdc38c3d3c378470271586e5c98f9f
MD5 556541ce1749d475fc926f13249fcaf9
SHA1 43853bfe3e340193d7c992bea21fdbeaccb1245d
SHA512 fb01636f051153e8af724501b24b948d887f694e6fdc6492168b258c1bc9505e610ce03c8fda57016d15b7066bce9066be6f637672853a6909c693c7e4049f03
SSDEEP 24576:wnXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKL:wnXoJJYH84VVS6AmEFJas+cHBjSSKHPb
TLSH
T1D965BF6EA2BC04E8D5BBD17DC5C2550AF5B278651331CACF026082BA3F17EE59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c6350b5a8de05525714946aebc7f7beb8d1d4ea80b7e5f8380d80069b32a03a8
MD5 c23414bd2b01382987d7079bda017208
SHA1 3beb2a9f834fd184f40f794bdcb0d81678a126db
SHA512 5a4c3a3e0720d98444a0dbfd1ad38612210217617f82947652b8ece0cc6535d64322e57e54cf33dd7dd0669b60d7dffe04ae7841c80e2ca55a0a58c5b6ccd43b
SSDEEP 24576:Iv7Xbxd9Tuycf8M/TYlSux/r2PCX6nKmRRWEl43MqpALDXmCS:IDLL9TuJ0M/TYn2PWEutcDpS
TLSH
T112858D5EA2EC42D8E47BDABD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 cf67d969c7d26b28f0d566c98bde9e220a2de823dae5799eefc045985414bb1d
MD5 49331737515dd7fca253f7e7630e3fd4
SHA1 f375bae3a561fe74225fab038877c232328b0d0c
SHA512 be98738bac98639fc4c64f3559c9bd2892c4f9e60c375c8fbcac3fbfd1810f802f3dcef363b74dc300166a44fae90341099de6688b038de89effe1e3060632ea
SSDEEP 24576:segJgpwJOmPOHWAK28ZguIGyPsxr5Vin10w7VnKmRRWEl43MqpALDXmCS:sngOJOmPOHF0EutcDpS
TLSH
T18C55BE3FB7BC15D5E03EC17D8A96881AF6B1782613255ACF0560827E1F5BEE46E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 5b8720244b2dc964996958e51ab0a79924d1bb3001df2f40379f0499629dd604
MD5 8f316e0c5ca5740f260f8423de3cca63
SHA1 b2346a49580291b3eb77f0122deb120476efc945
SHA512 39bde1e7bb104fd0e1f07a395672011895a411496045b5902a5b373b04788f5130f624694de74de1ff905f769c24ec0d007ced618e098ab204d7c1ffb0797a84
SSDEEP 24576:2LJnJiTk3R3waE4JrOwtnKmRRWEl43MqpALDXmCS:2LJnJK8R304loEutcDpS
TLSH
T19315E03CD2A810E8D477C2B4815A265AFF72347C2B2569CB19B4D9313F52FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3b94be7de6ea3ec5546d294100767a62b93f8aaa7dc2e6cca707f7c76a8a1870
MD5 9de5da61afff2076a0c9eff2453290e7
SHA1 395009fed5f53847f9769e3eb6c9e4fc87b82f86
SHA512 a622d08e970def1a019ce08b40f0a6291b0858d9ca6209685471aee8f64ad055d7520aabbd0fa7be76c801468ede443c63f24280d722e3c80d7f5c6c3bc09fe9
SSDEEP 24576:RA9EqCceDQncA/BmlvLto8cFVr9og9P/Z6pz2nKmRRWEl43MqpALDXmCS:W9EqCzDScAZmlvTcFg8Ph6lEutcDpS
TLSH
T158A55C05F7EB5298E8B3CAF1C96694159B327C509B34F7EF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 8e745767174e2cfcaabebc051291330ba8445fdb20ad56a54c9c83f7f9bd15d1
MD5 b149c0342093a7fe294d978e257cc6df
SHA1 f22de374a85a88357dc7298db7bc60747f73efca
SHA512 974177efdbe34a64d568ac1c7bc552f590b07ab766443719afeab2831c2a52a1f707f2d4ef87b7d00a05658eab86aac356ef82687c386de2eb3b41edfe92125c
SSDEEP 12288:1lYJeXm5nkEUuERjlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:1lYJeXm5jUuERJnKmRRWEl43MqpALDXE
TLSH
T1DEE4135DB6AC74E5D13E927988A6140CC3B2B0B8176527FF12E4C57A0ED2ED59E38F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 71402fdebb2c8dfe4f2c918ab5bf6dc7f2c5c33ca05a1a21c92719ee8a731f52
MD5 f5a13ce93c2e4dec33ffa0ba4e7faafd
SHA1 5edd80e5a5295e5b9668a09b8992555a7b7f56e8
SHA512 c4b0b7858af637f82be08c967829972222a37208f27d4cb0c832b5318086ee1e433e4f3d491924fdd1ab0552c97fa2367fbf5e6fa33c4bdf78f1e5c09875ac54
SSDEEP 12288:xRA6kyKnxlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:xGtyKjnKmRRWEl43MqpALDXmCS
TLSH
T149F41205B3A86899E6390B749CB7105C8E7ABC641F3456EF1290EA2F1DF2FC0E970B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 d231f91fc5c4214850c8a8535db286aea1d9aadb78294c5f4cac7c6c4b04316d
MD5 d83126b302b0a61c614dbfc9d281b45e
SHA1 3c8836bbf39ab4e0b66d7fa548ef944f8b786046
SHA512 81db42bf400775153a9d4487639a3d95a06b340bbee9b9a6a29fb1ed46597d05a92db7119c7f21b4afe847f8ff8d9daee73c07b6fc04815e79bda2b58170b459
SSDEEP 12288:BAlplnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:ylbnKmRRWEl43MqpALDXmCS
TLSH
T175D4236DF2A9AC9AD5295BB1487F344C45BB70FC297C28BF169CAD610CE0EC1D9B09C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c2df58297a8ff29071ec677ee694f27bb3ee35fef2175b55e6393ac092ea5b9c
MD5 914e56307da631000cb4603962349d70
SHA1 7258e287540b75e447a3aa829edb9abd39943943
SHA512 a4b0a4fb88421e0096de32e55bfe0f9cbe42c0814f2c53f5d0b2475f8a58fdeb69bbe28982dce24fd67607b314d01caa95bf1bef0e86a57ce3ebaca27c9db8fd
SSDEEP 24576:RC+TyQIu93VAumZrHjm6GnKmRRWEl43MqpALDXmCS:R/TfIq+A0EutcDpS
TLSH
T120558C1DA7E91DCAE276C675C8A35493EA33B472137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 835970448ca611198ee99eee83a77caaa90a1a3716c8e70aa8f3f3bfc09670a8
MD5 60ef5d1a210b4dddf4b3b419a9f4637d
SHA1 9a1dafa0f142c60220d602b297ccfcbf9332d8f2
SHA512 a368ba5ea5fca793e649c434820e2fc85a0ca85a4ef01c5df05175c47602d1dce72e3233b5673c569d312f579228e487886a93da1ab2d385dc0d88717b61a024
SSDEEP 12288:5cyrWOstaa3kcsUTlnKmRt94ozq0p9IizX143+SoqcxmAYRUdXsGDCi63dQENI/q:cLQikZUZnKmRRWEl43MqpALDXmCS
TLSH
T10105F10FB3AE10A5D167C27888960159F6B37474172267DF02A0CB790FE79E9BD78B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 12773896c4e52270b6d00cb56e05272228f885e1e06a3a2021251175bff3cf1d
MD5 aaa8bcdc7ee25664a122f2e10c2c87a2
SHA1 d04834291dbeee25c23a85c0755566d1f06210d2
SHA512 6bca14fad7a1aecda00a91a4590e62043f0871b78db8e064638cfde9aec952bcc40fa2e30b85fafdc8d47c3a1a192d8f393a4d8a54926db71c19c1fc62a1cfa5
SSDEEP 49152:/pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPmEutcDpS:kpC7b4+80GTL75
TLSH
T144A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-56-0x000001BB74820000-0x000001BB74886000-memory.dmp

Download

memory/424-54-0x000001BB74600000-0x000001BB74748000-memory.dmp

Download

memory/424-55-0x000001BB74820000-0x000001BB74886000-memory.dmp

Download

memory/740-94-0x00007FF714E90000-0x00007FF714F76000-memory.dmp

Download

memory/740-18-0x000001E5C55C0000-0x000001E5C5626000-memory.dmp

Download

memory/740-16-0x000001E5C55C0000-0x000001E5C5626000-memory.dmp

Download

memory/740-15-0x00007FF714E90000-0x00007FF714F76000-memory.dmp

Download

memory/804-98-0x00007FF7043D0000-0x00007FF704516000-memory.dmp

Download

memory/804-96-0x000002F051F80000-0x000002F051FE6000-memory.dmp

Download

memory/804-95-0x000002F051F80000-0x000002F051FE6000-memory.dmp

Download

memory/804-183-0x00007FF7043D0000-0x00007FF704516000-memory.dmp

Download

memory/960-281-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-288-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-287-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-286-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-285-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-291-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-290-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-289-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-284-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-283-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/960-280-0x0000018B31910000-0x0000018B3382A000-memory.dmp

Download

memory/960-282-0x0000018B31490000-0x0000018B314A0000-memory.dmp

Download

memory/964-198-0x00007FF7BCB60000-0x00007FF7BD08A000-memory.dmp

Download

memory/964-192-0x000001EFE0980000-0x000001EFE09E6000-memory.dmp

Download

memory/964-193-0x000001EFE0980000-0x000001EFE09E6000-memory.dmp

Download

memory/964-271-0x00007FF7BCB60000-0x00007FF7BD08A000-memory.dmp

Download

memory/1064-203-0x00007FF6AE620000-0x00007FF6AE6CA000-memory.dmp

Download

memory/1064-116-0x00007FF6AE620000-0x00007FF6AE6CA000-memory.dmp

Download

memory/1064-117-0x000001F73B7C0000-0x000001F73B826000-memory.dmp

Download

memory/1064-118-0x000001F73B7C0000-0x000001F73B826000-memory.dmp

Download

memory/1588-184-0x00000194B4E00000-0x00000194B4E66000-memory.dmp

Download

memory/1588-270-0x00007FF79A5D0000-0x00007FF79AA9A000-memory.dmp

Download

memory/1588-185-0x00000194B4E00000-0x00000194B4E66000-memory.dmp

Download

memory/1588-186-0x00007FF79A5D0000-0x00007FF79AA9A000-memory.dmp

Download

memory/1744-64-0x000001715F550000-0x000001715F5B6000-memory.dmp

Download

memory/1744-71-0x00007FF62D760000-0x00007FF62D8C8000-memory.dmp

Download

memory/1744-62-0x00007FF62D760000-0x00007FF62D8C8000-memory.dmp

Download

memory/1744-63-0x000001715F550000-0x000001715F5B6000-memory.dmp

Download

memory/1744-69-0x000001715F550000-0x000001715F5B6000-memory.dmp

Download

memory/1996-213-0x000001F0687D0000-0x000001F068836000-memory.dmp

Download

memory/1996-251-0x000001F071BE0000-0x000001F071BE8000-memory.dmp

Download

memory/1996-235-0x000001F069920000-0x000001F069930000-memory.dmp

Download

memory/1996-219-0x000001F0696F0000-0x000001F069700000-memory.dmp

Download

memory/1996-215-0x00007FF7BDAF0000-0x00007FF7BDE2E000-memory.dmp

Download

memory/1996-212-0x000001F0687D0000-0x000001F068836000-memory.dmp

Download

memory/1996-273-0x00007FF7BDAF0000-0x00007FF7BDE2E000-memory.dmp

Download

memory/2128-126-0x0000027A0E6C0000-0x0000027A0E726000-memory.dmp

Download

memory/2128-125-0x00007FF7F30B0000-0x00007FF7F34DB000-memory.dmp

Download

memory/2128-266-0x00007FF7F30B0000-0x00007FF7F34DB000-memory.dmp

Download

memory/2128-264-0x0000027A0E6C0000-0x0000027A0E726000-memory.dmp

Download

memory/2128-124-0x0000027A0E6C0000-0x0000027A0E726000-memory.dmp

Download

memory/2128-209-0x00007FF7F30B0000-0x00007FF7F34DB000-memory.dmp

Download

memory/2180-173-0x00007FF71CF60000-0x00007FF71D34F000-memory.dmp

Download

memory/2180-168-0x00000211F82D0000-0x00000211F8336000-memory.dmp

Download

memory/2180-174-0x00000211F82D0000-0x00000211F8336000-memory.dmp

Download

memory/2180-176-0x00007FF71CF60000-0x00007FF71D34F000-memory.dmp

Download

memory/2180-169-0x00000211F82D0000-0x00000211F8336000-memory.dmp

Download

memory/2380-43-0x0000000000AD0000-0x0000000000BE7000-memory.dmp

Download

memory/2380-0-0x0000000000AD0000-0x0000000000BE7000-memory.dmp

Download

memory/2380-1-0x0000000002F70000-0x0000000002FD9000-memory.dmp

Download

memory/2380-7-0x0000000002F70000-0x0000000002FD9000-memory.dmp

Download

memory/2420-109-0x00000000006B0000-0x0000000000719000-memory.dmp

Download

memory/2420-105-0x00000000006B0000-0x0000000000719000-memory.dmp

Download

memory/2420-103-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2420-194-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2600-153-0x0000023CC22F0000-0x0000023CC2356000-memory.dmp

Download

memory/2600-260-0x00007FF677870000-0x00007FF677A5F000-memory.dmp

Download

memory/2600-154-0x0000023CC22F0000-0x0000023CC2356000-memory.dmp

Download

memory/2600-152-0x00007FF677870000-0x00007FF677A5F000-memory.dmp

Download

memory/2760-88-0x000002A429990000-0x000002A4299F6000-memory.dmp

Download

memory/2760-86-0x000002A429720000-0x000002A429868000-memory.dmp

Download

memory/2760-87-0x000002A429990000-0x000002A4299F6000-memory.dmp

Download

memory/2852-34-0x00007FF7EF2C0000-0x00007FF7EF54A000-memory.dmp

Download

memory/2852-42-0x00007FF7EF2C0000-0x00007FF7EF54A000-memory.dmp

Download

memory/2852-40-0x0000022DF4E20000-0x0000022DF4E86000-memory.dmp

Download

memory/2852-36-0x0000022DF4E20000-0x0000022DF4E86000-memory.dmp

Download

memory/2852-35-0x0000022DF4E20000-0x0000022DF4E86000-memory.dmp

Download

memory/3004-165-0x00007FF6D8620000-0x00007FF6D87B1000-memory.dmp

Download

memory/3004-160-0x000001D1DFB70000-0x000001D1DFBD6000-memory.dmp

Download

memory/3004-161-0x000001D1DFB70000-0x000001D1DFBD6000-memory.dmp

Download

memory/3004-263-0x00007FF6D8620000-0x00007FF6D87B1000-memory.dmp

Download

memory/3356-46-0x0000024818FE0000-0x0000024819128000-memory.dmp

Download

memory/3356-48-0x0000024819250000-0x00000248192B6000-memory.dmp

Download

memory/3356-47-0x0000024819250000-0x00000248192B6000-memory.dmp

Download

memory/3752-214-0x00007FF75AAB0000-0x00007FF75AB60000-memory.dmp

Download

memory/3752-134-0x00007FF75AAB0000-0x00007FF75AB60000-memory.dmp

Download

memory/3752-135-0x0000015660260000-0x00000156602C6000-memory.dmp

Download

memory/3752-136-0x0000015660260000-0x00000156602C6000-memory.dmp

Download

memory/3936-74-0x00007FF761310000-0x00007FF761426000-memory.dmp

Download

memory/3936-75-0x00000223D0070000-0x00000223D00D6000-memory.dmp

Download

memory/3936-76-0x00000223D0070000-0x00000223D00D6000-memory.dmp

Download

memory/3936-179-0x00007FF761310000-0x00007FF761426000-memory.dmp

Download

memory/4548-142-0x000001EEBBA20000-0x000001EEBBA86000-memory.dmp

Download

memory/4548-256-0x00007FF707E50000-0x00007FF708113000-memory.dmp

Download

memory/4548-144-0x00007FF707E50000-0x00007FF708113000-memory.dmp

Download

memory/4548-143-0x000001EEBBA20000-0x000001EEBBA86000-memory.dmp

Download

memory/4636-180-0x00007FF7471B0000-0x00007FF74746D000-memory.dmp

Download

memory/4636-267-0x00007FF7471B0000-0x00007FF74746D000-memory.dmp

Download

memory/4720-201-0x00000232064C0000-0x0000023206526000-memory.dmp

Download

memory/4720-202-0x00000232064C0000-0x0000023206526000-memory.dmp

Download

memory/4720-204-0x00007FF796490000-0x00007FF7965BE000-memory.dmp

Download

memory/4720-272-0x00007FF796490000-0x00007FF7965BE000-memory.dmp

Download

memory/4800-115-0x00007FF7DEB20000-0x00007FF7DEC06000-memory.dmp

Download

memory/4800-27-0x0000024574340000-0x00000245743A6000-memory.dmp

Download

memory/4800-28-0x0000024574340000-0x00000245743A6000-memory.dmp

Download

memory/4800-26-0x00007FF7DEB20000-0x00007FF7DEC06000-memory.dmp

Download