expiro | 2270510b6dd97cf35a38597bb3f62e1024229c54bfad3671553fa2d6bda48a97

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 552KB
Sample260425-clq4aab16w
SHA256 2270510b6dd97cf35a38597bb3f62e1024229c54bfad3671553fa2d6bda48a97
MD5 205d9dad0e2f439686bd13b8a986e25b
SHA1 93dea38096ad2c080b84df7571b916b91f9c50f4
SHA512 c55c33dce16b3578b521c4583c88a524074488b73b2a3ebeeed94e6705b5bd20b725253c4d7d1cd971bfe5b8309864cc2d546734a0ee7c9ada463ce84e49100c
SSDEEP 12288:tlPrGxzQ9TA1ubv6I83fBu6Tc0ISmXjROUxyi0GaEVZyXE8:tlzGxmAPBtaSmXjAXi3
TLSH
T1E8C4CFD330C0C822CFE29BF448BC6662666EE8F4A7D5C45B639C23DC3E647C9D619916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery expiro

Malware Config

Signatures

Family: Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 5 IoCs

backdoor

resource	yara_rule
behavioral2/memory/2096-0-0x0000000000F4E000-0x0000000000F7F000-memory.dmp	family_expiro1
behavioral2/memory/2096-1-0x0000000000EC0000-0x0000000000F7F000-memory.dmp	family_expiro1
behavioral2/memory/2096-2-0x0000000000F4E000-0x0000000000F7F000-memory.dmp	family_expiro1
behavioral2/memory/2096-4-0x0000000000EC0000-0x0000000000F7F000-memory.dmp	family_expiro1
behavioral2/memory/2096-5-0x0000000000EC0000-0x0000000000F7F000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
defense_evasion

Executes dropped EXE 5 IoCs

pid	Process
4324	alg.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
968	fxssvc.exe
2100	elevation_service.exe
3884	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\E:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\T:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\R:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\J:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\W:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\I:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\L:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\S:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\N:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\K:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\M:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\O:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\P:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\U:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\X:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\G:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\Y:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\H:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\V:	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\N:	alg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\msiexec.exe	alg.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\SysWOW64\anialflj.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\locator.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\wbem\nbhmdmfj.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\SysWOW64\ailhhdcg.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\diagsvcs\dcdekbed.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\mfnlmmia.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\coedcjae.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\openssh\mekphnmo.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	alg.exe
File created	\??\c:\windows\system32\bhobckoc.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\SysWOW64\kcpcdphi.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\oghklbdc.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\cdpegoef.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\nkdiokae.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\alg.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\hddgpdob.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\feoooibi.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\windows\system32\annqbnci.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\jmofaklb.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\pijgofaf.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\dendjgfp.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\cobmhpje.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\program files\google\chrome\Application\140.0.7339.81\cadjlfom.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\mnbehiff.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\lhbjhkab.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe	alg.exe
File created	C:\Program Files\7-Zip\lncjookl.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\nnbpngba.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\hfoijjjp.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\kjkookie.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\pabmlgjl.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\jfjkgccl.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clmaedbq.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\dddilmae.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\pgildlkb.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ldcnmoao.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	alg.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\dbpkoikh.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	\??\c:\program files\windows media player\fcbmhmif.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\servicing\lmbddenk.tmp	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	alg.exe
File created	\??\c:\windows\servicing\mkjimkic.tmp	alg.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe
4324	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2096	2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	968	fxssvc.exe
Token: SeTakeOwnershipPrivilege	4324	alg.exe

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_205d9dad0e2f439686bd13b8a986e25b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4324

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4984

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.6MB
SHA256 b1642aa114a119bb5c8b4c9fa169b1c99dbe0344d90ecf034f75d8597f82c0a4
MD5 e3e59bfe7bd7954ce99ed57af23811f5
SHA1 cc51e81beda32f3fe2abde647d939e1c593a056b
SHA512 b4f6ad2f3d0b349d1630c001e593ab6f4067dea67f61ba1bb50c71cb0e33c958d66dde5657fe04b888622779202e07262012908483e229125b39c4d15c524218
SSDEEP 49152:Db+632BuPkFKRrdE6ohFstBhuXjfS4LWxnCmvGwn9:h3q66jBlmvGw9
TLSH
T182C55A03A29930D4DC6DC1FB970A9122EBA1BCC90B24A7DF069076752A77EE75B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 941KB
SHA256 441354232818e565ee1f07486e8f84841b1ce983d930e32cadf8893ee19ef75f
MD5 d881e870800a11866cf1c24466de944b
SHA1 8723b01cc8e1311574ca1f2447bc76a5d5b629df
SHA512 549f23f3f368c8dbdfe90b904256e81a08fe10243fcdbd25e0d3f03d962b4209b5570eea5221e0a182df572542f7d85dde4f5218278cbcd54c099744c60e7198
SSDEEP 12288:9XZNYVLeyUji0h90ZD0wxpGZIVuOrHsRdSNhEbc3XOwHWr8sxOwkYyOtDFO49:T0Le5ji0hmx1rMRdSNOJr8AkYyOhFj
TLSH
T188256B15F5648721C033C1B9F5D6A68EEB3230465B30B9CB4389976C3E676EE863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.3MB
SHA256 d841400f51ee78732ca3821ce9dfd38e808aa5c1b8bda6451eca8a6a63ea0b2b
MD5 ae688d9bc7d8e4e1b859974a7925711e
SHA1 c97e410e2a7770475ca36c4a1a9480af5427ba76
SHA512 7dc501a585c8ec462ecfebdacacd6940715dfe042b99eaf98cf9c5025c32921665f187ec8bf7ff2b71d5d425944c47537939a1153fa3da6caf386f5da98f531c
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWh6q8wyuxGzhowQL7CYgA0WCUKCQimj:m/ezSC6vUzPvUHjyOkhow+OA0WRKJimj
TLSH
T196550725B5F88F23D0B2D0BAC5D66A5DF9FE3046C73089FB024692282D276E58537739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.1MB
SHA256 997b6ac13f5ec0e42fd2e23d6265b7a934e186bd2ffcbc196250e36c1d27baae
MD5 d9d530bb3c4895f79ecfb06d08ce0edd
SHA1 45efdd6218db3a07c1c736fb84954eac8a63f80e
SHA512 3937555200daad803e59231d3c35b86ff084b15734263c1d19b5a1d4c9f62322676d6a3bd32479c93bf41e293aa70c0122b0adf836cc0919c813f8f24be3baa2
SSDEEP 12288:UVJjBq33vb5O8M+l1D0hwsEBoW/lx42f0Im98TW4bFoJ4h6pOH2HxN4/qiFvIucq:UVbqPb88hv/l+mnbFoJ4HH2e/Iz
TLSH
T163352866B16CB321D072C079C4F29A9EEA733C4157338ACB124697682E67BD7D237721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 406KB
SHA256 3c1be032d6f0f82f5d4e038e1e61b1ac7a03f6389cbf533cc48f26f6154c4ed2
MD5 57b073f384c013a03025081855ae0819
SHA1 fed0c0b8e24d7af7f437dbd569017eb13d992f73
SHA512 ba95726d9f55ad67dc7a9f596960f0fde954358998d25441d7ac054e6d4ba045bb96f874494179d9adce9412a1061488b65f5c23d7aeb60c89595fa1afbfc7d0
SSDEEP 6144:laPB4hdo2t4Z1LnUnO0pAb2mJ+HjNov5yvRPri8QtMk7dGfwI1ylBAiJe2GKTXk:lKBwdoc4ZlL0pGq+vMZziV17kRiap
TLSH
T1A294BF2074E0DA00C860D7B699BDE7EB768BA54CD2D9D4796FA9373C3F49A8D530D808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 668KB
SHA256 a5c71af3a2b1fe74231387a80b200411db7512e437a2a8edc55bf07b942d29fa
MD5 8f08ce9cac2939d665eb94ad690f2bcd
SHA1 8a3e5ccc0e7e8eb13bfaa44600db2ce517032707
SHA512 5d3b02f737a3d1ff7ed3bdcfa4c666dca28b9d1e4f004c51d11d0309fe91747e0944e26b03c2c5b3919a8007e1615a5620d949e84117851b3843f342bf6ab3ed
SSDEEP 12288:neBNUbTVO86UDKr2T4YJKminHUM2l5tmekQQ6Oe+I:nJIUs6nJdGrQQ6X+
TLSH
T103E48CE69D2CEFD1C1BA89BB46958200A37274704BA197CBD1E48209BED37DC1E7DC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.5MB
SHA256 27e583cdc19a761d88bc4509dc9780a30fe753e08d95f04fff398f32a29e09fd
MD5 16bde58a1519af0db9626e149db37980
SHA1 69a4edca9d3449c3ccf3b3d02e75a71ae8a1a1de
SHA512 1ace112e4b6ef15bf604a4ddd06874100dac1fce017069ea65618977d7b40ce7a7900eeab5db6b54e2a9824c17dde76b045cce8b852e951aad3bcb943ba766ce
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJP9DN5J8NRV3THf:rQvGAdlCEL8c/PRNw5CZqG
TLSH
T160263A756BE880F5E0A6D1748A7E8772F7767B031931AF0B0251C66F2F33A908D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 734KB
SHA256 e4c4dd8c14e734fa2ba37eb46c84079ec94ba0717918ba943755c38d90c2dde7
MD5 ab8520eda5c2769ad624766bb6460a4b
SHA1 2b5cb771cd97e78851c55de05445124c7c03dde5
SHA512 ee5db2f1b21212195eb2b1521589a9e60807e5ca3dea665a762d028322be2f8448c6dea161d21a73b6157cca77d045e8cc06de9f9fa59209420a8b176d6ca77a
SSDEEP 12288:dAwSfxL/2Dc3HDLLmt0LDQewsHjDpUBqYLINl5YPUUT3kz0bHXq9REpjzBL:OqewsHj2qKiWsUY0bHXq9REhN
TLSH
T18FF4AEF0F9B0E421C67B4AB24E6D9316E52EE55087B559C7E3FC7A4C3B642C1133A90A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.8MB
SHA256 fb36eae913df4a68b1a46fe73e2da4f44e1d5bc390312c74a0eedbc2460fa191
MD5 e559a0734517473cdb83b4e3fa5afc13
SHA1 d56d3304b9b8578c69438a1a1db1739c173bc059
SHA512 dcbc7f050fedf74f5c3598fa8d7ab0146108428f93409b7da511e5baf32086c5b6fe614ef5f861b2b69e6ce56e508da58115b457c9b92fe878d54ff69a734f9a
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyVIldPlbuJH:dUEtQevvqc2W1cpV2VI32
TLSH
T130474A91BBE843E2E3A6953485B282B6FBB17C0E1F35A33B1179F21E1E376905D15321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.5MB
SHA256 82a02b5e6c7b809ef22f47fc9a4a491813242154218fd730b1fc11a8692f759c
MD5 b32d5b33fd7e3fb78a693ac7ce6058db
SHA1 b1e3e745fcc0dc019ebe9f4920d34f3794abe67b
SHA512 6f9a6721e2e1677f2cdd69e6988f671b2da6efb787ac58649f653ec3ebefe0e406399818bae2f03fcb20eeec45ae969ca2a7e9bf8ad58693b133aa55a8bd32e0
SSDEEP 49152:MCbRquA/m2yL5zefFiV+XenmE3/zbuBKiun36WXCx:loqzVjnmeuBKiuq
TLSH
T1D6C56D1976AA81A4D1EEC378869286C7F3717A05FB319FEF4265460F1D33ED44A3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.6MB
SHA256 c3a41c0f6b9f9d87858230a370601c988ded1362028c5a7d369f64da1f9d728f
MD5 58586dfb5b57a6d0edf9cae76fc4a66e
SHA1 467303d018b62029d37a8c300170b1a7de3b24a7
SHA512 971f463820983cf6cd9ec06dc88b93f59d676c66f181e37974e8f57e8dcb992842fba22f6a4476b703d42f4e6a4db6059c9cd9b50dfdf500907a2a4bc28f6551
SSDEEP 49152:PB+taZ3usBWOBr4tEGx0bqx0z+n217aau1glNyS/nfqp:xu6Jmfxd2d7nS
TLSH
T1F7D57B13F19901E8D059DF78B74A9122E9E2BF093B20B6DF0A9372453A76AF45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flhjdidc.tmp

Path C:\Users\Admin\AppData\Local\aacjkqcr\flhjdidc.tmp
Size 639KB
SHA256 7b9e5a1461928318865981135b423f5ad6b36f530f23a05a7c65327cc385b2a4
MD5 7a672b637bc652a9e3fbbfb493a8287e
SHA1 b30b6d40f78934b0001403b8ee02ad53d9fe2af8
SHA512 84d608d2ea6b29c90af771587685c46307cd33a784bb8007d5894a81cc092598ccd4fbc7355ed0dcd86b924c883250d447119f9de696226cd61ed3db51121cb9
SSDEEP 12288:Gj32cnr9XGoq8UtOhVUAnX5L7iQw+l7Ekdp0Bj/ht5kYslZfslKGgxB:a2cnr9X3ZhKAn1+Qw+l75p0B/hzkYsl/
TLSH
T114D4BF20AC90D9F0C8E1A3F4955EF376656EAC65D38980C793D42F9E79507C8B63A20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Size 804KB
SHA256 03ad45da960f59c7a89c6354da796013a3cd608b6afe8823a4ee08b38eb7d4fd
MD5 d8952d0376ce103eab15eb4d641cf19a
SHA1 6008e133fa67cf67a60a8dcc01371498ca608aee
SHA512 a9bd6f1c1ea9367ef36a444a941ec96bb1bed8e3abb0cb39a3bcb85bb1be341545e7486faf3e812d417f54b1f58e9c0b5ab4a3d2af7cf0611b4aca482afea168
SSDEEP 24576:T6MW2KjJ4Td3kJnbsPhnzqm7QpUrKjjdhw/wBM1uY9:0nJ4Td3mbsPhnem7QyrSdhwr1
TLSH
T1F3059D5325908740CC65FE75B82F5261161EAC69C3C7C6DF96D8B3E829B0EC0732A97B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 500KB
SHA256 020f5e3dc44309385a7b8df963d2fa8297d04d3e3c2ab524e17b516dd7fc49c8
MD5 621910f58d6effc41b9b65b6c44d593a
SHA1 f918c4c19ffc1a9a9f6ea54e4449750e9180b8ab
SHA512 b029a0c942ce47789ef7793c096dcbafe528234fb6b28ff9315fcc6c6caa1fb3adca097393bcffa6ca8ddee4854dbbdd7256ad24487be424d9293081c68659d0
SSDEEP 12288:8bxA1U7KxqLuaUuuh0Pz8Jey8K6zim9eX7wx8uyJi:8bxA1UGNFdh0PzseFX+ECJi
TLSH
T182B4CFE8B2A43090F46B953588FE4F269373784453B497DF25D55A282FA2BF80E3F605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.0MB
SHA256 5bb8bd1a2a380aa6952046ccdd4958fc5ed7872996ca7351736e8d8158ee8bf6
MD5 7cc2d240bb3ef4dc3902b71ce5e7ba05
SHA1 5feefe8ec23ea380055022237c64b402eb065de4
SHA512 a8318c5c4e4a1daaa77cbb71e63758a8f0f732647c32ec17bbe1da0bec27f83d38bbe1bcd853362945b57aac8530be7331e158cf86be0749f39cddd00cfa0187
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrnM0VFb5GwMIjbxk7UDTci9svseJh1TdvYOnOF12a:hjRP0yHfVqzlAsrnN1KJZmAazMkoA
TLSH
T1D3355A3DE2A91CF8D896F23645160FB5AB7174291F60D6CB01A4C235AF06ADBDE34F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 500KB
SHA256 2fa61e497a4260b9e43d03aed165b248e8f56f109506e791f39c2c5d2285bca3
MD5 107aa624077a8dff627e70b0e6e65c4f
SHA1 d89afc39c5a60fa8e87f7f9775fc0bd8c49e0872
SHA512 8efb20c8a43b191ce862d9d55649caabaee9e0d1782181c3f982c2326a4ebaeea31c7aaf9919e634896303daabfbd07373c772e6b57731489f4be93005c1f23f
SSDEEP 12288:PlYJeXm5nkEUuEE13cx/F0H91scNMs8DR44S:PlYJeXm5jUuEqsJFSY4
TLSH
T194B4D01928A469D5C019C0B589D82714A367B3A87F9773EF56EE527DFA02ECC0D389C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
Size 654KB
SHA256 3dc8058288508caaefad1e258c110af6c38f0637367cf52a398cdbfaecebf8ef
MD5 947d4d58b79adef02090fade2a1a41dc
SHA1 f8d488abafc44dfc7887b4ed2646d6a473828443
SHA512 cec61c1ac91d260b240ec564a1af8c9daee7dbe6b8187d48d7e8e1bc9548512e9bcf008f04f72ff38fed29e6494e87f364df9426df01fcead5cd57f96bcdade6
SSDEEP 12288:71XLsswWkxy2lRq2czAgGGEcC1zUQ3VV9erhZl2ppORjY:BXYfDtczA/HcCBUQH9uhCppOZY
TLSH
T12EE4D02466FC55F4DC26C139C89AD505EA62781787ACEB8B03BF47452E633FC1A3EA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ose.exe

Path \??\c:\program files\common files\microsoft shared\source engine\ose.exe
Size 633KB
SHA256 1ac06d3e8edfddb84a5e399f3045989df05efc97eeb56dcc565b5278413ea9d5
MD5 399e2ead94423ee263a27441489606ce
SHA1 e06395a6d082bbbb03c8e6e602c6d1055e3c554c
SHA512 3b75e03bc14aa57f2ea6e4edfa27fa9c8e4d79e0e98da07b198a394a5f1fc68ab51699dd25429c6ac2ce94b8d6a22f0e5620b0936635592463a41a28f61f50b8
SSDEEP 12288:8mw5HEjsChNPBFgl0WDm+CdmvaXoYkJsWMwNyC4Pv4Fl1nAP:5wuyOWXvWoBMwIhAFgP
TLSH
T1FAD4AE22E2A05CE7D46663B989F78536E7B378511265962F1374C31A3F6331CBE2B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path \??\c:\program files\windows media player\wmpnetwk.exe
Size 1.3MB
SHA256 73ae553707b53cece6db8c3f786a3317e634a69c6ebec128d496c6ee3d9a83f2
MD5 a332ae1ff7c0ed3f00d2234b5284e241
SHA1 00f3605b99982fd4ef5c25b5c71f13b76069caab
SHA512 38992b1e6660259cf37ecaacb642ede9a99f116ed08ab00ca6405fa1029709068e8bb1b8485e793645b06e4242dc649cb0ac2a98c0cf02b73a6afc69a2ccbb15
SSDEEP 24576:tCUrpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA9syjAPZ8bOafgH57:tCUVPTY+8Wg2lIL8lrIUJLWwgkKbOiQ5
TLSH
T15E557C1DB2DC0896D07B813589558A16EA3238EEDB2187CF2160C33F2F66AF95F35B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agentservice.exe

Path \??\c:\windows\system32\Agentservice.exe
Size 1.5MB
SHA256 de20d627762e1250bf67da569abb47fd48b746ec16a351ca3be0983b8bbf3cf6
MD5 fb3a13d1450483b26d6670fbedcdd716
SHA1 1aebaa0e2c17d6d58b59cb3c0daff1f2c0a6594e
SHA512 405f2a963d809e1bf929fe35bdbfa4a3bd9d64d56751c5d19792c75e12add58e6ecef65c75820a57f3bc4df543b81aa6899dc93f9cdfe5560ad7068d3bc756d6
SSDEEP 24576:l8RMyNoSFw1d+rC4vrmRcGPiQEaFPnMRTCyb9/vAYyJ+UX8vOx:6RZwQCyiHiQEaFPnMI
TLSH
T1AE757E1D52FC46B5E0BAD278C9764407E6B27B16473392CF029182FD1E27EE45B3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Appvclient.exe

Path \??\c:\windows\system32\Appvclient.exe
Size 1.1MB
SHA256 728a83054e6e81a2009ed2c6077594d23c852767dc502a42334679fae351b3ed
MD5 554be637042648409987db2374652f6e
SHA1 8f9e45ca044bfc85b2dad9f860b8ec7dc8f502aa
SHA512 b7717817e4c8358f322e668b57242546f41b04efc9a5fdf759f9e0625f7dffe0da61153755b6e208c5c26f1faf653b67c03a9a7b9e763aa63797cb0fc9b46ab0
SSDEEP 24576:TSAwJPE1IDAo+4Kt+l4413aUQhsKWGeI/8s7DA:TqPCIo4Kol4QQheI/8sf
TLSH
T152457C19A6B95DE0D1BAC6B58A73CE11FE723423D33163CB5290853A1E169F85E36F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path \??\c:\windows\system32\locator.exe
Size 420KB
SHA256 344058c459ca4bb7a322e62c7c25d729f8172e890dee432df288728c01339522
MD5 22d22332e0226800e00d289ebed8a4c8
SHA1 51b3be264aa9448f97b8879887c4157a3db2c62e
SHA512 3b1f2cbd8550d80bf394f5109302fe9c49c42b0f5f0b08ddc45b683c1caf36f684bd01887ab98a615f559387a5e200ab60c345dad3e105e1e0a0406edb820ae4
SSDEEP 12288:z5FQxBF8M9IUVUG3j3x9AbwdUD1POcqxEMg:zk2IgqmR
TLSH
T1B994C07A0470EF25C84C96F8C42F5AC879471D26C2CDC8EA62DA65D4234B2EDBF65C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path \??\c:\windows\system32\msdtc.exe
Size 556KB
SHA256 8bb805f39a6f3038003206d621887a7cf6076a9e51efef40d0a16a3304528c4b
MD5 21deed891b6e7e84b904bc221f252b86
SHA1 1e6b91cf67a504f1bb205364cbf498b791691774
SHA512 5e19ed4404dabc7ab89c364ae6eee3c7ef9f1fefc2dcf642ade0d8412f60ecca963eaee84ecda25ba88419f5d8b724be30479c1f805341f2dc91737cd12025f1
SSDEEP 12288:jku6ky2TvMdY/qZp8VQY94UOjeqYRdzXS:j5tyIbiQVQ+1OjNYR1
TLSH
T1ABC4E13054819940E4A5F5F589A9DA96A66E78AD03C586EF42E3F2FC37387C8C4DCB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path \??\c:\windows\system32\msiexec.exe
Size 568KB
SHA256 9002d89fe471e20cad3447ba0d2917775a28dd93e5d5b412685755f9524364c1
MD5 d430e906ea41a45d0886b022c6afb53e
SHA1 000b8530aa9af1e83ddfd0d617b48a125ae29556
SHA512 af76019070ebe6e872cc74a96b879a848f11f3421e0d3973ff9834ef4a5fb8ef88baf0c116214ae4693abe34c5053fe4a8380c9c98da945f1252bb727cf90c85
SSDEEP 12288:K9lyvj3IkxjbBz/jcpIx7sGnY5lvqTk/ymyWg2BWsU33KxY4:KWv8qjp/WT5Jq4/1nBWsU33GY4
TLSH
T1C8C4E035D2F1BCA0FC1483F0902EE5999196B82A5783D1BF93E5D73A2A74F806435ACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path \??\c:\windows\system32\openssh\ssh-agent.exe
Size 768KB
SHA256 0efc21c57dd2bde6e3570080ce97b77ad0fac080839c9672848360f5c4931378
MD5 9e07e782e78db472acba99fdcd7f4162
SHA1 6183724d4ac7675c8d3a4cb02d005451d51053eb
SHA512 64a1f8f0072f53c2586b148b96664b0373b3a0941dbb9252128050b24d6110582c66ab32ef68fd9e7084dfab19fb1cc95cb7dabdcd2c181173573cf753c927a1
SSDEEP 12288:FOb8A4LWO+vAYFT/CgoN6soG4IBeKQ5GqbszTWdCa3KMHtGeiRy:C8LBUT/TE3oG4IgKQ5GViCa3X
TLSH
T120F4CF49D6AF44E1C86AC33885B64D12E673B80D43A4FBDF43E943952E4379C8E79A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perceptionsimulationservice.exe

Path \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe
Size 624KB
SHA256 5ae57d505361ae4fbcc450bae99a506f0943e9bfb047b344cc43a7f15221b22f
MD5 bb7d31d8bc218d1faece528be716e577
SHA1 a20f020c03e55bbf18cc66930c1807e66d881135
SHA512 ae91674914721afd9677f0ed66493b17f9cadaee218a5e8bcddda913edd247e0cdb5d7b01fb0a6503df9c552f426f1bc873ea2ce97c440838254a4ea0abd5196
SSDEEP 12288:f70VmtIYNvUyBp30ul6e5GpYQm/wqihpAJiRNiztBCfC0lyfW:IxYNHFk0v8AkRYm5t
TLSH
T1C4D4AE1962984C94C437A279BD86C109E6F3B89E535F96DF02E782381E17EDB683DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

searchindexer.exe

Path \??\c:\windows\system32\searchindexer.exe
Size 1.3MB
SHA256 8c496e3a64e98e0f86ccbc58d5d8aa9eb77bdbb03c637d914477a36b079ac54f
MD5 a3f5f9e1da8e259e44cdda41ad40e518
SHA1 634443283079d6844944f7d6c9c85b51518b8961
SHA512 28d52e31c25a777147c0c9b3a8ac115a23ba9108b91ad073215cc95cc76e8c28ec50b8e08d8669f9f68f8acfdb666d1556f11b2ffb449c8e0e4ef3f3255ca33e
SSDEEP 24576:4nXoJjNYH84VVSNAApoEOO66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKO:4nXoJJYH84VVS6AmE3Jas+cHBjSSKHP4
TLSH
T1D7558CDEA2BC0498D6FAC178C5824517F6B1F8655321C6CBC22082BA7F13EE56E35B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sensordataservice.exe

Path \??\c:\windows\system32\sensordataservice.exe
Size 1.5MB
SHA256 b6c766bdd467d34b7e2f771a6404a926841489a6539f4dd9e25922cb76115ab6
MD5 79832b3032dd8d302a24469fe9c99e3b
SHA1 bf0f6bd941edb42897689036c86a1de143183b0c
SHA512 11d7a8b11f367170882456d412f2bd15b10c6524a80fb93b7f94f5c5bcb6d074ac27207ac7036e575a46dd4c74e48ce12c783e5ef7649ebc472a81ac8f450017
SSDEEP 24576:uv7Xbxd9Tuycf8M/TYlSuxur2PCAwRBP55q4io:uDLL9TuJ0M/TYw2PCBPjX
TLSH
T150756C1AA2E84DD4E3BFD6BD85769046FAB2BB55173081CF3250856E3F23BE05839B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgrmbroker.exe

Path \??\c:\windows\system32\sgrmbroker.exe
Size 780KB
SHA256 f3c9c50114d60b9e51a5f3b9bd1d3b0178578c108a676bf760c90bbbedd97aac
MD5 6773558bbcf8e806c8f6dfc64b35813e
SHA1 49ab1bcbc41e8c28efe41675498e7bd2ada0f339
SHA512 2845b5ec8fb4b3d1f7bc18b3d81aac74c263b5f0478882394eead2d972fb0e361d2b55e5bf7bade4fd4085085fd9a6433f17b6cfb101e71976efbae8145d9dff
SSDEEP 24576:4yLXPLcQ94tkCHKXzKVWuPku07Xev4VhAFgP:4y7Po3tkU+zKVWKkn7XFVhA6P
TLSH
T18305AE39E55808E0C57EC27CF5E24D46F67238A8032169DB05A891792F5FFE46AFAF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path \??\c:\windows\system32\snmptrap.exe
Size 428KB
SHA256 a2939fd03e6dba278609594f28c2ea611957d3965f7f396caa8fde626283dd77
MD5 89ffdb1519e4b20e94c9bd200f76733a
SHA1 1bddc07a54f39a54371218c15f9f2c81b77f1946
SHA512 acd27a8f84946ee1e02507b79909aeb94a74ffb8eedd68752558dfc0a781dd76dd4141c77d54104c54f5d8c93af4610556f25aca2f33d07fb2de0327093a3854
SSDEEP 12288:vPDdiDFKRU/XET3I/abIUT+OuZzLA17dspLc8tRW:nDdiDFKRU/XET3Iy0UT+Ou+17epw8
TLSH
T10D94E1D4B4E4CBA2C840D13F197DAB3ABA5DA11503DE81DFCBE426306642D39EB6D934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spectrum.exe

Path \??\c:\windows\system32\spectrum.exe
Size 1.1MB
SHA256 e15a86e826405f504b51027c84a70785bb58a2859e52549ef01c8e284b732c72
MD5 73365d808dfe44a8840cf125766a859b
SHA1 5fd6dec5ad55d238b7c8fd3db7a97463be8801f3
SHA512 e0d416c3e7c55954dcba6c17f34fed567edf76296032abe203aa86763aebadd32287799cef230a2f56202259d5acb8cd11959f125b2966fa832f92d4e99444d3
SSDEEP 24576:negJgpwJOmPOHWAKS8ZguIGyPsxr5Vin10wDxVT9vAeYF0:nngOJOmPOHZXTBYF0
TLSH
T135357C2EA7AB1DD0D07BF179B956C516F671382203255DCB0193427A1F1BAE72E3AB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tieringengineservice.exe

Path \??\c:\windows\system32\tieringengineservice.exe
Size 728KB
SHA256 5a5af187f14403ca741a66bf9267fc1225e60b3a6bf774c7f6f0738854393999
MD5 9333bc16c2f8db109703c56e9f7181b2
SHA1 41000721c8a1d97c1e8cba184cc8d53aac3553b1
SHA512 0e0790abc9aa6f23d8e8e7af2b90fdc952dba06ab3a931a081e9716f242dbd546fcffec54d8d6020e7f012987da10f9ac0f6fc2bbe9678c865379be7199664df
SSDEEP 12288:HRNTJnJiTk3IUO7aU+wahW4JKqOblcKQm7oLEmAcXlP5QmCAgDJxrtWUBiCd:HLJnJiTk3R3waE4JrObBGCAcJxrJ
TLSH
T152F48D2CC1A41CE8C0B6827441DAD696BF72382C3716A9FBD9A4D13D3F01ED15A79B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path \??\c:\windows\system32\vds.exe
Size 1.1MB
SHA256 e2b0ceacbabca507f9a5f2afa27402cb41990a6b02f5fac8cb5c6df88858a595
MD5 e659ca8c9f5df47d7faa3bd80be6b623
SHA1 8fa8eaa1ca7da03c95b21de2377f2fde33cde315
SHA512 07c00d87cd52e2f7b12a1151e605e17d3e1ac67cdd26c1981a28f3dc8778088903222f8af5736d80315081b37dd883fde6985b97a1bff79ad660094b6718a22e
SSDEEP 24576:4C+TyQIu93VAumZr7jm0zcvLV7ejsVvYWRF:4/TfIq+Y0QvLV77
TLSH
T1E935491DA7EB19C6E176CE7588A31492EDF3B471136186CF2144C1790A4AEECAAF4F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path \??\c:\windows\system32\vssvc.exe
Size 1.8MB
SHA256 992ccbf1dcd44c15ab7a3153ab099a8fb0fb476ba8d57134b94bbf237171ba6b
MD5 6f1a82cc8a84baf5cbc0ca725a6d5d70
SHA1 496bd5e7648f540ad8a3c53c14e8c7df61f2fe1e
SHA512 29e16e6df3a49800c867d5904b3c4d8197a119d66ebb90ed2cef50fc6b5c0287fa9475918f91976accac7231d8e0384ea283089fc93fb34558af2ae3f8e83f03
SSDEEP 24576:YA9SqCceDQncA/BmlvLto8cFVr9og9P/Z6pMY6CoZRHH:39SqCzDScAZmlvTcFg8Ph6+YxgVH
TLSH
T1A0853A05A7EAD187E8B2C6F1C9229415DA323C739734B6DF0A8CF96A1F32AD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmiApsrv.exe

Path \??\c:\windows\system32\wbem\wmiApsrv.exe
Size 592KB
SHA256 68137b6f2f447d09dc9fecf081ff8a8428972e8b6703954ff1ef20d99eb96980
MD5 dbc6baf36897b7007432631d5c5d53fb
SHA1 7961392b236717f9fc261bad22bbf48d14ecd1ae
SHA512 8b03ea0f32fe3d003bad74d96182c8e892eaf7c4105ac75f1801c9d45f32861285a11f07817419807e44d032551229fe104cea05c59deee10a741eec06600e2a
SSDEEP 12288:rcyrWOstaa3kcsGMzKGnkNdKTLSAvbULCxdWAttYHXTYet:aLQikZGD8LgLCxd9i1t
TLSH
T1E5D4BFDBB2A94450C362C2388B8E4105F773702557F0F6DB32919738CF97AE6ADB4A45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path \??\c:\windows\system32\wbengine.exe
Size 1.9MB
SHA256 7dbef76f2f34b8d1e656f8d3e30c1f717a6da7586b1a3d32c908546ce3fce76b
MD5 ba2643b44de8b10467250d28c86dc04e
SHA1 4ddce6c84c10a0529c782eba185a46ee6435c00b
SHA512 3710558eb12ed635552e4969b1adb11ae0ed1ac7b3e1c3e8146dbc8789fd5547b1cef0dc02e31abe907fb472bbace526483bdf4760a7702042a2cf5a245e19c1
SSDEEP 49152:0pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPkHY:1pC7b4+80GTkb
TLSH
T1EE9539EDAEA8307CC85AC27585461665EA713C3E3F2057DB03E0C578BB1AEE19638F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path \??\c:\windows\syswow64\perfhost.exe
Size 412KB
SHA256 d33bbee23749a90515de78921c9db914df6bf7d774bb17ecdbb6b44d4516f499
MD5 9c1115e54d8082c3a65b1f3be3c4113c
SHA1 8049a379b48fcf772b697114401f7142ad641b1d
SHA512 a187db910dd93f06b7246ef3d481f104e4bff1eb041c600fbe3d3290cf9942fd7aad5407b38258de6e33a09e337f6cc58296a2795b060667ff496cbbba8d1b7e
SSDEEP 6144:vDc2Js1pmiwR/aLp8DmOhh+lj53pq9Rggc86F0qgdwqogM5q4c0kzkqms:vDct10RiLp8DxkovK86FekqaV
TLSH
T1DE94BF2360A0D941CB64D37185ED6E773F5E909993C9C97A73A81F183B49AF853CB80D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-0-0x0000000000F4E000-0x0000000000F7F000-memory.dmp

Download

memory/2096-5-0x0000000000EC0000-0x0000000000F7F000-memory.dmp

Download

memory/2096-4-0x0000000000EC0000-0x0000000000F7F000-memory.dmp

Download

memory/2096-2-0x0000000000F4E000-0x0000000000F7F000-memory.dmp

Download

memory/2096-1-0x0000000000EC0000-0x0000000000F7F000-memory.dmp

Download

memory/4324-50-0x00007FF6B0C10000-0x00007FF6B0CE2000-memory.dmp

Download