Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 745KB
- Sample260708-ets9qaaw5z
- SHA256 cb28e53a4be86412affcfaee6f871d8194e828764dfb08702da26ea36ac1d3cf
- MD5 c18d005cbd853799e588272101bc1bc1
- SHA1 ac022d146d2b43ed2c92ae9a14a00ebdd94cde4f
- SHA512 2cc5c72bf9c466e65b6ed451c5325ee993a380542d7662812119de7db7d7aabf47806740de56e328a419c9793858e2aa0e06b67d102165e02bd4bfbbfbe31659
- SSDEEP 12288:390G6vmzOASubviBNDYa3Mu/a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrV:3aGGSWBZx/XKEFG1rDHmj7dip
- TLSH T14AF4120272C080B7C673193466719A71547EFA701F654AEF73D42B2A5FB46E30E29B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5456 alg.exe 4472 GameInputSvc.exe 2100 GameInputSvc.exe 4460 elevation_service.exe 2464 elevation_service.exe 1340 maintenanceservice.exe 424 msdtc.exe 3976 OSE.EXE 3200 PerceptionSimulationService.exe 5612 perfhost.exe 5512 ReFsDedupSvc.exe 360 locator.exe 1896 SensorDataService.exe 3268 snmptrap.exe 2832 ssh-agent.exe 4684 TieringEngineService.exe 3440 AgentService.exe 4688 vds.exe 1264 vssvc.exe 1844 wbengine.exe 5980 WmiApSrv.exe 3416 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4e2bc4522468fd14.bin alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaw.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\java.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008ec0959900edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abf5a257900edd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065bbd657900edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072d49f56900edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bbdc557900edd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f80cdd58900edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2100 GameInputSvc.exe 2100 GameInputSvc.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeTcbPrivilege 4472 GameInputSvc.exe Token: SeBackupPrivilege 5512 ReFsDedupSvc.exe Token: SeRestorePrivilege 5512 ReFsDedupSvc.exe Token: SeBackupPrivilege 5512 ReFsDedupSvc.exe Token: SeRestorePrivilege 5512 ReFsDedupSvc.exe Token: SeBackupPrivilege 5512 ReFsDedupSvc.exe Token: SeRestorePrivilege 5512 ReFsDedupSvc.exe Token: SeBackupPrivilege 5512 ReFsDedupSvc.exe Token: SeRestorePrivilege 5512 ReFsDedupSvc.exe Token: SeBackupPrivilege 5512 ReFsDedupSvc.exe Token: SeRestorePrivilege 5512 ReFsDedupSvc.exe Token: SeRestorePrivilege 4684 TieringEngineService.exe Token: SeManageVolumePrivilege 4684 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3440 AgentService.exe Token: SeBackupPrivilege 1264 vssvc.exe Token: SeRestorePrivilege 1264 vssvc.exe Token: SeAuditPrivilege 1264 vssvc.exe Token: SeBackupPrivilege 1844 wbengine.exe Token: SeRestorePrivilege 1844 wbengine.exe Token: SeSecurityPrivilege 1844 wbengine.exe Token: 33 3416 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3416 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3416 SearchIndexer.exe Token: SeDebugPrivilege 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1380 2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4472 wrote to memory of 2100 4472 GameInputSvc.exe 89 PID 3416 wrote to memory of 2120 3416 SearchIndexer.exe 110 PID 3416 wrote to memory of 3568 3416 SearchIndexer.exe 112 PID 3416 wrote to memory of 2088 3416 SearchIndexer.exe 113 PID 3416 wrote to memory of 1680 3416 SearchIndexer.exe 114 PID 3416 wrote to memory of 4032 3416 SearchIndexer.exe 117 PID 3416 wrote to memory of 5712 3416 SearchIndexer.exe 118 PID 3416 wrote to memory of 2604 3416 SearchIndexer.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_c18d005cbd853799e588272101bc1bc1_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5456
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2100
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4460
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2464
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1340
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:424
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3976
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3200
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5612
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5512
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:360
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1896
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3268
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2832
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4688
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5980
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2120
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3568
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2876 2872 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2088
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2612 2608 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1680
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4032
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2612 2608 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5712
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2876 2872 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2604
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8f0aa988a74c61b805918a345be896dc59129ce9a94dc21901cb1f8e52c58777
- MD5 df569cd60583591461f32c8545191956
- SHA1 27514a05ba638a4b429afedd0abb9ad5d500a06d
- SHA512 b701fc200b26a8b04735d68d0d4f890865f9466005196ba3b1d9b208bf620a6a227d2bdc1f0c8f06a8e54c27b6e82a5a6b506bfb2a7bbcba28d48724b839db78
- SSDEEP 49152:94O632BuPkFKRrdE6oh7stBhuXjfS4LWxnJXKEFuDHchip:c3q6gjBoXKEFuD84
- TLSH T1FDD59C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 b74245d01be1785b16c0501dc330d24b56d2c4db3ec9e2e80ed725eac22cfc23
- MD5 c29b70faac310d7f5ce73bdf14c63e5b
- SHA1 ef3aaffe5b81a11cae64f17771bceecdb8c3354c
- SHA512 234fecd095101cb210f7f684621ddaec193cdca108600dd68ae663721d0fe284aa8eccb37382cb9481130e5d348d766bc7ade7f2fc7f213431491204c5a4fbe4
- SSDEEP 12288:v1XLsyMWZxZV9a+2czA1a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:NXYJW0czA1XKEFG1rDHmj7dip
- TLSH T1E2050129B3D009FDDD2B827CD9628912E673B89147A0E79F03E499251F237980E3EF55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 bbcfd8c7bf1d582c0c23d4c104ec0cc2de229c3cf40b826e9ba6473274a28052
- MD5 97667ff13a4f696c17bd33fd86d791cc
- SHA1 3ab918b100748186acaf779be745089b2da63199
- SHA512 006c734fcc9526dfdaa1bbbf53adf3714c697a06f7b6a68eb0a4d2bb5f933112120585e09966dfd976897d67a874684b3984824824865358c50196bbba4aaaeb
- SSDEEP 12288:qwsNYVQe/U1L0E9QVQiwxpGZIVuhrHs2a8lKYK2krUyEGGgp9IobHGqR+pf3jJwf:e0Qec1L0EXxOrM2XKEFG1rDHmj7dip
- TLSH T15435AE16F6748335D073C0B9C5D2A69AE97230825B308ACB4285D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 2d1901a2c688b1cc9c07a9e66f6419774ebf8cd4584ee3632b2f5a368dc54341
- MD5 ab7ca91d7a6db2390a7e65995b0f7ea8
- SHA1 09f1f93c3688af453511dc8658b8268baa270954
- SHA512 235b29802a44a0ef4059b7a490f2b686f29ea994d140fe465a33cc9624a0d4c5490e94792271a521802a8dbe9e7afba1bc8ee01841b8edd04565d2c9c37abadd
- SSDEEP 24576:wAacezSC6vUyD/aqgrvW/6q8wyumXKEFG1rDHmj7dip:wcezSC6vUzPvuHjyLXKEFuDHchip
- TLSH T19D756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 e97138099e1f5433458f275ca94385b7a46ca9da6d653e6dd641cb4352d7be64
- MD5 330ff79dc92565224b5914bdf433756c
- SHA1 bd42380b0166127b23a7e8ddc33e8ddb4d058a6c
- SHA512 dd5f8ee8bceefd2bdc51a03bfc5792c9af4f898d3a8b59cc6441195522300da6ad22d815f57215ee9c417766b09eb315b7a4d046af5d8dbb90d997a08566e7e4
- SSDEEP 12288:haJjBP33vTni7B+l1D0RKsMBYWrlx4jf0Im98+a8lKYK2krUyEGGgp9IobHGqR+M:habPPTi7IXrl+d+XKEFG1rDHmj7dip
- TLSH T1A9559E66F5748335D073C0BAC5D3AA9AEE3230415B318ACB1246D76C2E677E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 599KB
- SHA256 fb4129d918573c7b524a3831cc990bad8f36636e546ca1324d3586e157d5aaca
- MD5 7cf4ec1ca77d34e372ff80498e084477
- SHA1 c71f4696beece5b5b060e13df95a815a1bf60e29
- SHA512 a0b96fd87af1a0bb0802931fe7b7b37a062b2882bfc804e3e09db95fe694a8a20c29a7b23c859e6ff6bd41bef0fb95fceea56b42d1b206584f1570421557ba48
- SSDEEP 12288:Q9Ga8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:Q9GXKEFG1rDHmj7dip
- TLSH T127D42303874043FEC31D2EB9721B6DA590B6D7E04D451AB865E43A559BA89330BCFF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 859KB
- SHA256 908a1b7f9fb8a2090b7f23417644ea0479ccc26d3f656821d3f6808f49e1c3c8
- MD5 adc180343e7c91bdf1131315c90a421b
- SHA1 798476bbed71f3814bc891cb6b0ad007bc03f695
- SHA512 301c90855761dcd39145b7f8e4b420a8f5f52de8725b8769f574da1d2b3aecf82bd529e03214cd63de33892be003fdcc9890363dce2ee564da76b8750ee27994
- SSDEEP 12288:YeBNUbTVO86Uba8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:YJIUbXKEFG1rDHmj7dip
- TLSH T1C115CF2BEE28FCE2C27E5DB967518640D7B274704F52A3CBD164820EDE135E10E7AD29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 2.6MB
- SHA256 b1a12fda24cf074ce8b7d37b36622071b15b1c94909e090587e8ddc33f734f50
- MD5 2d1b20a216c0fff7897d491454ef854e
- SHA1 97504b07a7088cf113d09c61d5fe008c859306d9
- SHA512 03e1d57dc5a4fb16efd46fb7e98473b0c50d24da2bc7b42be2b2bbb5c6f1678bf5a92e4c2df132427be7494aac04040cee7d417ade0b9266935189a11c1524cd
- SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5v:DQvGAdlCEL8c/NRNF
- TLSH T1DCC56C9657B840F9E56FE098CA6BD973F7B138460130778B07A1CB672F77A602A2D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 928KB
- SHA256 1708be9389c54ec72cd4993d642ceaf23108577846e273eea144f157fdcf82f2
- MD5 aa081e5b2edcd75e7d3d71329a560f42
- SHA1 e1ef2d372bdf4e2132412a1b9b45d695f2c4f457
- SHA512 fc0748b8d61a5a4cc226825377333d85ca3f7f00b38d752d41dd0ee500b27e258251024c060fe9cf8af0f489390188a45c522a3bd405c11ae904c5635ec845d2
- SSDEEP 12288:gGwSfxL/2Dc3bDLLmt0LDQewsAjxa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVw:vmewsAjxXKEFG1rDHmj7dip
- TLSH T15315E031FA70E036C37B0DB62B26C716147DBA604F511AC3E3E85E9D5A602D2177AE1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 2.1MB
- SHA256 c910fd4d3b1873678d91d0450200541bd5bacf391e8fe98d460b2002bdbae22e
- MD5 0d0218250b2474ac88e0377ba751b2d4
- SHA1 90ec2c1e61f9d90e03edb69f90f78a9cf4e35e0f
- SHA512 da8c9308b9bedbd6a9dad9f74f99ae2ac1c7c6567c04754cd4b63786a478299fc007fa2229c27a5aa5e9a471c6f8c181970c3309f521033d5816f4b7c8fd118b
- SSDEEP 49152:yYVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6B:pVJ3MQ
- TLSH T1E3A56C965BB801FAC57BE188C79A8537FBF0780505346B9B87B1C75B2F3BA60592E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 69821544d864d21179eb4889036c4061e0e5818ae274f3a1f39d615a7d59e900
- MD5 6ee92c43f85947c87238532565528390
- SHA1 7e48ee1284228d99561e023a2d5af2a3c50f3037
- SHA512 cf3ea49b19ecb97f51893f43b289bf6f200984cb9f0d772e7147da331256b5f919f089eb35054f88df5b63af216f29f3a0b8d347c1129624027bbbf7f952f9bd
- SSDEEP 49152:BobRquA/m2yL5zMfFiV+XenmE3/z+EXKEFuDHchip:Yoq1VjnmyXKEFuD84
- TLSH T177D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 acad5d66e45ec41aed0e2b822146204fd9fca64abc873714fa4cab3cf2656453
- MD5 72c18dc144718aa594a0d06a8b8c31fa
- SHA1 9fe0e4b58d2df493f7b67c163ebe887695798ff0
- SHA512 c64f6bc178b78df8acab14699f3255df15a4290d39201375a39319b5057a2bf48db8b9ddcdd1c4140eebbb6e0f7a9444a2ef56ac71740292e6e3816dd993688a
- SSDEEP 24576:BAhGLveFoiwtA5l7S53SXKEFG1rDHmj7dip:BAM6Foiq5iXKEFuDHchip
- TLSH T16745AE81E7F945D4F5B3AAB8A9769570EA76BCA65E31C20F2160D10F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 825KB
- SHA256 ca2a86e2a9fac858908c7b39c3e505d4af3acd5b93d83dcc5ea169f05a3c5b0c
- MD5 354d76fc8444ae609c4ee849d1cf020e
- SHA1 ca3998931d5a45191393b4438e8abb4efe62481f
- SHA512 31e1d83baa5444f3f99ddff62f891dff6241dd3baf56413b18847f1ef5dc6b7e6e5a2bef20d1927ecf932d02c8ec718079f713c02f71ee9bcb253ae9442cec74
- SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CAqa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrV:Owu+OW9qXKEFG1rDHmj7dip
- TLSH T1ED05F14677940CFDE56756388257C536F7F2B8112A21DB2F13A0C65B5F273226E2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 675KB
- SHA256 cc6f4ab82d0ee72e98beb823b93fe2ea5b48af261075dbfdc7bc8f8eabea01e6
- MD5 48e786891e6dee06b0b13ee60912679b
- SHA1 557fb3715bad49342cb0bee96d9670e78c2e328b
- SHA512 3be4add04a47b1496eb11c37702b117e2263265706f62519d4042016461706d0e9d22b6bbf1908a0451b5c754f00efe62ffe6a6821e14e1f83d9f7f0d384e032
- SSDEEP 12288:Spf1Igza8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:UfuqXKEFG1rDHmj7dip
- TLSH T1B2E4120723D021FEC267167CE6A65A45D3B2B0A21B7603DF12A416555F62EE30F3EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.1MB
- SHA256 d5489fe2a11357b4aacc5eacb8b6d8c25707ec1dc0817e7d5dbc622ffe8e0a3e
- MD5 b002df7dce3917035c2c6d2e36438d1f
- SHA1 2e3bbbcbb4a7082a72796a13d0aaa46d487b6179
- SHA512 4d6d52a22177ed861fab0d3b1b74bddd343d9244cc4e802cc56e4cf4e3bb4b7a0a65df2033a6096c0ad593d569c412b2e1cdcb8dcc2a693a5ce9b9ec892866f0
- SSDEEP 12288:tuIShFnDelt5fhWVRZjvKeZAiCa4v7ZllQzUxKd:Sj8eZAA4v7JeJ
- TLSH T1C43595EA933252795C1FCCA09A3C68A2442C309F5175D3FE18FD49B60672ACE6B1DF25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 960KB
- SHA256 62933f73b004fc719ef5deb7b9879d768450e80e9fe18b1504d27373691aee33
- MD5 5c108ae33f8047e7f474e8678d9a8152
- SHA1 acb1874f2ab30d009b5e69d10469fe114593e2b8
- SHA512 07afb4a8fab91c130a3e1df8902098dd42c69734f23eb261a04c00747e2501b14edcebc78b5329ec36fe0072f947566dfa95fa89fb52a32648a151b0470e9082
- SSDEEP 12288:tuIShFnDelt5fhWVRZjvKeZAiCa4v7ZllQ9:Sj8eZAA4v7JS
- TLSH T1212572E9933222791C1FDCA19A3C68A2442C30DF9175C3FD18FD49B64672ACE6B19F25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 1.3MB
- SHA256 e93e92ce1befb6d717f4d59d52406a4f90e19238097f71d1ab59564d5f0614ff
- MD5 f28384260d00ad8519a174f466500776
- SHA1 e017ea90e402df25506635d7cd62623eeb13b754
- SHA512 508ece1ffc651a1e0f3110ec6438fae98917525edecf2c9b351cfce50a232664d67b049dde40c0bc45ac3d9b5dad8e0e4a3185012ff6117876aa6fd8ae1530a7
- SSDEEP 24576:Owv1qf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohLw:g68Qg55nhMeWu7PNU3/s
- TLSH T1F2559E13F2D901E8E06DD178875A9632EA72B8060B35BAEF0A9087521F77FE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.2MB
- SHA256 b9bac76408483e6695d15da498444f62d73b0e51cca2565a37242d1ebc8dd126
- MD5 fe792a22a33809d9f5c13657bca61488
- SHA1 2dff2527c86cd332d102c760d08e0c97e35fa388
- SHA512 1f44605ba45b6fc5829b4ff4f1deb62a52dacf28d71bbf2f5cd674955e20a48c59999d1aa1430b23886e556a695c35e1ff3508d9be8f7059fd2d17894891b8b7
- SSDEEP 24576:LvKQvT3aa6sp0pEnRdh75x0JcB12MksvcwWCXxTTYyJG:/3aPC0pEnRdp5x0JcB12Mnc0YyY
- TLSH T1AC456A13F2D910E8D05DD179978BA232FDB2B8494B25B6DF0A5087622F6BEE4673C710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9255c5d45c8f05cb13f632b3ccd7c4ff4115460952a9b2bb229f3f0a31bd7c58
- MD5 73bac682f5044967f23a6dab6e2c9cfd
- SHA1 654956969e8ce496d2c62a79c6f1651d7582247f
- SHA512 aec45d6c33b1540ab7b4db42a4618d355c3e860dd9298e6dc4c4890827bc867054bc81499f6c09c3456b113128346011ffb05321e8a0349af9607b822b6cb7f7
- SSDEEP 49152:My+taZ3usBWOBr4tEGp0bqx0z+n217aau1glIXKEFuDHchip:Vu6JmTxd2dIXKEFuD84
- TLSH T165D59D13F2D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 896KB
- SHA256 dc932f065e36aa43a80cd1cf72b6ceb1171a438b6483cb62d6939db133bc67c3
- MD5 6686c98ce80dd10cd29fb4f82c97ca5c
- SHA1 a67bb608b98d52a3c752bab76bd64b2d2dedce5c
- SHA512 3261c62fa617dbf0165dcc2d5be956dca9a1ba0bcd06291036e7d83f54549f1fb5f6d7d930862764461e39ba0d201fac5a8bf1fa24b3bf91d3303ba9d7aecd31
- SSDEEP 12288:X3InhvbNEwE1hcnegus0+t2TJyd2z615uCMGLOjB1AodZi9FT98Pg/66m0O:UhvRE1hps0+ogd2z615uCMVF1Agz6LO
- TLSH T1E5158C13F1D900E8D09DD0B9979AA232F962B85A0B3576DF0A9097522F7BFE0673D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 768KB
- SHA256 27bfe9c357cf8f7d1cfa50ee1e4ae3c0babda3a56ebe8bfb36442c23a5e0230d
- MD5 15548f6524322cc748e009343c1cc538
- SHA1 877bcda9041d62a22df1c36763f6c36f7d841d27
- SHA512 339480470814abe6b36409521438fd95cda2ba1b818e261c715b7c3be3d2719b9e70202ab57315cf15b934bb037ef625d08f104e041bcd01122a6035ac4fd6fc
- SSDEEP 12288:JQxjbBvlAVhI7fumpWK5RwflXZFAfPSPa/c0kB0B7jHWIbF:WHBvWw7fuwWQsBZFAfPSPa/0BeHWK
- TLSH T193F48C13F1D900E8D09DD4B9978AA233F9A2B8590B35B6DF0A9087522F77EE4673D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 704KB
- SHA256 5a12cb53e50e77b7e2a4f6fdb32918ac4c46ab79c6d32bc71b53f8cb2eae9493
- MD5 c12aa1508596fe8cb93978a75af84e4b
- SHA1 78e649f32b8a88fb7eb3fea5f0baf2fa7feadea7
- SHA512 03948d3dbf580b63cef12a79af8b5263f7b409ac1af82b2ad6213a26657ff9b610bbb39430e11ca94ee7c1ca7c45a65802eb317702ac12670b7b3aa39f3eca91
- SSDEEP 12288:wiTgMavZsix/PSLSS84fQsuRn+FgyUgi1gUXfy3HO4WO6DfR:vgMavNPSLT8EARn+FgyUgd0fJJ
- TLSH T121E48C13F1D900E8D05DE0B9979AA232F962B85A0B35B6DF0A9087521F7BEE4673D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 576KB
- SHA256 f2648c5009da9c63d7d9b9800e065361dee3792431bc1d8bd8a6f189db670437
- MD5 26c4ac0f712dce4367914b19d1fb89ff
- SHA1 14ea81f196c830cb805423ec89b971b2e4323004
- SHA512 353e35fe9594f13987fd15b528a85570ed71b6280473ca2f5f012b1dc8af2aed940850cd52df3e817c3cec985d5a255d1073917127a2eadac148105e4beba497
- SSDEEP 12288:IRa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoq:IRXKEFG1rDHmj7dip/
- TLSH T164C423039B8043FFC3141BF972176AA9A4B693A19D4516F866EC3511AB899370B8FF1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 512KB
- SHA256 d0e2fea75f0a4bd4dcab1f5248cd8cb09197bc64ffbacd12f5915329f3f8b482
- MD5 d8b542a163f836a905324728b497d97e
- SHA1 307fbf15387243e87229922a4967cdbd51b2786c
- SHA512 4b6854039d4ff531d00645ec492c81c6c2d7191f39e266997701963d27da59a98cad6676e50428f872748d491d994ecdddb2bdd7ac7fb2360cf2ea89a439cd9a
- SSDEEP 12288:Kna8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUu:KnXKEFG1rDHmj7diu
- TLSH T13EB42306579043FFC2082AB9330769A990B6D7A1AD4116FC67EC36256B84A7307CFF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 384KB
- SHA256 6eaa2752f08013d3ac6ddee0a09c802fbdb39b9bcd0cdcd3a1fe96ae2b7b178d
- MD5 93e849065721c54ba9d7371ccd0e3825
- SHA1 ffcc51944c71432966eb7a9464ada52ba06d3265
- SHA512 29c42ab2c6258739c409d8cdfb6a2e8fe8fbe0f11802c26396f51eaf538cf80e56154ed8b61d9088949ad8ac149b7f2b4b98df702e3c434746c8f07d88fe75cc
- SSDEEP 6144:Ix9Vg4a8lKYK2nnTgxzfUyHHE7MHGgpF2BBbDaI5im+NHGqR+5zDf3tlVYi2KwkQ:Aba8lKYK2krUyEGGgp9IobHGqR+pf3jM
- TLSH T1C584230966D167EED30C167673131DEA94B5D7E1BD012AEC6BEC1260AB806720B8FF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 320KB
- SHA256 2c654196d8982e1aee463303550e4396069a149a1da36483df69ab03b5d7825b
- MD5 7966343a27ba92f2dab61714cbbfad7c
- SHA1 b3cb097248619b847ba9a7d6697e4f5bc5f64acf
- SHA512 fc16611d19054d3e45e3dca78419f36f836bca9e7dcd59152f62f58328ac5b7c1e021246fb860ba46b87b639dd267b18c2a45559f8d31d1d35aa07cb355d18f6
- SSDEEP 6144:AuSi8Z6i3Vg4a8lKYK2nnTgxzfUyHHE7MHGgpF2BBbDaI5im+NHGX:ilN9a8lKYK2krUyEGGgp9IobHGX
- TLSH T16364230823D427E6D4285336B7225A76E5B2FD91EE1027DF0B680A661FD03611EABF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 240KB
- SHA256 1259c1f222c62954972ba710b679db6c7142e56219e96bc0781c9bd15be513cc
- MD5 2d7ccd1fb760e9fbeff6d05470f590a5
- SHA1 44055fce34521e5f8bb65e6e1ee63df637133c6f
- SHA512 4073880be97b26d268ec67e5db90be8ee0eb5b9dd2bc727a43107091352fd542b0fab64dd0cdd694bd48162bb2c853f64401305913685edae125e586c740ec79
- SSDEEP 6144:4wSkVg4a8lKYK2nnTgxzfUyHHE7MHGgpF2BBbDaI5F:vHa8lKYK2krUyEGGgp9ID
- TLSH T1F534120897E657FBE12C1A3633075AAE98B16B92BC0516DC5BAD27325BC025303CF72D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 112KB
- SHA256 39ac7c362fac544bb5ea99653bede049af4dd9558edb8f345b3a1a63ce728979
- MD5 e072ab9ed888249de021bb05728b6f21
- SHA1 408417a7d368613bc44d14ebd582863f8b49860a
- SHA512 4aaa26bcb13d413d8701796d16ab42fc95e9c4ae902d31df126536f2824dacdaf53bc8b4d2a60ffce87f944ff01dd3c72e025d85e806e00d6dfa47588e62a553
- SSDEEP 3072:FOIcvcvWRGg4aHcrpKDIDtPK2nnTZGTSv+E:cHvoVg4a8lKYK2nnTgxE
- TLSH T115B3020463E786A7F2164B347382189BF9B5BB673D46696C9BAC03565F8008315CFB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 64KB
- SHA256 c840769f25f85ad7d91549df4ddd5fd553563abe7c1bd9c2d427f2b80b6409b5
- MD5 4d0a233b7ce51d3be4178843afdd5c7d
- SHA1 59fced3263fa1e74bd801cff019849dc0fa765b0
- SHA512 73d42d95076aff444eccdd6982050436f00620eb6543de1098cb291828d7411d48221b8739b96a40d89673b968cb0c7aff0ee2f43d9fc079a2a5ab0078c5a615
- SSDEEP 1536:Nz10EfcnvEiY2lmQ7gwja0ohFqvrQh2FR6/GQ:d10kOvWRGg4aHcrpK5
- TLSH T10853F101AEE201ABF22B8B75A5D311CBF2BEB6522905B16D6B2C02545BB01C3344B7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 42KB
- SHA256 9a04fb8d4739d01446c84193650b53c6f974e78d1f13a5c05fff7976e46ff26d
- MD5 013202cb8ce0b976d9e0f15f4c38ad05
- SHA1 5cfc31437032de88542a4ca1f7ad2bb8655f44a2
- SHA512 447627c78f24a647ee0c53bbe9ec7c9de8f61df7346bf8cba1204617a4e1f75b4eaacf99c663d8a251c8d9e3cf78baa4b9f3836f2406852145dae34c6377c005
- SSDEEP 768:CNaMG4lx9BAgutTlSjJq75KbqBHTjMI59ydKHs4W+LCCYwwJ+6/jG0dUpyl+pJ:CNaM5XBMtTlcQzjMi9ydKHs4FC1//jGV
- TLSH T1CB136C5E93D020B0FDA6D138CA56D51BE3F3B0226524978F07B54EA62F33A31792C799
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 14KB
- SHA256 f939dd7489daf0c983c025ed14f5028570f7d367101f403623ce2812f70783e2
- MD5 448a39aef1f52b67f5a00c8d04a29032
- SHA1 2504a332bf867da8be3e48b007c708975833ac5d
- SHA512 7756468027586e91ef8293403b1ab68c69b2d9f52cc5d3792eb5ca5a09e7d5ec22f5252a7c8763ca2a21fd2e0fc9577c895d5291f6d88161d4b59464ef6783e0
- SSDEEP 192:rsx3r2z5ejmTmxq7B9GBDbK1FS5tfeiCFefSeU:rY4cmTqFKF5iCFefBU
- TLSH T1A7623C0AF9F604EAF30541B5D5B613CACCBD7E5BB582935EAB6C01182F217452607BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 73782b040e0f136bd3754b922ac09a2edd4d57ef93c3ae1dbfaa95e84ed43a56
- MD5 111142e951bb509254eaf8dfac41c133
- SHA1 b37877d4ec8217ffeae1a8e1fc67b19a5117e800
- SHA512 735f3cb8997547c7d0cb574836cba16e63ef4c1e8464f8982d8fdf3e80f22d9cac988703861da9e4b3746c4b8b5fd57bafc9e7d56607cb6f775e8f12e98e8851
- SSDEEP 12288:4+wvD5ue64Lk3tRX69qkyAI5ka8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxZ:4+wvtk9RX6wkyAIuXKEFG1rDHmj7dip
- TLSH T1AF35D029EBC804E5E177923C99B7460AF2B178691B31C6CF1299536D0F37EE45E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 1.5MB
- SHA256 ba8220465da1f51e5c4afebeb5361e091bb8921df4d44b991dbe3ec32e9c98b8
- MD5 f2d0678e0cd75a37b0fb338e74fe6f76
- SHA1 3dfd68d27e1dd52bde2d6d4f158d5dc5493ff71a
- SHA512 fa69fcdfd9a51c1729c9ffe756b620b9ebc984618f7429d37d2fafe0d9066325973031b8f5b2d9aed534e182e6ecf30108366046a0734c8a85b6f12b841b191d
- SSDEEP 24576:rY7HdNpsToxhu/dC7druy2Mf+tAgtXyvAD8nsgQWrcaEyB32:rY79Npsyk1C7pu2fFg4vAwnsSrxF2
- TLSH T13A753B9751A841D9C1BDD1E98F07DD1BEAB1340A0335A6EB03E546931F6BAF0AE3E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 8c55fdb8c48c9dfd0b88fcd9f48caba54e8f449052a42c6969e857694df33f5c
- MD5 c00508f996872616718221a62be5ef58
- SHA1 fafe150cc093f8dc52c835759d2196c467c9813a
- SHA512 e110f89b2cfed966240402fbe1a1b39ec82682df3f8c5e4abc2d4ab12f9d7d808a1203594b40f46f9867e2e9e8215592035d2e7556d83b0ec7a22bf3fdddb09f
- SSDEEP 24576:ku7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYUXKEFG1rDHmj7dip:ku7JUQjXirIhCnDHUPfF/eXKEFuDHchS
- TLSH T14C65AE1EA3EC02E5E17A927885154A5AEA71742E1F31CACF22B0437D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 718KB
- SHA256 5b3a16e684b0609a1297de5ce3b3f16db6ebd795cbbdcf037b9b2a2844d26884
- MD5 151d3441ca1b1fa1bbe95a683dfa7ac4
- SHA1 cc85a6b330503696527a3da505bbd0f5fc555ce6
- SHA512 afaead8498a239c4f1a8b7574e7b8f32b710f68385409be1e6a36e72331abbb168a1d67e1ebe0024f61f7b587c28bc80db5c730086347385360892792fd0e26e
- SSDEEP 12288:wF8fRa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:1RXKEFG1rDHmj7dip
- TLSH T1E5F4010AD28402E9C12E2679D3065A41F373BD6187E1D3DA63D0F53E1F7A6A14EDAB07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 606KB
- SHA256 8471ade1a4583f72f2110ee9b5cc335bf8a08162d21e634485917fd46142b9a3
- MD5 b5e923d3c7a20ef30ce88868679f0e4c
- SHA1 5321c3afe46fb4e48f09991162b0925cd16fa0fb
- SHA512 98d5db0ca2d567fdfd64066ebd43f3a07780445cb51d26d839ac0be76e6d2c2cb750675ace485aba62b4c6a3a0db712745d356ffa283dfbec1aa546aeeb9ce5a
- SSDEEP 12288:B87la8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:6lXKEFG1rDHmj7dip
- TLSH T115D42303978447BEC2282EB8721B9A35607AF3B14F4155FAB59436509BA4D730F8EF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 0a2436d671a0c073781e3e101472aaeab5ca8d0ac52871d87477f5916311cd95
- MD5 adda0ef3f5c89ad119751a195d8a4957
- SHA1 66465cc270e9e8221f449828b9db34781cbd2ca8
- SHA512 9d2ff49b4df26f4dc2ff348581c451fc822adda1cf5002c8c05f2ed2a775e4fe0f60bbb445cb8eb269ad40ecd0644eafd6fc8e510d317cf23981fc20b3cdbff2
- SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bY7rXKEFG1rDHmj7dip:hgb4mBIBhGFMrXKEFuDHchip
- TLSH T11965AE1E22E802F5E1F9E2B8DDAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 660KB
- SHA256 46a301cf75f6871b1962357c86167ecebe789f5e492ccc83a739ae32a684a727
- MD5 b4136152a3c43840060d4bbda475b29a
- SHA1 1e0f9e326f86cc1bfa4f46cc14bda5f576228e50
- SHA512 6bb87de984dd5bb15b0e6ad60cbb25e8c540c8a434234db0cd4244bcb6eff31ca2bead7b48bb67765d8f07e70b3a6e17ca2fa3996f923478f9ef096edcb9dde3
- SSDEEP 12288:8dGUa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:gGUXKEFG1rDHmj7dip
- TLSH T1D0E4221A66D022FDC2395ABDB1165966B0B2B2B04F0426FF05E475358F989F20B7EF1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 624KB
- SHA256 b8c36078f90869e8c60a24563dd7bd1fe63bda2374ba99b053590d79a16d9dc0
- MD5 e5518cad1947593414c04777b7cc0938
- SHA1 0b022b381f8ad77dc85f4ec75c40bb3de2cc9b77
- SHA512 9b1dc40bc35e484ec3785c1ce52b2123e2ec4f1110729e0c4ff398b0395fd85b0fd14bbaa159a55e33839a3a8a69127fb7702580a6687ab98f1d4a36422162db
- SSDEEP 12288:Tda8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:TdXKEFG1rDHmj7dip
- TLSH T1F7D42303974043EEC2182EB972076D6560B6D3A15F861AFB65E835119B889F30BBFF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 ea5f2046666e4f8580be9a5e3d6fb9827018380989333116f010ceba467859d2
- MD5 32258edd99775513aac8e580bae961bc
- SHA1 abaa2db22f1bc2ef2c5907a297e5ac07a55b0cc0
- SHA512 bf6c0b5b258d1a45f16a735a41aa57e04fc28cfe3cafe4396c4bcc2faad517844c6a6084c6014d200f77033135652003740c1f92358f44a04c74f1ef3afd5869
- SSDEEP 24576:I7b8u8FpJqH1ivria7/mRXKEFG1rDHmj7dip:mAZFPqV9a7/AXKEFuDHchip
- TLSH T1F535F16567E002F5D07BD1388A464A63F6B2B4250364EFDF06A88B511F23AE50B7FF25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 828KB
- SHA256 c8548fe7229ac15439d403e2ba7909630aa92204cb837603ba7e235224711a4e
- MD5 2e6058033236c632770caf640d7eef6a
- SHA1 cfe00810e661883510c918c30603db64ba205475
- SHA512 0a54d92a13fe30cd3910e3dea1345f3a39369c2f651503c333216c2686eb3658c0a4f3df340017a7b057ec9803e59094d4abb462634dca38000787779e5464e4
- SSDEEP 12288:AHvUrBFrEjwaQrCa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:APUr+NQ+XKEFG1rDHmj7dip
- TLSH T15205F21F22D818F9E67AA17D9642871DF772B462070292DF02E0417E4F67EE86D3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 75131acd214c62cad823834980504e8ba848fc76976d855ce4f22272981c15b1
- MD5 ca9167a62eb173000beab9ab101c520a
- SHA1 84815f8e0a842ca54ad53b517444201727e5b09c
- SHA512 0b597712b1a6e94ac9edf231b75c4fda95d06c6a117984d3c5d9397c9c856aa635c738eaec78e8037a63d5a08f39b58c82d3487e80b0ca7cdd53a68aeab5dc3b
- SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfXKEFuDHchip:xG05lO43bAXKEFuD84
- TLSH T148D5C06A62EC01F9D1BBD17CDAC64A0BEBB23415033556CF02A486A91F27FF45A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 0703b19ed88222c63feabc9f5ea32b1f1ffe546a1fa23b93afaafa046cab66f6
- MD5 3c3b3502e0007e648ab206a975dcc6b3
- SHA1 7281daf25307c0db53a94af594b7237d40d55ce6
- SHA512 f01164457bcf4b5cd8b04b6970a8428eb8fede89ee73b7962f9af55aced6453789b6aef199d82ebf0b8b7206232f894c1b5ab4975f8114f0aa6491f81a678d89
- SSDEEP 24576:PZa5POZ3dpbWVM50JicR2hG0lasx2+47eidnvXKEFG1rDHmj7dip:ha5POZ3wJt2pasx2+mdXKEFuDHchip
- TLSH T1DA65BF5EA7E801D5D179D17DC5838A1AF5B1342253329BCF122182BE3F27EE85E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 7f4871e6a57b57b2b19751f2fdc54c974d2b58b9af5d52dc3aa830c14fc951a1
- MD5 54f6c88e400d1c6d00f557c509da782e
- SHA1 de6fccbf67e1043df2e1151b141214f3f95e0834
- SHA512 7face5e0878b8218cc217dbde8db3eab43bc057af676da2b5fd6483e3fa825b946f9ae952fc8f5745d47fe61e7932d84e7bc9170d30d4b25021bca254e4c2489
- SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkFXKEFG1rDHmj7dip:pNc/zEOVHFQXKEFuDHchip
- TLSH T176858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851B1F73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 932KB
- SHA256 a12a118d21c81398bae0d4de397d5a908fee7c7ef39fce1402133249b3a69c94
- MD5 3c64f4b08a4def8c117c27157b66ceaa
- SHA1 cf1deebb43fe08bc78ca2c1fd165a50b581d8cc9
- SHA512 fbdd552d7f49dfeaa47947da9bbd70fab590ba62399e811769174440c7a99661f72f083d6296f6bf87994dfae6bb173b18417ea8749acf17fde1aab55cc58bd1
- SSDEEP 12288:6nHPJnJP6szeCs6Rl28dKa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:sJnJPbzB4SKXKEFG1rDHmj7dip
- TLSH T14E15E02DD2A810E8D4B7C2B4811A1B5AFE71347D2F2269CB19B4D5343F52FE06A79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 1eb5ef84d1eb99b334d5392facc7d425bc15470a6ce6c9c3586d28d9fa89b014
- MD5 521ffd00e5e5b89d6fefe7f078f9feb6
- SHA1 22ff8cb61aa3ea6380613ee7bf6ebabc0a0606ab
- SHA512 36ae238a96cf1cfd0976fe6bc9360298ca7578df95af1d81e3b6157d23676085188cb706d57bfc45b3b9d60813c3e61945adeb58355d6c2e815401d3c811a77e
- SSDEEP 24576:JCLHGL0MoeVtFumTijCmlKQWDkTXKEFG1rDHmj7dip:JCLHGeeV5ijCmlDWDkTXKEFuDHchip
- TLSH T1ACA56C05E7EB4184E8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 776KB
- SHA256 29916a4349a92d68ca40471e0d640698cee126c12db898317ed985ea0c8c1b06
- MD5 653ce5e75a34a147b1b2297075cd476b
- SHA1 fb21910093421153bedbf94bb6a4605d1c69224d
- SHA512 a35c63e0552210e98b048d6944e0c7d83231580f4931acba512b43e0fb6c2560ba7d8cc8b47aaaa34560edb54bacf79e8caa157acf7bfdd69ac7046c64cfdd74
- SSDEEP 12288:U1Huk6j5ZI7la8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:e6DIBXKEFG1rDHmj7dip
- TLSH T1D0F4010D236611F9C16B907EE2430512E1B2F1B187121AEF06E4D5798FA3EE97A3DF45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 760KB
- SHA256 c4d57ce1c2b1073accbe494f5461bd2d87d47b69b3f9f2e14032d8b94df4a89f
- MD5 f98ad68e80129de6432dd74a95a223c3
- SHA1 125f71ca9c0a65920a9b62c04b01f331f4c5a7fa
- SHA512 68e3e13bef21a94ceae6b66b53b39f2f5df48ef2c1bd9515354e7995cbb059effa5304d17b8159eae60699ea92203976679d515caf38f0048f37a634da42ba74
- SSDEEP 12288:NG6kyJa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:0tyJXKEFG1rDHmj7dip
- TLSH T14BF42202538451E9D2391A78B22386A09975FD305F0117EF21E0B63E6F75BE21E7AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 632KB
- SHA256 35000501aea257b512f9bf85d741b92ea84ac418eff83acd0af14194ab978b92
- MD5 c48c99e7de132c545a9901b3de7f20ab
- SHA1 5feaa3dcedb40ba41b25495d367f45a757d557f6
- SHA512 f9b1be7d9acaa885f091abcad838d18303dbcf3644247f8ec7c4d7098b61094263099843a884f57b8f1c87bd0445d2139cf1d86260125cbaccc80fd3c825d32b
- SSDEEP 12288:tg3a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:C3XKEFG1rDHmj7dip
- TLSH T108D42306574013EEC2182EB972075E659076F2B14F462AFF65E439318B999E30BBEF0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 0ffb2b718c7b21dfd6adf0120d7849f85a693b66372f3bca053c36e5e9db05c6
- MD5 fb152ef4610050c67b8b0abeb52ca308
- SHA1 0dded69a499e7ed766499d9e28ceb1edd93aaaf6
- SHA512 6a33d226bd4079c5957c5dc8c7a90ce7bc21140aac3acbe17640e8fef8ad90316f891b12f4abff4e5ab08a95c429a387193bcfbcebc258665abbd20f7b528356
- SSDEEP 12288:oEgZSZyFDK3tT5Tr7aVLIH9lH3cba8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVw:oEgZXoTfaidZ0XKEFG1rDHmj7dip
- TLSH T19D559D1D63EA05DAE2B2D679D8231493D633B4315772C6DF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 792KB
- SHA256 ccfe130bfca8c21151a6a2684ecb0b9b31de89ae972cc5361321c5b3e4fd9ad0
- MD5 b9fddb00dcddd630757ec1c1b802f894
- SHA1 b18b8a0b8430943879dfcab87926fdd3ec2aa44f
- SHA512 1f76ce692a8c6b80ed312366fdb09401133868063f5cf42c08ec3c918eee084a65739bdfaa9d5978d74271fe7f60d90335f850ffae2cce83070f2b89a63b6fcd
- SSDEEP 12288:UpJcm8CNga8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:UrcmRgXKEFG1rDHmj7dip
- TLSH T1A305F10EB3AA00FAD27B917C89424655E6B3B070571267DF02E0877D4F57AEA3E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 86febc3cc7a8754ea93e5b03a696d748c03c40e17b224dcb555af5b81a3496ee
- MD5 992fd542d1a66889e794e977a8d2d5ec
- SHA1 0aa4687a7333edef76e8986f658468ffd76ba90a
- SHA512 25882fbb817cb6f20f14fd06d7d5b0066b6124a2122884cdebb9676104a9e7763082bda532a9db836b74684299cfe4d15d6434aebe91ef2a17fecb6f7ce73e69
- SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3pXKEFuDHchip:G3Upow8sBWXKEFuD84
- TLSH T1B2A58C3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 fddafb9aa8aeeda265f5d147599b7f7241ae6165111ec623d45944175b8cd4d7
- MD5 1ebb153d3f541c91a3d05c52571823d0
- SHA1 42c1e5bf415064f2c9a150c651a88127e0199307
- SHA512 adbc1560b732bab559a66661f35a6ed03ab93b126657fc9d235b190fd8c40f23f116c7956bc54706aa24efdcca9a7754b76638861d86e45f2895f3fe44ab81d5
- SSDEEP 24576:mTkNvNnaFeYhJNtmZBmpXKEFG1rDHmj7dip:mTMwBtOmpXKEFuDHchip
- TLSH T18A55AF2EBAF806E4D1FEC6B4DD238512E6727461073253CB5290C13E4E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 988KB
- SHA256 1707db7d69b65d02a6d0fb25150bc4cea1415fab413308903d2315645cd3497e
- MD5 0e73a2c5dadadebbb867b41c45e5facd
- SHA1 2b84e289f333b9b0950994031c3b0d9d029600aa
- SHA512 5f31b2fbd4b628ab8e9de549a41eb99f7fa77c553c62a4fa2fecba78088da0c5271f0f52a2d226ffa168314d37b7f7575f36d15ec9f54f2819fbd3451d9bde83
- SSDEEP 12288:0QcMxWDXN1Dp/fshBItT1IQgAeYa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJq:uD3FHshBIYQgA1XKEFG1rDHmj7dip
- TLSH T16D25F13EEB9C00E4D57BD1BCD6638A06E27174A9072266DB02D481B65F5BEE42D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 768KB
- SHA256 229d0a292b50bd08413e42efc2ef3500e267c989f70b9606b09f4727470fd832
- MD5 ef1d76ac5777ca13a16a3cf6d69d20f6
- SHA1 a6cb3587eb0ecc4b98f5aa160b16f7913c002d16
- SHA512 d21bed32f70690cb36de925b0d193e70df007e0442c3f6371a831314a0618bb1661b1d881cdcbe072017338321fe0ee64b37ba0f98691b1e92d063f872dd729c
- SSDEEP 12288:0yk6b3IkxjbBzsa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:06UqjpsXKEFG1rDHmj7dip
- TLSH T15AF4120E57C011F9D1391674F226862580B1F9720B6666FF31D8663A8F35EE24A3FF29
- MD5 SHA1 SHA512 SSDEEP TLSH