Analysis
- max time kernel
150s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 03:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 749KB
- Sample260714-eftckadx7n
- SHA256 c8966ac88629865e4baeb7c97844efabb66f6cc194a86dc21d100a0fc0d5837b
- MD5 5cdb9650fee9ef8469d576c8ceba50f0
- SHA1 ae40340be620a29db441f967e51c84f28ce83cfd
- SHA512 7cc67257366d8f6a5a409a9ea1f073cad4e248caea470536c6e176dd1b57a469801105ba93b755252b15600e6fbe14ede4b9f76756fbc4c0ef41293e220b2ce5
- SSDEEP 12288:z93G6vHzVACubvJBNDYa3cflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YTh+:zVGGTQBZIlsfNXzsQoQs/dNoQu3oSgTe
- TLSH T1EFF4121171C080BBD5230A3045B4DA71663FFD311FB99EAFB384172A5E706E29A39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4288 alg.exe 1444 GameInputSvc.exe 108 GameInputSvc.exe 3176 elevation_service.exe 828 elevation_service.exe 860 maintenanceservice.exe 1256 msdtc.exe 5372 OSE.EXE 5380 PerceptionSimulationService.exe 5516 perfhost.exe 2740 ReFsDedupSvc.exe 4496 locator.exe 1604 SensorDataService.exe 4220 snmptrap.exe 3300 ssh-agent.exe 5364 TieringEngineService.exe 5868 AgentService.exe 3224 vds.exe 5168 vssvc.exe 5080 wbengine.exe 6136 WmiApSrv.exe 5220 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\10f24a63238bf42.bin alg.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078e321684413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000344d4fa64413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c045a684413dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e0a2d5684413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000955c6b654413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc35d0694413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca2b96654413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d10c70684413dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 108 GameInputSvc.exe 108 GameInputSvc.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeTcbPrivilege 1444 GameInputSvc.exe Token: SeBackupPrivilege 2740 ReFsDedupSvc.exe Token: SeRestorePrivilege 2740 ReFsDedupSvc.exe Token: SeBackupPrivilege 2740 ReFsDedupSvc.exe Token: SeRestorePrivilege 2740 ReFsDedupSvc.exe Token: SeBackupPrivilege 2740 ReFsDedupSvc.exe Token: SeRestorePrivilege 2740 ReFsDedupSvc.exe Token: SeBackupPrivilege 2740 ReFsDedupSvc.exe Token: SeRestorePrivilege 2740 ReFsDedupSvc.exe Token: SeBackupPrivilege 2740 ReFsDedupSvc.exe Token: SeRestorePrivilege 2740 ReFsDedupSvc.exe Token: SeRestorePrivilege 5364 TieringEngineService.exe Token: SeManageVolumePrivilege 5364 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5868 AgentService.exe Token: SeBackupPrivilege 5168 vssvc.exe Token: SeRestorePrivilege 5168 vssvc.exe Token: SeAuditPrivilege 5168 vssvc.exe Token: SeBackupPrivilege 5080 wbengine.exe Token: SeRestorePrivilege 5080 wbengine.exe Token: SeSecurityPrivilege 5080 wbengine.exe Token: 33 5220 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5220 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5220 SearchIndexer.exe Token: SeDebugPrivilege 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4756 2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1444 wrote to memory of 108 1444 GameInputSvc.exe 90 PID 5220 wrote to memory of 3688 5220 SearchIndexer.exe 111 PID 5220 wrote to memory of 4548 5220 SearchIndexer.exe 112 PID 5220 wrote to memory of 3080 5220 SearchIndexer.exe 114 PID 5220 wrote to memory of 3532 5220 SearchIndexer.exe 115 PID 5220 wrote to memory of 5044 5220 SearchIndexer.exe 118 PID 5220 wrote to memory of 4976 5220 SearchIndexer.exe 119 PID 5220 wrote to memory of 3764 5220 SearchIndexer.exe 120 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5cdb9650fee9ef8469d576c8ceba50f0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4288
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:108
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3176
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:828
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:860
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1256
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5372
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5380
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4496
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1604
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4220
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3300
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5364
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5868
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3224
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5168
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:6136
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3688
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4548
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 1664 3048 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3080
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3064 1668 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3532
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5044
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3064 1668 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4976
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 1664 3048 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3764
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 37389f648c0e12cffb03709f9cd5094439a210147618fb1cfeb601faa7beda23
- MD5 fda972aae5eaea7532b2801b8bbb22f0
- SHA1 1ad2e0fcbdc47133a01c314abc79fe2890fc2b4a
- SHA512 3852e11793ae1e088d70a0e64502244871093ada2cf70d63d7092af60a24d75b30113233b73eea750e09a70d1d19aaff6360a2c35a1b9313b3c701b535bfc6ef
- SSDEEP 49152:wVX632BuPkFKRrdE6oh7stBhuXjfS4LWxn0l6ND9mat3fo2uZM:j3q6gjB3sJ9I
- TLSH T1D5D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 0526f70d2f1a7267d149a745459e6d4f5cc7c7436e7f9d3bb6c5440ff1300f1e
- MD5 0b2e468ed0d9dd14261a880899f1af83
- SHA1 a3b9eb49fb087b7effe98343131aecfe4b8c0d6f
- SHA512 37fd80b61a37deda23c37e6b3a8936599a8071e5b46056375fa24905d3205b955c81ce62af21c3cb81eac9ac551a6d54c325d4aba04d99e589a79b0543647130
- SSDEEP 24576:bXYuACczAYlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:OCcRl6ND9mat3fo2uZM
- TLSH T1C5050128B3D409FDED1B823CC8A28512E773785647A4EB9B03E49A251F137985E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 10297de09e47d359e4974f5f2a2bc74e31872a501742b40d8447263ab1d92825
- MD5 c26071c0b82a1111b1720f3406971349
- SHA1 a265976e3803019f4ad3ba98e0d7062e68d9c31b
- SHA512 7f38b7d49c3ce566c70751dc62e55ff2b8174e7600028ca00c54380954416ffb04d9d0238721b4f07f8e970fd23f8f54d97893b66434bd6f56f5dec078ba5bc0
- SSDEEP 24576:s03ewiN0VcxOrM0lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:s2iN0+oxl6ND9mat3fo2uZM
- TLSH T1F545AE16F5788335D073C0B9C5D2A68AEA7230865B308ACB4286D77C7E57BE6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 f28bf5363627b3dd88b5db5e2fe864f2b746f7342e7bae4c7c925c1d90367e23
- MD5 8a3008aceefd31f782f5df66922c617d
- SHA1 16f452eb6330d630e8ce1f1246020c3c76ffb728
- SHA512 312ee6c7925f6538b7ca924823779a82e4c69cac10f7598db3a5415f9ec3798f42b132c954c406aa0a448c7cbe76f1a35299a159fad929c764c6b3938aa0eea5
- SSDEEP 49152:VoezSC6vUzPvuHjytzl6ND9mat3fo2uZM:6ezSC6v2XuHYzsJ9I
- TLSH T1C7755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 36eb9659854d5adc03f5020b121231c5c082cd262368baa8089cc47d9a45e9c2
- MD5 480325cbcda8d119434558f51fb4607d
- SHA1 317968bd3036e5791321ac31a3fae33a4f6a230f
- SHA512 bb87cdb84253d0aede7936d22285a004bb8b4c10ba293fac7b5fb2ca0500f3d17a3f492e7150e0390b6011e4f20f350828913ba2246e7376c4d390a8299c02ad
- SSDEEP 24576:tab6PLWxtv/l+dvlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:taWWxtXl+Vl6ND9mat3fo2uZM
- TLSH T17D559E66F5748335D073C0B9C4D2AA9AEE3230425B31CACB1246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 951aeaa79a60e351cd3dbbce4c16c7d392e4f3621ff3f6902cc1433f67f6c961
- MD5 239eedbd0a0245a73c61600290210bc2
- SHA1 2e11c7de37c2adc76d646aa6e815b5205b50b0a8
- SHA512 12e568a4bc6fc8e9b3d5eda01942bf56e73807ce5e855ac84458e4edbb841baaf9579ea38c2f679b035b67298ea0bd282c4186ebc9051bf0a60e487bc7e8d54a
- SSDEEP 12288:A7rflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLz:A77lsfNXzsQoQs/dNoQu3oSgThklXo9m
- TLSH T1D6D42301914C1ABEE70F97348049E653638B39574FFDFE68D994BB2018889A2F2B3F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 b2e91fd22ca8f9da08979f9af3abb556ed8a30a6e63b052a0fc4feeda8f671a3
- MD5 ab3f2d27b4cff88c4f5649092386f1c1
- SHA1 623c61d1c7d64bd55f8e4acc3ef13d00bfd8ebe1
- SHA512 9eb9618e72c0b114d4b8124a703b479bb71e2439ccd32cf47c8d6f17c9627956826e7e661514d968ea6862684c93472419d9760eb548bd822c70b896af4ee8bf
- SSDEEP 24576:TAIU/lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:TAIU/l6ND9mat3fo2uZM
- TLSH T17F15CF3BEE28FCE2C27E8D7856918600E77274714F62A3CBD165830E9E135E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 fc6cefbec39828b39b7abdcd6df93162f476b0d79c92274325799f2336a92bae
- MD5 40aaf75c97853d7569adc1d5dbe9f6e4
- SHA1 7575daacf4e0d3f7e0a0a9c597384509939357c5
- SHA512 d32eefce9306331d025e7970d5af9238e97966b1376d81c009fab379051ec4160064b08629f633e10ac8762017312addacec722643011018d69208f9d2041aaa
- SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3TH6:VQvGAdlCEL8c/9RNw5C2sJ9I
- TLSH T10F367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 a7469674fc7fd52510bd3e178217b0c81180ebbeacd4f82cc5a10d87f7357dad
- MD5 fba42c1e0fb270b998603b9c1272f108
- SHA1 b4fb67b5672c977f3c800da032a29384231ee366
- SHA512 666a559f5b6149b2e55b66b1a47c3ec5f3740df3fe44c910b9b380a3c2ce7a75281db115bce87b78e7413e391ce5cf78785b5153f08827f7044d139b0033192d
- SSDEEP 24576:ImewsAj9lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:blj9l6ND9mat3fo2uZM
- TLSH T11715E031FA78E036C37F0DB51B26C716146D79204FA12AC3E3E89E9E59602D26376E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 3f14ffb47f5a3e375882196bf1433bf9b6d077ae1545e1828dc4b6ed62bc89be
- MD5 c6c0a0df48ad99bee7ebacc268744a5b
- SHA1 dbb434ff8e519c8248508430de601d0090f89c52
- SHA512 b58a86b2245f19e6ca0f70dc9ef42adab6ba776fdaec9966a6bdb61ed1917cdb03c1d3237bab703460ed4a0b2ca63f7732e85ab30ddc6e0689e1f6cfecbb8195
- SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHoG:HUEtQevvqc2W1cpV2XF32oG
- TLSH T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 d1c07b5250faf9805b708f38081fe3782f413f0e5c9da2cecb75aacbcacfd7e4
- MD5 e6fb3562d99f67bba4b4bec808b72e22
- SHA1 2625de4a453936014fb9cf5992e1369b00eeb63e
- SHA512 6c9546e55105136f5e3cf828dc680494ff1295ead206c995afa6f9ab70c0f7d61368b4daa9d6c6aacbf828b33775065045363030d81266e04e99de35b57d4377
- SSDEEP 49152:O5HRquA/m2yL5zMfFiV+XenmE3/z9l6ND9mat3fo2uZM:moq1VjnmSsJ9I
- TLSH T145D58D0976B881E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 2cc0592156e435cb6aec633ef4dfcbba2d10cb468c1c377b49c7e910bd5ffed8
- MD5 0af44715fc0a5d84737437321255e00f
- SHA1 a7bd5d90804158f0116c5ed59b6a5823ce0ef582
- SHA512 b6a38233ce8246fc2fc1455e0bf2a43e8d6a95de5e638c1abfcef051543d45fd1660b5de328e399211075804f519132db1eaf7ced92e814be3ab2a3e53abf758
- SSDEEP 24576:RAhGLvyFoiwtA5l7S532lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:RAM+Foiq5ml6ND9mat3fo2uZM
- TLSH T1A245AD80E7F915D4F5B3AA7899B69171EA76BCAA5E31C20F2150D21F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 830KB
- SHA256 b6c10bae1ef5ca35ac2ca9b78b40301ccfec0a87745bbbd5ff728cbd9c893b91
- MD5 50b7fcd47ea9db1c3bf4f98a20f1e811
- SHA1 8dee91a52ab5b6882962da1e05dffbf88abf9f6c
- SHA512 0e2377179192ab4c46ec7b96e66bf19bb5b9d16e7d3a1e9fc1115b40f7b9226280d64bee1ae3d8f53546bddf91e03446fb5c27d365aaf5fda2b61252eab44987
- SSDEEP 24576:QwuuOWYlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:QwVO7l6ND9mat3fo2uZM
- TLSH T14F05F14572A80CFDE95782388557C136F7F3B8022A75DB1F5760C61B6F27361AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 d21c27ccb20af2d44f725d9a627d933a4cd0c7a3fb4aafacac29079307c65dff
- MD5 db5992f0961e8bd05b74f09a03d65587
- SHA1 aac53ac99a9457926dfbd89fa15f1992128f3b17
- SHA512 049a2560db97166965ec4af293f4dc5f22773777f412277302fa6165cdabb053b17d5592c364c9dfbc5e072632c7cdaf83e3fe1f0ec1818d04d2ff8a56149d0a
- SSDEEP 12288:lVw1IvP1flsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6o:bwu9lsfNXzsQoQs/dNoQu3oSgThklXoc
- TLSH T1CBE4224532DC21FDE247823CC8E59606E3B3345327BA97CF555487652F42ED2AE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 85afd6473336ab116461e423c43522d62cfd248345e8c20347401e92ea50fc48
- MD5 ee79c5e3ccef62969b1d89ce897d3fbe
- SHA1 804c4a535fd3abd6353d7038b705d8982bc8c829
- SHA512 5a1f4a02979609338f0af60be971ecf0e596f4ae35a86a8fabb64c8b1f6d9ab4a03f1adcaa2435db45a83a59f01f208a6089ff7f710e7cfae63c61f4facc068c
- SSDEEP 49152:pb5XB0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UC:NQRQyi36YOcP8Lvw2gAf+PN3/sJ9I
- TLSH T1E1667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 8d948ad051a2222823d502fa4a1fc59fe4645e55b25b68714f7a4f3a6cee8b04
- MD5 62a1d5af84572ec40d30d21a00a66f5d
- SHA1 5bf6a4dc9a6f4f6bc67d3da99f33febf55d3078b
- SHA512 2816bf25772b1a950a778623a26685cb4a76459c98584bba4a163c826c5316f31fa64d2eda2b08800098aa5b26c2ca8bfd29a2b2173d29e7867826d9221c9748
- SSDEEP 49152:pb5XB0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U7:NQRQyi36YOcP8Lvw2gAf+PN3CsJ9I
- TLSH T12D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 7463dc52b6c938c20b4a344cc3898c70a5ebc83aa173fa9b258349c485748726
- MD5 7dfec995ff5811dc39ed39723f1da189
- SHA1 e6489df01fdd49c745787041fc037a82e25164bf
- SHA512 9551ec63da1972e00fde73e32952df90bd8667df95a742f8494dbd7f33192f6726cd5bfa44a4a694049ee4ec74008ee1291312f4f12664cbb63c009d2de6b5a9
- SSDEEP 49152:k68Qg55nhMeWu7PNU3/9l6ND9mat3fo2uZM:OthbRc/9sJ9I
- TLSH T13EB55933B2F600A9C44DE1769F4A873196D27C758FE1E3DB850172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 b5e327c2964f9b593091dee53f61f5b4bbe6134e0f5b98e149c8881873496e4f
- MD5 4b5e92e969bbe455cf91c8e67eddb72c
- SHA1 5b7e905b0909db9f743f0baba48d31c79a54403d
- SHA512 aa6932f793f7408b8416b07932af1fc644de02bf925839ee0b9a21305325a65948de804ffe0a1ccc6351f6b79d7ca94d9e88f198895fe56069303a2013ee6110
- SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99r:My5112gYy5azzVv569nLKnhZlpsJ9I
- TLSH T153167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 70013fda6dd7b280a25e72f791ce88f4d481dd122dbb887291102ccccd694227
- MD5 7f020d0e63906e5150095441b0068436
- SHA1 2de521a0fad9518b39ab3fcf67448ee39162daab
- SHA512 e44971a10313737873a23bc36a7a45566c1a565ea330075503881cee59767180f015b1b73aaebd548d7d62f44b2aa280768a343fca672e14cbef0af1cb14a858
- SSDEEP 49152:oR+taZ3usBWOBr4tEGp0bqx0z+n217aau1glccl6ND9mat3fo2uZM:uu6JmTxd2dccsJ9I
- TLSH T145D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 940a4f9b8a43500f6910c6f4742e2435f7360aa5d5ab10e5a1dab023f418c79c
- MD5 266c8035c91a5ae71d0ffb8b69263f7d
- SHA1 3d5d5be0ff294b47975801cb60353df6311e2f8e
- SHA512 7b1d98f634aa21ad261532d2ff731a425a7b069c525523beee6ed577c3e694f86b6ee03293176e06804ee9da1390c60d26e170fa85313b86d038b91627d408ea
- SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4xyl6ND9mat3fo2uZM:GmifPbRDsJ9I
- TLSH T1CBB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 751c8055658d63d6da4ffe21a97a3dc9938299043c6f0503695b08610edeacac
- MD5 8e5b73cc88d6b3feb1519f8945ccbcaa
- SHA1 eafdc2dda1a1488683aaf03fc0fbb8b9b97dc9e4
- SHA512 888a81a40393f4fa67095c3e3a883e9735bf9569fd2b3b99831ee56a02da9e91dbe4a23d0246deefeee170a15be8f990b3a450350caeb385020f4b8c09c74e2e
- SSDEEP 49152:lSuZQIY0Be2K6RVtOnks6NMHqCl6ND9mat3fo2uZM:r5dKoi61CsJ9I
- TLSH T142C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 dfbdd3385543f31809fba99d435475a978e02d2f8ca8a36c1f19aa1b455e01ec
- MD5 0c02048d29002964247ca078c5d614dc
- SHA1 89b59ae398bda8a3920a664c68bb4991b7a123ca
- SHA512 2891b4f1cd26fd3478af50b303e51e69bb588c00e969948d9488279310c95d7fbb43567ac33a1441131c5e4e648aae4dd253d271bcd25455612f6d146c4ed77a
- SSDEEP 49152:3DvSn8EApI0figTgiDn0AP5wSl6ND9mat3fo2uZM:2X2iyphDsJ9I
- TLSH T136A5BF13F2D900E8D05ED174C7468632EA62BC160B35BAEF0A90B7561E7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 109b8b2249eba1082849d207ef90049837d40c5d202be6d85ea433eee9bff138
- MD5 7b202a73243ce6de8118642c63c4042e
- SHA1 403ecd0efecffa03c0adcc9905745876cbb08192
- SHA512 f3742e586ff374b84ae4767d96fb6af9090e305088a05ebd3479b95fa694b3f136fe332e7900ae43c1da2cae3555e56ef492eda59a94ae887d3b13d293c50272
- SSDEEP 12288:wOflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:wqlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T19AD42301908D16BFD10A97748145E247A34F354B9FFEBE68E58CB6212984972F273F98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 31e7f41212c2bfe5331183b58ca41099c87958e11111f521faf01c79721b007f
- MD5 31f25d50b1fe43b1dd1b433f143ee428
- SHA1 548fa0f73f381f378fff82d9058ac926ad76623a
- SHA512 97c69610bf15abde273a1cf7a1ed99ad266eed9fbffb14ff3e81b42b6194896f5115f2f903306355da8bcdd4e923e6b1d35f8c87cb328574c1d8792f67b2e0ef
- SSDEEP 12288:eXflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:ePlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1CBD42301A08D0A7FD10A97744105E346A34F354B6FFEFE78E58CE6216984D72F276E98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 b2525d70e72673c5ef59b2db686897ab5506140107fbcaf882b3ee69c416c906
- MD5 3e04acb72c11711b5d19a8d588869839
- SHA1 3499aedf1a640214ecc77ef88882f4e9544b0c8c
- SHA512 db4a3d38b910acc6720316923fed6c66e6b1222d460cd52749dfac10b31475029e6677eb166e53105823a8b9a76985c5758e37f454ad08e3c48617c7345f59b0
- SSDEEP 12288:YKflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:YelsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T198D42301A04D0A7FD10A97748105A356A35F354BAFFEFE78E58CA6202984D72F277ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 a8ae5dca9cc65c3dcaed8d6615599737c7210e39ea26642d10d6d75c91fc75c3
- MD5 4d478a50b9aa3b4c568e3e399836f8aa
- SHA1 48fd7f8385f3c856a3894d084c98a06da0e22ce9
- SHA512 f1108643722242c1c8e0158e57c69fb2d9d646a70d0671cae7b94a165e289397a1d8522cbedb53a1f62fdd6c864ba032fff7a44bb3447450b594596d41d430f8
- SSDEEP 12288:plDflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLz:/lsfNXzsQoQs/dNoQu3oSgThklXo92LH
- TLSH T1ECD42301618D06FED40BD338C0569252E3AB38979FFAFB6FDA445A111E80B61F275F94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 9a404adde6770cb04714e991387f56be82c0c919d1ead8b47098c13ed3f21721
- MD5 8e002c66a0d9f2ee9aea6e12003171bd
- SHA1 25ec1feb6b5b72052348f37e7dd72a46aa488cfb
- SHA512 74ee56698cdab7b9bce980868efad83cec80935017bf0c7a1b01e1cfde6c6eafbb195a954a90308986eda98e502cf31047e10b0305c24e991043b25e52018d76
- SSDEEP 12288:XiflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:X2lsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T183D42341A44E067FD10A97348105A346A39F315BAFFEFE78E58CA6201984D72F277ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 547503c518e27faf4d51594b1d3771bb99deb0df1328d218953f685995001685
- MD5 708c2fe7e6e21ac5403049447976c786
- SHA1 fb72441885759a65ca4dfeeec684dc9874e11237
- SHA512 d8db4a04ab1bcfae55538b5e9cfb8482a8856740be41154a3a712c1329d72f0c5c5ec6970635f5b6402f07b1f435426779ce141e045161d2c5efe7bb02693374
- SSDEEP 12288:kVflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:kdlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T123D42301A04D06BFD10A97748145E242A34F355B9FFEFB68E588E6112A84A73F277E98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 602KB
- SHA256 fe758076a039119cf118d4407565eab52065184a74d2fa0a79dabc810880e637
- MD5 ec8822c46da5620b98eace354671490d
- SHA1 9fdbc167717e3d3fb240b96a47290fe71ef3e999
- SHA512 df640c196176b1088335b74958696954f4848462816acfbcc846addc288b1237ba1fb0bacecc286ed068c99d736e62b9d3b36e55dfeb51c1d7a2460e157348da
- SSDEEP 12288:dyflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:dGlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1FAD42311E04E0A7FE10A87748105E356A34F355B9FFEFB68E548E7212A84972F273E94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 864KB
- SHA256 7efaae8f11574e5f91b198e1d7f1ed11f314df6fa5007868d2a57a17cd0b5ac7
- MD5 240c8b17e07d333e4f3b112106a4f1d0
- SHA1 9afbc0d8ebfb7b55b738dc7e6ecbbfe80ddca93e
- SHA512 0167b37b1ac33574ec2117fa56ab000d665c485f1e4f99775f09edd3a97f8c7f62fb5091f7f4ceedd8d872822710cd7493e1e7f9ebce6f69de92806a4b9d3929
- SSDEEP 24576:RZMUzFVSlZlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:RZMUzfgl6ND9mat3fo2uZM
- TLSH T10B150195B39418F8EC57823DC9159906D2B37C5A0BB0CA1F13A836261F733A15D3EFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 602KB
- SHA256 9a4cf9357a171bf42c8c39f2065c1321e923d8e4359ab8f1473b4b0678cc50f8
- MD5 3a1f494bf17dd9b7fe4cf9459c230f97
- SHA1 f2bff9ef085809228ee02e9322cf7ddbe705baba
- SHA512 314bb2f65ec38453f72aa162a9078260f7faf12ee8644b3e081754e1b0f5366b7a86be1661270e4bb194001040e66e333f41516a077bc912a68f8c3aad8da8c2
- SSDEEP 12288:gAflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:gklsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1C1D42301A04D0ABFD20A97744145E356A34F315B6FFEFF68E98CA7202984972F277E94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 602KB
- SHA256 622048b6572fe53025be6c87ebf49cda727aa9dff39915a6ab43a2b3eb92b883
- MD5 c682279c946f00458b4631318974e424
- SHA1 f55e0ccaf8f226d2749f0caaeeb32bc1d6b3303d
- SHA512 e397ad9225ce73bc0225daf33d6a1dd41715a39514c36f597a53747f73398193b34475f132940f8900fa96835f2924407dd7713e105cee726dc363cfcb3c122f
- SSDEEP 12288:ezSflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLz:ezmlsfNXzsQoQs/dNoQu3oSgThklXo9m
- TLSH T1F0D42341A08D0ABFD10A87744105E346A34F354BAFFEFB68E58CA7212984973F277E94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.1MB
- SHA256 43ff44229897e685b1391e62567bf00e3f0f54e0a9194023f928180fe68cf22a
- MD5 8771de16fd4ed7a17fc1cb580991c2ff
- SHA1 75f207e9f88111bdde160c992466dfedda3bf2cf
- SHA512 8d40cfd82f29b6ee2d8c5703acb6b5fea2a77667ef9ec9290e7da58cb2eb877d18aae4ed03e96807739bb91e96c182086b694cf5e69b180b9dacfb37632b2364
- SSDEEP 24576:h3wvtk9RX6wkyAIAMlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:eMnYIAMl6ND9mat3fo2uZM
- TLSH T1D235D029EBDC04E5E177923C89B7460AF2B278591B71C6CF1299536D0E37ED0AD3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 62ff212fbe14f5c9707ff63aeba8dc2d506272b98d29253047eb24f3232a60f3
- MD5 61e0f8d32be9b32221a4e0f3a517e5d3
- SHA1 50a854a631d7756904f4e95e38d8651edf8b0eb5
- SHA512 6c6a8157359a19b85edc74ac3387244449f482992cc9e2880a4e736b6c934746a86a66bf3d2685483b736c7dc31c00f325d7d7515b4acf8c4b4b0bc4a5ca1e87
- SSDEEP 49152:SY8hNpsyklC7qu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ol6ND9mat3fom:LySzPAsJ9I
- TLSH T1BC067D56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 d3d3b6432bf89ad04efccc718970839cb23a42fb68a795b4272e302e01c256ff
- MD5 a9ea928328a016c168733ebe2f910a11
- SHA1 2d6fb7cb4a6143f180885d592fe20882000e2114
- SHA512 dc5ee86281451d9bc1766524951eb61d06046cb3531037ef9953bb9964f2dc4d3c10d3989940c818f5d06ff7e59714f06203cebda5c63ace3a2010c506f54c09
- SSDEEP 24576:uH7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYTlsfNXzsQoQs/dNoQu3oSgThklXo9m:uH7JUQjXirIhCnDHUPfF/9l6ND9mat3z
- TLSH T1EC65AD1EA3EC01E5E17A927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 44e8427e8cdd1b65d4a278d57559af309f2437ff0b1a2c6f676c0414de064ac9
- MD5 289288a79d4a3acb4b4de9a38ec38139
- SHA1 693c1f8eed87d1f2bf33f8269e580014e7f4a7d9
- SHA512 a47122e4e9ded550eddf35e6d1d922fee377966f5d9dfae374e34867be43345c3764e772e9de52a98bbf1e86ed226bc1bf7828c1e6aa6173d05783fa166ab3bb
- SSDEEP 12288:8CXfWflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NQ:JSlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1ACF40109D29802ECC01EA238C7469641B3773C6687F5E7CA56C0F53E1F75691AEEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 ebfc8ec544032620c0152c41aad5e66ec6caebe888e904c47b4c78f8785806ee
- MD5 ce9d6c910721f31e7c85958cc2906813
- SHA1 244b0b1db4c99db90076c6218cca8702a5d2d42c
- SHA512 9a5f8c55e1af6fe1b4634e259dcfbde2f388b116a69f00bea338325a8c98ce025388dd1455a612a4a9e5f249f385fee14ff94e8c56d3b3e87b9fa42502eb779b
- SSDEEP 12288:Ry7bflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKf:ArlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1AED42311A28D1A7EE50E9734400DD221730F31675FFDEAEBF448A7212944EE2E6B2F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 339dc261e3d0dc81e7aec709938285b54160c6f6bdb518e2c1fbab188586da0a
- MD5 0ba25e24518b4c7a544ebc1423b5c0ef
- SHA1 035d3eea9949f9407352c5572f040bd7dd851966
- SHA512 bab4b166e803e7a52a99ab1aba1fae451052b4a52b81336c660912f41d8d060c8576e963bbceed827ddb9d541ecc8b0dd048a30ea981d6f9c9be7fe87dff7350
- SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYHlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:mgb4mBIBhGFwl6ND9mat3fo2uZM
- TLSH T18A65AE1E22EC02F5E0FAD2B8DDAA4417D6B378160731D6DF1151422D2F2BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 664KB
- SHA256 ddeb0aece4309f2911fbfbc0d1fc1aecc1c687c2ad45f2d5ee5fa35f4de120a1
- MD5 aa69b2b6f393a7a2a3114164f60434d5
- SHA1 0badce35fea00f8baeacc163314d14344e882fb6
- SHA512 f609a66b84a8935e24809a4cb21a51062e1be25824b581b9deb077deef93212d78e16478d00a8911d7bf8fbe764a1a4ef357ceccf5caf709208def274717feb4
- SSDEEP 12288:NcGsflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKf:aGolsfNXzsQoQs/dNoQu3oSgThklXo9m
- TLSH T1ADE4232970EE35BCC52AC3388065915372B731615BB9BAFF88D4E6315F449F1B23AE44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 628KB
- SHA256 486ea637e281c5a5967ab8e4643905e21b34a01d7f2169b49aa556bf2599fd08
- MD5 8ce0d5b162dd0309d286c2e43296a8e7
- SHA1 74b0a1eb295204c1e2c00dfc8d79a9cd641a263b
- SHA512 e24e4711cf42244d32134b97979d058fdaad69b40a2c1ac8c011fe93d9cf1b97d5bfe101fed2fd0543f3e59364eb07d2d7dc0e50cc3001c29e600b0d92030c22
- SSDEEP 12288:DCflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLJ1:DWlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T1A1D42311A04D1ABED50A97384006E612634B31575FFEBFE7E888B7211988DF3F276E94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 3d1c35f0b2ca1eb5f6ca1764696243f8d96308e37aae02c225ab569e1bf35ef4
- MD5 6bf1a1a5392b6a21e137e1d2dc8ecad5
- SHA1 8eb2f256e63e45246b947d7aa90986fbebd73482
- SHA512 2f1c13e0edb6bdd75d5737a9f6e448b04b547316ed4ea83506c3b728d0c39d7751e8c45f60de62038a06436377cee1babd3425ce01b33ee355ad93eaed994388
- SSDEEP 24576:HG88u8FpJqH1Qzria7/mmlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:m7ZFPqVva7/Bl6ND9mat3fo2uZM
- TLSH T1F1350165B6E502F4D47BD13889864663F6B2B4260374EFDF06A88B511F13AE14B7EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 832KB
- SHA256 9fd11da8617dd0ee0e7b43382b0fdcea82cd31d1094b609ac655e986f1508a17
- MD5 1f560047fe3f50aba63b261c15c917b3
- SHA1 c99e4e4165138c23d4cf140023898727ccaeefc6
- SHA512 0ad51db75429212b52c0eabfa38beba16eaee222c6458ae3218bf1f00bc79f05443af091fe4a77a4a42035f95a7de169fa45bf2744228e2340c1b576ee1db128
- SSDEEP 24576:0PUr+NQKlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:0JQKl6ND9mat3fo2uZM
- TLSH T14605F11F629D18E9E67AE17C85828709F37274620752E6DF02D0817E4F57EE8BD3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 529378701476a97081f5fb5206e76bf97e1a1639ba97b9a2301839189c63343e
- MD5 feed185ac19168002a2ec544abd3e7b7
- SHA1 9f9dfb2374a48f37342a7e8b2a46cb40c4f55362
- SHA512 7c1484351692e2656c14fb431695bbe2c18c9c2a1b9121eac7ed0cbf9ca5fbe6075d12e387ed323ca261846cfffd6ffbc54a7aa05ca7e36be53d15723135813d
- SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5l6ND9mat3fo2uZM:EG05lO43bosJ9I
- TLSH T10BD5CF6A62EC11F9D1BBD17CCAC6860BEBB23415033556CF02A486A91F27FF4A57E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 b431df39488884211f1153f52858d58acb2451cbf6a9a67f7480cd5c2765d73f
- MD5 4e0e4de26c789c140684fa609e4feaaf
- SHA1 5cad2f001f20b017f392d7279f05518c47e0ea8b
- SHA512 70ec63053345eb3d101200858be4be6491812e311625bd1716ae693cb56f906928697b2c23905eb0873198a0de3279a70130b628dd2a98a576adbbedd2d17f27
- SSDEEP 24576:aJa5POZ3dpbWVM50JicR2hG0lasx2+47eidnPlsfNXzsQoQs/dNoQu3oSgThklXL:Ua5POZ3wJt2pasx2+mRl6ND9mat3fo2D
- TLSH T11665AF5EA6FC01D5D579D17CC583861AF5B2342653319BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 b572103104e40f2a5b1c8535bb7805af06a309922f8a2c495cbd58f073de4271
- MD5 7aa2d8c246b1e43004683ceba7656d47
- SHA1 555704506a89c00745ba69a5c73a7d154fbdc3fb
- SHA512 06aa24c22f66a36b6871e4eaf8f48a6231baeb7e4d70290ffc8535fdbade214e9378ea1e695edc0cf6e97fee66d98df7205630a855cc4fe8a999fc62d610213d
- SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkblsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:4Nc/zEOVHF8l6ND9mat3fo2uZM
- TLSH T1BF858C1623E901E4F1BBE1BE89779546FA71786517348ACF0291811B1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 936KB
- SHA256 50f89635e35139ce23cd834f37103bc68c19bd71c6ae78a9d3ab388cc5f620ed
- MD5 cdf45c6a34a31fdffc0228b472e999ca
- SHA1 0d958ac91d48024e59fe2d854de05b71598217fc
- SHA512 2522e7937109c71ec26a8f56b4ea6cdb461762bf49e42827d91c610e2b866955441149ef1883c91e43bd3388e76f6d0ca8b53f7510e804cbe519234c7ebb4313
- SSDEEP 24576:mJnJPbzB4SLlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:mJnJv6SLl6ND9mat3fo2uZM
- TLSH T10D15D03DD2A810E8D4B7C2B4811A175AFF32346D2F2669C759B4D5343F42EE0AA79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 28944199bf653515ecf2e152deb16ba02b3187f02631fa93b26315bfa17f12c7
- MD5 cf8df8ac8ffe5c44b002c25a900f0476
- SHA1 891e6ccd0f416f87888eabfddae06c2fcdff69f4
- SHA512 083f38249c05709191bde006b3a7e6e75f8010f1fe17f31e8ddc9b5eeb2d72be693c5896a4536215435048825705dcbd91f9b47063e339b4a07e8bdf57c5fc10
- SSDEEP 49152:bCLHGeeV5ijCmlDWDkBl6ND9mat3fo2uZM:GTsJ9I
- TLSH T1A8A56C05E7EB5188E8F3CAF4C92694169A327C549B34F7EF4A80C96A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 780KB
- SHA256 af1d1f19170f9b37f5c63930c411be6cd174f95783e0aad2e4580654ff056807
- MD5 3ec3b1a8fda272f8194ed6ed9bf1d92c
- SHA1 a8be1cdfe7543685a917d0bda5013753611daf59
- SHA512 2255cecfc484b5d73f632442509350bb48ea81f6455bcb69ce20ec1c1b8f873e2175271d7f3129f9045260ad501343b88dfd6025c8f3167130e73a4e415cfbd3
- SSDEEP 24576:6/DIhlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:6/DIhl6ND9mat3fo2uZM
- TLSH T10905015D237A10FAD16BD13CC1834102E2B3B0B187666ADF4AD8C57A5F93ED8B939E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 764KB
- SHA256 1bdf3ec18e548adae7b702cc4ff5f91f322b9d10ce38e15fb6d4873badb4a669
- MD5 554e078b021b5a335a30dd48aee45615
- SHA1 3b1a4bcf7703338236e634f8939a81e545cc71a6
- SHA512 98853bc72362756935aca43dc13900efa08665cd460928a1001b04c328514aa1ba1bcc20c63b546bd34075201f29b9db52a470489e9c9a6e83946e5f5ad31038
- SSDEEP 12288:BG6kyUGflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6DM:otyplsfNXzsQoQs/dNoQu3oSgThklXoc
- TLSH T174F41200638821EDE62A4338856282A19B377C215F75A7EFA5D0E73E2F25BE1F531F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 636KB
- SHA256 19d682f7e4194e9625e59c0de763842a3310000a7e45093adca30013f8116548
- MD5 2179963a8e235990b997e31f95a665bc
- SHA1 51bd325bcee78485ca9a0b7d4086f742a546b5ee
- SHA512 6d83953b7e2c0a87a14810bab28945959c93da69d71518ebb6132e0898dc444775dc7649b39fa192d95ec76351fb7968ecd3a3298f6cdc99587184d51f48359a
- SSDEEP 12288:mXRflsfNNh82ZsQoQidJi+LdNoQxas4kUn3o4TLY8YThk5nXo9/ovRDXB6D1NKLz:6xlsfNXzsQoQs/dNoQu3oSgThklXo92D
- TLSH T160D42318A14D26BED509973840099352635B31671FFEBAFFE8C4E7314A889E2F272F44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 c9164152aece363b902a160c66934e680567fe0981f6a153ef0eeec8ba19f2ee
- MD5 920544d498253f28c109046c67d6498c
- SHA1 847ad2918027695c7759d1c52c1409c524529b8e
- SHA512 3ab4492efd055bec463110b065075568100a6d1657130e894d5a6a2a76d2299717b9308bc63a43fbcbe8ad8d0abab09acc42b126e50318a9e6f440eb89b4a427
- SSDEEP 24576:dDgKPoTfaidZwlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:9gNTrZwl6ND9mat3fo2uZM
- TLSH T157559D1DB3EA05DAE2B2D239D8621493D633B4315772D6DF2448C03A4D9BED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 796KB
- SHA256 b69668ad773386b268ca22761e172e08ad500dbcb3387c226906215c3e85c528
- MD5 724eb618422884912244eb25775d4240
- SHA1 134f03a6e324014d388ae0f154ded258b31f553c
- SHA512 48985ac00b5eab2cc30bd84cd8e49e868e5dd6c766aa651c9e741eda73e3e14ca259f2a2e20b0339ceff562f1e5a141376f6fca61321bee68553dc17cadd2c7b
- SSDEEP 24576:JrcmRPlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:dcmRPl6ND9mat3fo2uZM
- TLSH T12E05F14EB2AE00FAE16BC23C88414256F3B37031576267DF42A0C77D4E47AE9BA35B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 bf15c5a1c5f0e89642532c010af2bdab28a2419f0580ea4d1dad253e1d2e3218
- MD5 7ec9564c500da81a333c986b9e70c7bd
- SHA1 90b5b1e759a28b636a04daa79c05173f4421968f
- SHA512 fd2ee4e69a24b1ca4d3eef42ade15e8c03a9fe94276153f4de6ac3a5ecdbafdacb8a25a13f6a75cac46fa84fa3a14a17430996b7d6a23394421daf11fa658c09
- SSDEEP 49152:TDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ul6ND9mat3fo2uZM:I3Upow8sB/sJ9I
- TLSH T1ADA58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 080a942ddc6d6edd24a198aea8dde4d3776dee1d3bd0ec555799dfd364ca9f0b
- MD5 4cb25f673572400322147e1ad6598061
- SHA1 131bbdd18c8e06864f4f8adbbc07d1c30aaa65d4
- SHA512 645ef5699f043465e5ebcdc1085eed1b45911a39f64093c00547a53b302601f2efc4dbd1c318b831d0598989bf26023f2490663929436aa596ec0c0a7158b1cf
- SSDEEP 24576:cTkNvNnaFeYhJNtmZBmAlsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:cTMwBtOmAl6ND9mat3fo2uZM
- TLSH T1BC55AF6EB6B806E4D1FEC6B4CD238512E6727461073293CB9290C13F1E579D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 992KB
- SHA256 91cd1928e14bb5ae63a0054f43e4b76d7010ac3c45578972104e85ceff1f1698
- MD5 f69389078695711a6fba7eca20c6cd40
- SHA1 76b2c07975b50ebf12d49560d1b307609fa06e2f
- SHA512 75d189c3025ffaf61500d644d0de1def44776bd891b09022d80512346a747932fe8615b982de4a2c03fa2b4534a2f212520cfe6c0156f8627cf29f5112480ab4
- SSDEEP 24576:FD3FHshBIYQgAclsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:FDVHeBIAAcl6ND9mat3fo2uZM
- TLSH T1F625E13DE69C04E4E57BD2BCC6538606E37238A907366ADB02D481B51F5BEE4793AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 772KB
- SHA256 a08a8a465c3129221f4f23b3bbe7dbc562625b5cdc6e5226e5b8f3730d555a52
- MD5 b77864faaf8d303016c82ea1d118ca7c
- SHA1 83f8239d715e543cfd960ac2e2415d7d9e9faa37
- SHA512 6a5cb06a8c8a8282179ce98bb75cd8314704b4a802b2fd2a6390a88643748775e7d74181a6dee705d440cb2622aa9a90dcad4acc30ff32eb7a63c8dce27648d2
- SSDEEP 24576:D6Uqjp6lsfNXzsQoQs/dNoQu3oSgThklXo92L6D1EJ:D6Url6ND9mat3fo2uZM
- TLSH T129F4125D52C824FDE02A8234D5658226826778731BBAAAFF71C8D63A4F35ED1D13BF10
- MD5 SHA1 SHA512 SSDEEP TLSH