f350493528f2effbd9e21d360ff42be74e93c79e25b836e9696b8e1c033b3e29

Analysis

max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 749KB
Sample260527-err9mshv2y
SHA256 f350493528f2effbd9e21d360ff42be74e93c79e25b836e9696b8e1c033b3e29
MD5 f374578a51f490c8d65711eb2925639e
SHA1 a150dade356adc0e4831a2eacfc623243ce2a0b7
SHA512 cd9d0b81e2d3036d59c36aab6a5771dac45a55d119ec69a5e104c3c710869fa92d95e0d3b3af6b124709537e1251a078dfe53119b3a0a82ef689bfed0cd94e13
SSDEEP 12288:G9/G6vHzOASubviBNDYa3hk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:GNGGTWBZRL9nbRdg5MDKQv3vgTw
TLSH
T181F4122132D09073E9B2053459B0ABB0563DFE302F71DAEF67581B2A5DB06E15E39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3152	alg.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3112	fxssvc.exe
3564	elevation_service.exe
4076	elevation_service.exe
4388	maintenanceservice.exe
3348	msdtc.exe
4640	OSE.EXE
2180	PerceptionSimulationService.exe
3064	perfhost.exe
1036	locator.exe
3108	SensorDataService.exe
2568	snmptrap.exe
5000	spectrum.exe
1196	ssh-agent.exe
2964	TieringEngineService.exe
1664	AgentService.exe
1548	vds.exe
496	vssvc.exe
4476	wbengine.exe
1808	WmiApSrv.exe
3748	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f2477e6c9945a43.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180281\javaws.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c30bd7f08eeddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d440de78eeddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1161ae68eeddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
696	Process not Found
696	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	3112	fxssvc.exe
Token: SeRestorePrivilege	2964	TieringEngineService.exe
Token: SeManageVolumePrivilege	2964	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1664	AgentService.exe
Token: SeBackupPrivilege	496	vssvc.exe
Token: SeRestorePrivilege	496	vssvc.exe
Token: SeAuditPrivilege	496	vssvc.exe
Token: SeBackupPrivilege	4476	wbengine.exe
Token: SeRestorePrivilege	4476	wbengine.exe
Token: SeSecurityPrivilege	4476	wbengine.exe
Token: 33	3748	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3748	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3748	SearchIndexer.exe
Token: SeDebugPrivilege	1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1364	2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3972	3748	SearchIndexer.exe	105
PID 3748 wrote to memory of 4080	3748	SearchIndexer.exe	106
PID 3748 wrote to memory of 2200	3748	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_f374578a51f490c8d65711eb2925639e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3152

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1924

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3108

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:496

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3972
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2848 2828 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4080
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2852 2820 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 82fcc64312dd3915df643c479650c31c54c620b2cd56f2c1bde151e9a37fb565
MD5 84bc707e9f40ea0c9fa29b7c1287cd93
SHA1 46c7c61798d3d935c7ba1b764eabd905b41c9682
SHA512 38b561806096284d15af2015963e413a2ffb86b5a08b07ed437868a6e78510fc73878b1a23d5838e9fc86b6e1332dfcb33a8a6c2ce494e58c5a5750e401666d3
SSDEEP 49152:IWV632BuPkFKRrdE6oh7stBhuXjfS4LWxnaLVg56l3gT:K3q6gjBfg56
TLSH
T1D7D59C03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ac3f5d0e5ac6aa4219b54ca1a58dc56ec23dea06ec2197df10445bc46a5ca976
MD5 6489c9d27e7632220aecf74c6383b896
SHA1 a1202ba3f3e6f49de8536cfc4c12178f1ebd1524
SHA512 837bab08562b74f199c720d28b4d4901968fc185efda3577648f7ed6b633f97f402bd7cdb0412a4180ec4dd05d5601a5c4838b6c4eaf9e6e2f38dafb9d3d8c4e
SSDEEP 12288:z1XLs6iGCx8HbY62czAMk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:pXYXRFczAML9nbRdg5MDKQv3vgTw
TLSH
T1D005012463E408F9ECA7827CCCA18611E7737C554760E79F07B89A264F237985E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 85dcddc0731458f0b9f414de4f0c1f7bcfc8f755ba57235b1ae58826422e8fc8
MD5 f6f607530d591357b6d1bb2c3f053785
SHA1 a09ddb7f89df06da051607a793a988974fb87101
SHA512 3616569d63bd7fad092de3fe39182edd5f5e44bdfa88abdbfdac52b1e4ff5840cef02e02c45516a2db5745eaffe30fcd8f80678222177a78e30d75606d956cb1
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+Cyk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:uwuuOW1L9nbRdg5MDKQv3vgTw
TLSH
T16B05F14537A81CF9E9A24238C5579636E7F2BC012A21DB1F4B70C75B5F23361AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 52cf89b8e04338fcb8df8210d8c2117210233100d8968491fdaf1e80f204967c
MD5 ffbacfa944bf54359f033fcd048939a1
SHA1 ddd3b736321cdf8e8e4a54e89dd33cb7fbaa5d38
SHA512 012be6abbfc8acd7d015d11a5357dab2a23287b2c66c445e175309a9e775b9016b1f2377a8a9dde6f861720109c170b116c37d1db3fd754e5165845dcd7e498b
SSDEEP 49152:IM+taZ3usBWOBr4tEGp0bqx0z+n217aau1glRLVg56l3gT:zu6JmTxd2d7g56
TLSH
T120D59E13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 dc2fdb5316596aba52c7cd9866dff91dbfecf5e0a3c6cbba30c68f02b0afa27f
MD5 8f6784841279e40da9d7b74a84e9bd2a
SHA1 2378eba1917b1b628ab46ee28380bc3404e1bbe0
SHA512 b082264528e82c139f3b4f7a0249db5f09d7ef1b43d58d665d51a3c9b368ac8c9da43ab0f18edaad58e2dbdf1d0408b0674bd328fc3ea325be9067753c553a95
SSDEEP 12288:ujk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:ujL9nbRdg5MDKQv3vgTw
TLSH
T177D4232147BC7441F9F013B8E5587764436D3BA93B21E7EFDC2C5B1298909F4AA3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9107bbba3cb4427018489127e48a20b417c73bd1d4ce07b1157148059263fbc6
MD5 21063d332893393905f20b49200d227b
SHA1 1a1c38ae242a7dbfd199869b772d40cdbcebe872
SHA512 a5a0dbb9aa6059c37f5a6b56f24f87292958d527478d6eff906a970d00ac453515d335a7ea18227fa5d125542e390db936b5ea6ad097d2bdfcb9dd7b8910804d
SSDEEP 24576:mHCMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCnL9nbRdg5MDKQv3vgTw:YCZwQCyiHiQEaTPnMOLVg56l3gT
TLSH
T1DF85A01E62DC46A5E0BAD2B8CD674407E6B278165731A7CF0190C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 704KB
SHA256 5ce27e96b2574415d64ad948ac2c7ca23101bec869f6d7d24ff60d0fd2e41098
MD5 a71d14fe59d8209ce792d2f79090a390
SHA1 1c7c595c2d71b2d7d294bc06d799f6ecc3cfda05
SHA512 57834150791c47faf2c3845c6c17188f4c92da19ad0cd69b7ed66904dbcf6b19968a5b8c04a33bf0c7e3039dd4749aa173788e3e41d5f73ae28c69c44d3dde1d
SSDEEP 12288:7ixA1U7K3k7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:7ixA1UG3L9nbRdg5MDKQv3vgTw
TLSH
T1B2E4122E16AC24E4F5B0927DD9958205C3317C2A2721D7EF58A5833A4F27EF46D3AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5b5d1ad35edb267aaa80e162845306b83e81d4a3d02b7bcaac7b0853c75a8c17
MD5 c588920e540a6c90b044658d032ad01e
SHA1 90922f2a44495051f226914bc11a8d3909ca895e
SHA512 741063c5d14466ce672463c21942a63c1b98246fa8cd35e4cee497a0f4c3430da403cde5aa774af6dd56549f20b5be720b3fd05b04adcfd36333d31679816112
SSDEEP 24576:AismPhyHaqrVqHra44KDzM+rndL9nbRdg5MDKQv3vgTw:AiRPhyHfVqzlA+rndLVg56l3gT
TLSH
T12055BF2EF2B910F9D4AAD136454107B5AB71782D1F209BCB0170C635AF0AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 4e69481851e64282445c88bbcf12735ac092939e4e74c2464548b4dd8ec70033
MD5 19a2fc08226bf58aab1cfe178dfbe56d
SHA1 de17e1df77dede9dccdbb3a2da91a630f2d359e3
SHA512 ec485357652e91362eec9082c91267d501a63a0f4d56588d00643169098dc574bca1d53aebed14aaf05f80e57580e572ac0e1c1cc6e17da69c878b875b730f39
SSDEEP 12288:Q0k7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:Q0L9nbRdg5MDKQv3vgTw
TLSH
T1A7D4232106BC7080E9E053FCE644379983593F593B32E7EEDC3D6B1289C59B5663AAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 963KB
SHA256 2dba0f374437a11653e8266e488f65b1ea6712aa27d486292afec35061bd7d47
MD5 077e968e7e8675b583f6abf2a6f1f38a
SHA1 0034b18be900b111b4cec0e16ffc5434d64e3c37
SHA512 26c9a867674b341037705d07876d7780117dafcf08d2d2353a8fce9812d5d8efd05f9aabe4b767044527600824f566320d5ea2be842cdbdf5b743f83b9b6c698
SSDEEP 12288:IEgzA4LWO+vAYFT3k7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:wHLBUT3L9nbRdg5MDKQv3vgTw
TLSH
T1D4250111E7A810F8E9B7823CC9629A16D272789D1324E7EF07684B661F537F14E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 e4bc3ac876b00b52e21030eaee0f52f0a4adb52cdc2b6bf6462cd6db5555da63
MD5 c82f5698f49875dd8996eed357f0cad3
SHA1 d963bc77b8a7948da08f8e809c7c71fc2795bd47
SHA512 158cd976afe0ed5cab870af33ee4f7182afab7e1256f379df70cbcf948b6a2c1027ae779481ff8e4e8d846dd45f2adfc86183256b18972a423a79ee9dc1cc2eb
SSDEEP 12288:e8X6mzIYNvUyBpPk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:J0YNH9L9nbRdg5MDKQv3vgTw
TLSH
T14705F12E52AC18E4E57B917DCAC28649F27278661711D3DF05B0837A0E17EE8BD3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 9549c41238997ba98b065bc6d14936bfb154a39bb7ef4c6fce20a535479df72b
MD5 3f0659d54cddb8e2942ff881fa74764f
SHA1 17b2296d1f056ce40483454ba831ebc2b508541a
SHA512 89251e4e4f8d69bc858d49352e83144c191e5cf9372dfb437d568aa30d89a3d3a8bb62be9c2bbe9eee43576a2e34aef3f15a2cbfd67d6bccd0ffed5521d1e6d3
SSDEEP 24576:pZXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKf:pZXoJJYH84VVS6AmEFJas+cHBjSSKHPo
TLSH
T12C65CF6EA2BC04E8D5BBD17CC5C25506F5B178661331CACF022182BA7F17AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ddc00302420ebb59db7095f7fc13178c05f019d7bd679555dae3d5de85e8d303
MD5 ad75de6bdffb6ff939078acd890b20d9
SHA1 1fac2d5263ef6d59e491027ae7af3ec42a871f67
SHA512 259c0a3754ae13d6865389f9f6398d971a3365f8e090467015705b1f8355ce5da1bbeca0345051202aa1d4324f039c3976a81e506ac22d04415c9de2ea9e2b32
SSDEEP 24576:Hv7Xbxd9Tuycf8M/TYlSux/r2PCdL9nbRdg5MDKQv3vgTw:HDLL9TuJ0M/TYn2PgLVg56l3gT
TLSH
T137858D1EA3EC52D4E0BBD6BD85B79146FAB2B855273081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 2e68b4638f73eb0ae800663189e6acfb6c7bb36e1b28568571fffac06564a46a
MD5 dfd580492daaed2234610b92197681b8
SHA1 53185e077129655a1ecb774194ea6264c36ee720
SHA512 d233f94bfb6c77a9c975bb12aa8846002b1a5b1e93b3baf116a0cb4640fb7d24adf6aa27a66e5bfaeee3540ab0beb38b4e224d5ac032ef4fa325ba552502685e
SSDEEP 24576:OegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wLL9nbRdg5MDKQv3vgTw:OngOJOmPOHFLLVg56l3gT
TLSH
T14B55CF3FA7BC15D5E07EC17D8A928916F6B1782613259ACF0560827E5F1BEF42E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 6edb3b51030d1cf6b854802811358977b5e32f37e52c5c6055d5b1cb975245e6
MD5 79c8a7c6b7aed5b048fec83541b0e96f
SHA1 8c7904a193dae451d47b62bb7510f97fe1d1cd70
SHA512 3a0f8e6fbb29325b926e16b171937b17c2d28e107b736eaf9d065d3c6059527a001f2f6f9883649ef5caee1122e8b8408c95ce6a87142aac39f81cb725ab949e
SSDEEP 24576:yiJnJuqL3R3way4JrOhL9nbRdg5MDKQv3vgTw:yiJnJ/TR3C4laLVg56l3gT
TLSH
T15F15D03CD2A810E8D4B6C2B4815A2756FF31346D3B21AACB59B4D5313F02FE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1354e023090b047058dc372015614f5d8514f886ee686eb27a873daa4ae7fafb
MD5 8fbf348a069049f2e9d55612d9ee5798
SHA1 e97099a085c755a991c5630d262c3ff543a3f70c
SHA512 f5f5e41fe4880a2d17a2e5d5b28ade2cf1a5fa18f330825f4a086262698bf51075fa37e4e7d83cf5a83d1b4192dca82a7855bb9142ddc134d8f282d9f041ad36
SSDEEP 49152:G9EqCzDScAZmlvTcFg8Ph6dLVg56l3gT:yMg56
TLSH
T1C1A55D05F7EB5298E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 704KB
SHA256 27d39e810c8a3730090c4e55b81b51136933156bfbad544b31e05ba2991c5b0f
MD5 3a928d18693b8d01e9378de6d032341d
SHA1 ecb533ec3b952727e8ae339ad21bbac0fd9e676d
SHA512 887e4de5959b86aab70e074d9de1bee711817415ab691bf2657546c698aa491f89bcbd50f928edfb8f7e77b1354f85ad3097cd9e96875c8edede8edd337c2cf4
SSDEEP 12288:ylYJeXmYQkXkuETk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:ylYJeXmYXkuETL9nbRdg5MDKQv3vgTw
TLSH
T18BE4122D26BC30E4E1A8917CD5914A54C372B4652312E7FF89B4C6768E87AF52E3DF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 8f71ef815b4a6f8bf4c98e8a514d54585b40205a2d00bf66d8a55da95c34841a
MD5 cab4940a4b89faf2a37487011a9d2be7
SHA1 c61bff646e10680a1b5de5074ede53b3a679e5e3
SHA512 a0451dea895fb9896dbb693e8f3a6645bd4a9c51419a77a5292fa7fffe6aa7d534ee2e380eb68fd8ffb934b79f372a685bf0009afa8647c8810ee52c9f5a98d6
SSDEEP 12288:HSD6kyVEk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:HWtyVEL9nbRdg5MDKQv3vgTw
TLSH
T14BF4121013A87094EAF4027CDA625294CB357D242F21D7EF88A0EB3F5E72BE4A935F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 b1e0ad36c6dd6c011c4d5b35c2de528cbb4430fde0abe908d21adb0c496d7dbf
MD5 c2048c3a6ba110a8bfae84ed4980e9b0
SHA1 f542f77d2ddc60f59dccb918cadfaa08d7c726ac
SHA512 6c2b83933522e3be5b40f33ad4aeb0942a9c618f9d1f67816c89e86cdf6625978a39b2da6140a4319a18f3c67205080af3260d9bd416f6b52b5828a0dfb0cb23
SSDEEP 12288:sn7k7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:M7L9nbRdg5MDKQv3vgTw
TLSH
T192D42321027C7094E9E052BCE5142B9583693B693B31E7FF9C78DB32CDC6975662AEC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a6212256fbd956b2fd73dc5d9c0dcc3cd0e39b5cb354774d7925294ecf9f4524
MD5 131b87e369cd8c3587b176793206488a
SHA1 f31d72ffe0f5bcf6bf00b3fccc752dcf87399ae6
SHA512 597b284bddb9fe893b5d15aec36c3cfa3e6849320a579c1607118aab72d67fd333f3373f8e47a9b02429589fbb9c5a32e26b50506034136dd23f139256a0d2b3
SSDEEP 24576:IC+TyQIu93VAumZrHjmdcL9nbRdg5MDKQv3vgTw:I/TfIq+AdcLVg56l3gT
TLSH
T1A2558C1DA7F919CAE2B6C675C8A34493E6337872137186CF2444C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 2f934fa1c8ecec2eb3293ac9b2709c5a1e2177b004da3d90fd7b2749d00b0643
MD5 0525618ab2adfa4227ea83e5760b4795
SHA1 5b7947d7d5cbb102334015f9162270851404e4be
SHA512 57ef51e738df8e58e3758b2f49ddada08d5177206a1cbfd3f88272d563e568d0e79341fe9be9f1827fc8299a1971fdb4daa3a1531d07b16f88aa6a2c4f4cf841
SSDEEP 12288:hDV2WX4vaa3kcsCk7+zo09L1zaNXiK+7K+RDhg5MDKQvyOK6gsuw:7ICikZCL9nbRdg5MDKQv3vgTw
TLSH
T11605F10EB3BE10A5E0A6827CC8454252F7B374751722A3DF46A0C77A4F975E9BD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 10d755ebca62feeb6ef6349c45cad3cbc2fe2e2abf3e5be910264338a2548ac7
MD5 f7f22140db339dfdcf3003c19610c768
SHA1 14ff4b048e7225f2c3fdb928f351ca22f75fa6d2
SHA512 a5502cf3c4a40efe3d46c7c5d147f2eb92e6182f98f94050b574f611cd7a1be722f146cd70231a59fc38bf99431206cc5d1348ac8686dc07cb473ae648bbeeb6
SSDEEP 49152:08JKQrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPsLVg56l3gT:1pC7b4+80GTLxg56
TLSH
T143A57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB00B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/496-187-0x00000158AA8E0000-0x00000158AA946000-memory.dmp

Download

memory/496-186-0x00000158AA8E0000-0x00000158AA946000-memory.dmp

Download

memory/496-191-0x00007FF7F0E40000-0x00007FF7F130B000-memory.dmp

Download

memory/496-269-0x00007FF7F0E40000-0x00007FF7F130B000-memory.dmp

Download

memory/1036-118-0x000001EA8A690000-0x000001EA8A6F6000-memory.dmp

Download

memory/1036-192-0x00007FF67DBB0000-0x00007FF67DC5B000-memory.dmp

Download

memory/1036-117-0x000001EA8A690000-0x000001EA8A6F6000-memory.dmp

Download

memory/1036-119-0x00007FF67DBB0000-0x00007FF67DC5B000-memory.dmp

Download

memory/1196-155-0x00007FF7ABB10000-0x00007FF7ABCFF000-memory.dmp

Download

memory/1196-154-0x0000023387550000-0x00000233875B6000-memory.dmp

Download

memory/1196-153-0x0000023387550000-0x00000233875B6000-memory.dmp

Download

memory/1196-215-0x00007FF7ABB10000-0x00007FF7ABCFF000-memory.dmp

Download

memory/1364-1-0x00000000030F0000-0x0000000003159000-memory.dmp

Download

memory/1364-44-0x0000000000D60000-0x0000000000E77000-memory.dmp

Download

memory/1364-0-0x0000000000D60000-0x0000000000E77000-memory.dmp

Download

memory/1364-6-0x00000000030F0000-0x0000000003159000-memory.dmp

Download

memory/1548-268-0x00007FF71F2C0000-0x00007FF71F57E000-memory.dmp

Download

memory/1548-182-0x00007FF71F2C0000-0x00007FF71F57E000-memory.dmp

Download

memory/1664-171-0x0000023177D50000-0x0000023177DB6000-memory.dmp

Download

memory/1664-172-0x00007FF779D50000-0x00007FF77A140000-memory.dmp

Download

memory/1664-170-0x0000023177D50000-0x0000023177DB6000-memory.dmp

Download

memory/1664-178-0x00007FF779D50000-0x00007FF77A140000-memory.dmp

Download

memory/1664-176-0x0000023177D50000-0x0000023177DB6000-memory.dmp

Download

memory/1808-206-0x00000213F6EE0000-0x00000213F6F46000-memory.dmp

Download

memory/1808-272-0x00007FF779290000-0x00007FF7793BF000-memory.dmp

Download

memory/1808-207-0x00007FF779290000-0x00007FF7793BF000-memory.dmp

Download

memory/1808-205-0x00000213F6EE0000-0x00000213F6F46000-memory.dmp

Download

memory/2180-181-0x00007FF65A030000-0x00007FF65A177000-memory.dmp

Download

memory/2180-98-0x0000019DAF3C0000-0x0000019DAF426000-memory.dmp

Download

memory/2180-96-0x00007FF65A030000-0x00007FF65A177000-memory.dmp

Download

memory/2180-97-0x0000019DAF3C0000-0x0000019DAF426000-memory.dmp

Download

memory/2568-136-0x000002B62AEE0000-0x000002B62AF46000-memory.dmp

Download

memory/2568-135-0x00007FF618BD0000-0x00007FF618C81000-memory.dmp

Download

memory/2568-137-0x000002B62AEE0000-0x000002B62AF46000-memory.dmp

Download

memory/2568-204-0x00007FF618BD0000-0x00007FF618C81000-memory.dmp

Download

memory/2964-163-0x00007FF7CE3E0000-0x00007FF7CE572000-memory.dmp

Download

memory/2964-162-0x00000262020F0000-0x0000026202156000-memory.dmp

Download

memory/2964-161-0x00000262020F0000-0x0000026202156000-memory.dmp

Download

memory/2964-262-0x00007FF7CE3E0000-0x00007FF7CE572000-memory.dmp

Download

memory/3064-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3064-111-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/3064-106-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/3064-185-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3108-197-0x00007FF726930000-0x00007FF726D5C000-memory.dmp

Download

memory/3108-126-0x00007FF726930000-0x00007FF726D5C000-memory.dmp

Download

memory/3108-255-0x00000168943D0000-0x0000016894436000-memory.dmp

Download

memory/3108-258-0x00007FF726930000-0x00007FF726D5C000-memory.dmp

Download

memory/3108-125-0x00000168943D0000-0x0000016894436000-memory.dmp

Download

memory/3108-127-0x00000168943D0000-0x0000016894436000-memory.dmp

Download

memory/3112-37-0x00000206AF690000-0x00000206AF6F6000-memory.dmp

Download

memory/3112-34-0x00007FF69A700000-0x00007FF69A98B000-memory.dmp

Download

memory/3112-35-0x00000206AF690000-0x00000206AF6F6000-memory.dmp

Download

memory/3112-41-0x00000206AF690000-0x00000206AF6F6000-memory.dmp

Download

memory/3112-43-0x00007FF69A700000-0x00007FF69A98B000-memory.dmp

Download

memory/3152-14-0x00007FF654090000-0x00007FF654177000-memory.dmp

Download

memory/3152-15-0x0000017C39FB0000-0x0000017C3A016000-memory.dmp

Download

memory/3152-75-0x00007FF654090000-0x00007FF654177000-memory.dmp

Download

memory/3152-17-0x0000017C39FB0000-0x0000017C3A016000-memory.dmp

Download

memory/3240-28-0x00000215095D0000-0x0000021509636000-memory.dmp

Download

memory/3240-26-0x00000215095D0000-0x0000021509636000-memory.dmp

Download

memory/3240-104-0x00007FF621660000-0x00007FF621747000-memory.dmp

Download

memory/3240-25-0x00007FF621660000-0x00007FF621747000-memory.dmp

Download

memory/3348-76-0x00007FF7212B0000-0x00007FF7213C7000-memory.dmp

Download

memory/3348-77-0x000001FAFCF00000-0x000001FAFCF66000-memory.dmp

Download

memory/3348-169-0x00007FF7212B0000-0x00007FF7213C7000-memory.dmp

Download

memory/3348-78-0x000001FAFCF00000-0x000001FAFCF66000-memory.dmp

Download

memory/3564-47-0x000001A4AB7D0000-0x000001A4AB8FC000-memory.dmp

Download

memory/3564-49-0x000001A4AB9D0000-0x000001A4ABA36000-memory.dmp

Download

memory/3564-48-0x000001A4AB9D0000-0x000001A4ABA36000-memory.dmp

Download

memory/3748-238-0x0000021DD25D0000-0x0000021DD25E0000-memory.dmp

Download

memory/3748-218-0x00007FF60F6F0000-0x00007FF60FA2F000-memory.dmp

Download

memory/3748-274-0x00007FF60F6F0000-0x00007FF60FA2F000-memory.dmp

Download

memory/3748-254-0x0000021DDA9C0000-0x0000021DDA9C8000-memory.dmp

Download

memory/3748-222-0x0000021DD24D0000-0x0000021DD24E0000-memory.dmp

Download

memory/3748-216-0x0000021DD1190000-0x0000021DD11F6000-memory.dmp

Download

memory/3748-217-0x0000021DD1190000-0x0000021DD11F6000-memory.dmp

Download

memory/4076-55-0x000002BD2D800000-0x000002BD2D92C000-memory.dmp

Download

memory/4076-56-0x000002BD2DA50000-0x000002BD2DAB6000-memory.dmp

Download

memory/4076-57-0x000002BD2DA50000-0x000002BD2DAB6000-memory.dmp

Download

memory/4080-277-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-280-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-282-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-276-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-275-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-278-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-283-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-279-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-284-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-285-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-286-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-287-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4080-281-0x000001C2BB610000-0x000001C2BB620000-memory.dmp

Download

memory/4388-72-0x00007FF705420000-0x00007FF705588000-memory.dmp

Download

memory/4388-70-0x000001394A1A0000-0x000001394A206000-memory.dmp

Download

memory/4388-64-0x000001394A1A0000-0x000001394A206000-memory.dmp

Download

memory/4388-65-0x00007FF705420000-0x00007FF705588000-memory.dmp

Download

memory/4388-63-0x000001394A1A0000-0x000001394A206000-memory.dmp

Download

memory/4476-195-0x0000020D96710000-0x0000020D96776000-memory.dmp

Download

memory/4476-196-0x0000020D96710000-0x0000020D96776000-memory.dmp

Download

memory/4476-270-0x00007FF608E60000-0x00007FF60938B000-memory.dmp

Download

memory/4476-198-0x00007FF608E60000-0x00007FF60938B000-memory.dmp

Download

memory/4640-88-0x000001C804AE0000-0x000001C804C0C000-memory.dmp

Download

memory/4640-90-0x000001C804D30000-0x000001C804D96000-memory.dmp

Download

memory/4640-89-0x000001C804D30000-0x000001C804D96000-memory.dmp

Download

memory/5000-143-0x00000266E3CB0000-0x00000266E3D16000-memory.dmp

Download

memory/5000-145-0x00007FF60CEC0000-0x00007FF60D184000-memory.dmp

Download

memory/5000-144-0x00000266E3CB0000-0x00000266E3D16000-memory.dmp

Download

memory/5000-212-0x00007FF60CEC0000-0x00007FF60D184000-memory.dmp

Download