Analysis
- max time kernel
147s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 749KB
- Sample260814-remjvadj41
- SHA256 04061e7ec96f7e353b4d1cdd10991a03fa8c0229fde90c8aa850a7d6c2dc7cdb
- MD5 2b42e6d68a148fe2c4375567542033a8
- SHA1 9aefae20bf458389ae4f763bd494339da81d4500
- SHA512 15762d428464e97f8a466b829290ae234f6575ef902100e30636d40d3ef7b8be83a12542c31e4a9e0e05d129c2aa936c0272e339cf86ed1af4f54bcf734d5913
- SSDEEP 12288:e93G6vHz+AhubviBNDYa3DokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CZ:eVGGT/BZx0pd6FVwwyBH/DI1uI
- TLSH T184F4121276C0C4B7E9B7153006B09A312ABDFD301FB15E9F7394176B9E702D29A26B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5388 alg.exe 1360 GameInputSvc.exe 4968 GameInputSvc.exe 476 elevation_service.exe 236 elevation_service.exe 2604 maintenanceservice.exe 1612 msdtc.exe 2648 OSE.EXE 6116 PerceptionSimulationService.exe 1620 perfhost.exe 4116 ReFsDedupSvc.exe 3864 locator.exe 2864 SensorDataService.exe 1840 snmptrap.exe 3224 ssh-agent.exe 3796 TieringEngineService.exe 5624 AgentService.exe 3976 vds.exe 3744 vssvc.exe 5540 wbengine.exe 1532 WmiApSrv.exe 3120 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ca2c889e763f1d8f.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090a8a033f62bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000095b3a533f62bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@zipfldr.dll,-10148 = "Compressed (zipped) folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edffad71f62bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba5fb032f62bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\sendmail.dll,-27 = "Desktop Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4968 GameInputSvc.exe 4968 GameInputSvc.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeTcbPrivilege 1360 GameInputSvc.exe Token: SeBackupPrivilege 4116 ReFsDedupSvc.exe Token: SeRestorePrivilege 4116 ReFsDedupSvc.exe Token: SeBackupPrivilege 4116 ReFsDedupSvc.exe Token: SeRestorePrivilege 4116 ReFsDedupSvc.exe Token: SeBackupPrivilege 4116 ReFsDedupSvc.exe Token: SeRestorePrivilege 4116 ReFsDedupSvc.exe Token: SeBackupPrivilege 4116 ReFsDedupSvc.exe Token: SeRestorePrivilege 4116 ReFsDedupSvc.exe Token: SeBackupPrivilege 4116 ReFsDedupSvc.exe Token: SeRestorePrivilege 4116 ReFsDedupSvc.exe Token: SeRestorePrivilege 3796 TieringEngineService.exe Token: SeManageVolumePrivilege 3796 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5624 AgentService.exe Token: SeBackupPrivilege 3744 vssvc.exe Token: SeRestorePrivilege 3744 vssvc.exe Token: SeAuditPrivilege 3744 vssvc.exe Token: SeBackupPrivilege 5540 wbengine.exe Token: SeRestorePrivilege 5540 wbengine.exe Token: SeSecurityPrivilege 5540 wbengine.exe Token: 33 3120 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3120 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3120 SearchIndexer.exe Token: SeDebugPrivilege 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5312 2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4968 1360 GameInputSvc.exe 91 PID 3120 wrote to memory of 488 3120 SearchIndexer.exe 113 PID 3120 wrote to memory of 4664 3120 SearchIndexer.exe 115 PID 3120 wrote to memory of 1136 3120 SearchIndexer.exe 116 PID 3120 wrote to memory of 3904 3120 SearchIndexer.exe 117 PID 3120 wrote to memory of 2296 3120 SearchIndexer.exe 118 PID 3120 wrote to memory of 4772 3120 SearchIndexer.exe 119 PID 3120 wrote to memory of 5604 3120 SearchIndexer.exe 120 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2b42e6d68a148fe2c4375567542033a8_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5312
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5388
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4968
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:476
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:236
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2604
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1612
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2648
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:6116
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3864
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2864
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1840
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3224
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4964
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5624
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3976
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1532
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:488
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4664
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2924 2920 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1136
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2952 2940 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3904
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2296
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2924 2920 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4772
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2952 2940 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5604
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 477b5ebbac49962777a6d4b1998fbadc06222f27b70e3bb3c206e58e7793b12f
- MD5 f11701ad6fc025332cceeb6d663ced6b
- SHA1 b214196b4d2cd743d314225285309a650ad97e74
- SHA512 412f9b3b913fd02d5b83e033fff41660be3055baa09dcdf2b386a8eb6729bcb06d7c1885c65f769e029397e210424f1034fe2a2138f96748e01adf120dd25d9c
- SSDEEP 49152:Yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxntd6Ha/DIAI:y3q6gjB8BrV
- TLSH T1FFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 a916d0042f7072e0295d0ad6ae390b8179e027dd87ff3b7098aa3230caee954f
- MD5 18c69908ca83f924841d3d007594b967
- SHA1 fe61fe07ac6fd4dce0a72d3d0fd7d25419c871b1
- SHA512 d61f0bd9f9eb742aedd777ddb1a6115f41055d0934890f61fd86b9ed2825b2ad4a26f077a6476ff026503aca6b9ece0800bf04fb5a64d858fb72b2e92b52568d
- SSDEEP 12288:21XLs2aWtxnfjBD2czAmokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4Cuur:0XY/+0czAm0pd6FVwwyBH/DI1uI
- TLSH T1F1050229A7D408F9EC6B813DC9B28522EB73789143A0E78B03B495765F332945E3FB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 5a3d94a8e7582e8f85164717de97a0b33c919a86d15379b63380cc003833400b
- MD5 2c14bc15ee4c7946722eb1ec5d870d02
- SHA1 086385001260e8f53b1d1d81e9294346262b0781
- SHA512 31bb95392fde0efacbf0ccf914fcd65db79e20882e3f7e37811824f156e65bdfd006e03e55ca14524868126452752cc646a44a50e0ef4db73b4cd06e8712998d
- SSDEEP 24576:l0mejhM0xhxOrMb0pd6FVwwyBH/DI1uI:lmhM0fo1d6Ha/DIAI
- TLSH T19045AE16F6748335D073C0B9C5D2A69AEE72308257308ACB4286D77C7F67AE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 eb3a85facc892a86972d759889d1870f02ff761a13be925bdba014bc3de0e048
- MD5 30712e85a3aec5bc7058a9e1dc03ab1f
- SHA1 80b4cdf127300298682538c800f51a79b265d146
- SHA512 bd7fb9ec656d04db03061460faef12033284aa421982e8dac8957c39c1da0ca16a248b528a559115c8a4da0b525f20bf315d52b089e062adece8757c1d695cb5
- SSDEEP 24576:cCC/ezSC6vUyD/aqgrvW/6q8wyuU0pd6FVwwyBH/DI1uI:6/ezSC6vUzPvuHjyad6Ha/DIAI
- TLSH T14D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 fe0ae64e5f8cda447b800690d27402943de0f8c615c79ded51fb17a6a6e1c5ed
- MD5 cfa04db729fe0e73e0e9072ce276781e
- SHA1 552967d5af59f8cfcd1d39e710a841b31cb86851
- SHA512 496d273c3a80efbefab5d8ebcf61a1b7b91f10a1bc4e6b464d6f0e57a99cc5eee8b67e8c0c2351c29e5983b1ba81a3fff59ba73c31598696a009f2b2f13824bd
- SSDEEP 24576:+AbRP1RvVv/l+do0pd6FVwwyBH/DI1uI:+ADRvVXl+rd6Ha/DIAI
- TLSH T1ED55AE66F6748331D073C0BAC5D2AA9AEE7234424B318ACB0246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 ebf8a76a74a4247264a140b175247168f074cc4d7e019162fa3f25511927ee2d
- MD5 529742b088e8cc55165f5f6732b8c07a
- SHA1 05e902d7dc10cdd911915a24f69bf05b60fb9f5f
- SHA512 58bee4dda9e5884d7362ec4ac587bc7a13224576785ab2d78f54d395445409793d9dad6f54a2e2d90023ef4cef7fda4533a01d32d39e9ffc5a978ed16ddfd687
- SSDEEP 12288:Av8okUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:Avg0pd6FVwwyBH/DI1uI
- TLSH T10BD42357CF8488DAFDFF1539027267323BD51DA142E1AE069F7062EBA970111E783B19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 badaeb2108ad70355d785c94fb95b45d3702d078790b5d534c6c7745f27ca7b8
- MD5 c9cc3d05f88717593ed4f8020855f7a2
- SHA1 e648a3692ae4eb055c2996971db799342afe7ff0
- SHA512 cace047e601786ef329bbc976d2d6ea5106c20c362b5e3881e4366306269ba309b41876ce26180bbfd7676048ebea209cae95e6a03dd343a8358e6514aa8b4bd
- SSDEEP 12288:CeBNUbTVO86UQokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:CJIUU0pd6FVwwyBH/DI1uI
- TLSH T1D215CF3BEE28ECD2C67E4D7857918700A7B278704B62A3CBD174824EDE235E15E76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 2.1MB
- SHA256 71cc34a41007ecdeb2fa36b764f819be5697b6d73d45feee3606f02af88d3c3c
- MD5 b659ab902603ad59ea7b163bbc11bb17
- SHA1 f2b0acbbe42a5157b93a5625d2d43600e66ea3b3
- SHA512 e92f529c3643e87d3f0e9fc1408245e888d361e8c4a8db58e72a9f494e4646b0b5127a220a5823f9efe9f3e5f5e836e790196c9f16fd4626ee3057ca28f2021c
- SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScW4:nQvGAdlCEL8c7
- TLSH T18FA55C6657B841F9D56FE099CB6AD973F7B138060130778B0BA1CA273F77A602A2D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 d9b32deb0ef3f6ce1a0ddf2b269aecde433a9f004bcb7e5d458f923fe93e5325
- MD5 db925bc8f760371a77b1825b3d2d3f29
- SHA1 588946162b89c3f2f7aa8de55c0a709a85bae4e3
- SHA512 0f032677bc0992533ebc100b5b531a0f051de6c907e8711d5ac3069f6ce5159daf7a06fe2d191ffe78218bed2fb51a6d48a4d8ff4fe878d65a5679774e7a41bf
- SSDEEP 12288:KDwSfxL/2Dc3bDLLmt0LDQewsAjeokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHa:MmewsAj+0pd6FVwwyBH/DI1uI
- TLSH T1D115E031FF74D436C6BF0DB61B36C716286D79604BA11AC3E3A84A9E59302D22376E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 1.8MB
- SHA256 bfddc849936a25ae2812e40ff6e70f87c75e880a1f4792b49a9bfcc8aaf5a3d3
- MD5 11b12118523e98ffc3acced5091e31a2
- SHA1 04eee9cf16d02b182043fcf18302817bf472b15f
- SHA512 1018e41f6a4c07f3fef22affc94b5c5ad2c1ba8c4302835607f40ffc303b1af5cde668492ac537818afe26a181d96dfb99fa23570813c92a1de04056eb300a04
- SSDEEP 24576:SYVsdaFd5FWsAfqeeTOyCkaXESPWXZWBB7bu+zQJDw42zFbFDoDYU7VM:SYVCPaBGkaXESCMBB7bu+zQ6zFZcDYH
- TLSH T141957D965BB801FAC57BE098C79A8537FBF0740505346B9B87B2C75B2F3BA60592E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.3MB
- SHA256 cc8ff1add6f523660ac313169ff263097bc4793ddc2857425bae82c60a94dae7
- MD5 1b890c31d952f14c764c4d05a7465516
- SHA1 d4dc2ec6aeb6626b36a5a62a3737d39472830e1c
- SHA512 8a1a663adb2971ece7420a6eca8648962a42cf8d39cf0c14c0553c4dca63907580d3d97f24c75c00cff90f727cb7526990e7c6f278570b48f8d8c2ac00b8d528
- SSDEEP 24576:l1bRquA/m2z+L5WqJGrHCYRFiV+XenmE3Pnzc344+0pd6FM:l1bRquA/m2yL5zMfFiV+XenmE3/z8d6m
- TLSH T1DAB56C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 ae71c23cf5cf69535fae5f797323f0d896188bb757418393e358d9a4e950d8f4
- MD5 6b05a82dc5d862da2dcd5964bedca0e1
- SHA1 fe8610116b5bbc270af90bf20ce71e45d467fbf8
- SHA512 91875d009a70cbfa88c6bad55ab32d503069491303984d9ec81b4fbe3de8785e81b3517f2061561d1d5fe3cb244925c6123291b559f86b5eac60fc0c88fe7cb0
- SSDEEP 24576:RAhGLvzFoiwtA5l7S53f0pd6FVwwyBH/DI1uI:RAMfFoiq5sd6Ha/DIAI
- TLSH T12C45AE81EBF945D4F5F3AA7859B69171EAB6BCA65E31C20F2160C11F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 829KB
- SHA256 99450531c3cffb7a29c27295d05be5102a0eb7a855d78a8570274eec8aa7b15a
- MD5 e996e93a490151ed0f03a02169fad1ce
- SHA1 17f5f7b9677890f289e59c6026ad12003989dcb8
- SHA512 a9ad6b8f929ca814a9744fd08b79197e9b08ce80d33374aff1fa50541ce2ad2eb6532b4fa2fed33a33b08c32ecb3658882f895c77f2252d570569bf71757208f
- SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CEokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI40:uwuuOWB0pd6FVwwyBH/DI1uI
- TLSH T16505F14677E40CF9E9A741398667C132F7F2B8112661DB1F5770C65B6F33221AE2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 ddd2f8ce17cdeac4af9019a02f5d992367fe9ab04214285d887a7c8e549df1b5
- MD5 3a7a664c2bafb61a208261790481b084
- SHA1 1abb943e2db5f1a8d029f1a291d5a9e554c3d264
- SHA512 a5ec025059a8461bddf6e26a828cde0432afa7138cbeb7e2d195adeb2c849526a7fbb10a9e125ca2b4cced1697d9cefc9618be87bdc27df2bfdb8da5cbacf137
- SSDEEP 12288:BHs1IQCZokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:tsu/0pd6FVwwyBH/DI1uI
- TLSH T184E4128B67D414FAE5EB513C85F15622A7F234A2537253CF1B2042AB6F32AC16E37721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.3MB
- SHA256 789001282f1bae477a8818d5b83836556b8aca6cedb11ff63820ae20cec316df
- MD5 720e791b055b4a7c9af5a79b840b9814
- SHA1 87a06ad29a66c66f53bb3f439dbcc412123eb9b6
- SHA512 aae788cdc7d40ff01a15909b16bc629bb17aca234965fe57617a7bc20091065d22bff256177476d9f29f4997fa8abe0032fed5ad4c6c53e5dab7327e80d1dddb
- SSDEEP 12288:u3gThFnDelt5fhWVRZjvKeZAiCa4v7ZllQzUxKb9laHtjjpB6WrMqQpL:1j8eZAA4v7Je3GHt3pB6jLpL
- TLSH T12F55A7E6A3321279581FCCA55A3D68A2542C309F5235D3FF08FD49760672ACE6B2DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 1.4MB
- SHA256 eeedbc2e54b5a7043057738f14250180f812c9d5035b2e8b381a1ff254e7b353
- MD5 36653394f6aaf693e743a13b4729a52d
- SHA1 a426398a2579f14248038b31d58dc9636113b055
- SHA512 3e714f0e6d1bb97bd9222d0f18ef40486daa8c47608305b173d511a4af42b57c04853e3f3ae7c34eb9fa31fd0955e0f835f92fb9c8e30de01ed34686280d3c67
- SSDEEP 24576:iwvx+f6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0N:o68Qg55nhMeWu7PNU3/M
- TLSH T178658C13F2D901E8D05DD179874A8632EA72BC060B25BADF0A90B3562F77BE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.4MB
- SHA256 6d866df3b91cf04a2a45299ded09a413e1c722ef2c016b7f18758439582ef496
- MD5 fbc303f7b472eb5de7096acd4c626d9a
- SHA1 babd6ed7dc507b1e465c58fac6134b8c8609f519
- SHA512 4b0aa65da75dd8662c49fd185caa593bb9fcea063a3ff1ebb4c629e7b772a7e3889272c74862c7dba0df1c14effa038ec393a8a3a78a66d375624fb1f145e3c5
- SSDEEP 24576:SvnQvT3aa6sp0pEnRdh75x0JcB12MksvcwWCXxTTYyJ3H3rW9H1a:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W98
- TLSH T146655A13F2D910E8D05DD179978AA233F972B8494B35B6DF0A508B622F6BEE4673C710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 da77b7327f57eace56bea6cf2078dc7ca64e3178f47f18a6d218049173bd4b12
- MD5 cc46998e5ca40fe08c95f1d0dbb946d3
- SHA1 aa3c19a0e369dd1fdedf979b86b48493259d1013
- SHA512 7a6eabb2631f622318834bc40807c3d9c14853860f28f40153fffcfda64b69f707369d01f1c66fbba8b85d381bf7fbbc90c5858a53e5b939af337ae9cf4834ed
- SSDEEP 49152:8r+taZ3usBWOBr4tEGp0bqx0z+n217aau1glDd6Ha/DIAI:gu6JmTxd2dxBrV
- TLSH T19DD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.2MB
- SHA256 d8207218c36cd87729d660f614356e380af28b89a869c0b4696b764210a5fcac
- MD5 ee5b741049f34e4fe004e494bf035f34
- SHA1 8b53df4cbdb39d89e1fa98885d07a7ee099f7a2c
- SHA512 b5ec56c2b036a39f6298fce6d19a2af7bcc7587fefe93b90bcd012fe16671300e7a767204f0a83dfec71e9f3986763bb4a545695f4abd5c0ab111a08de1903e8
- SSDEEP 24576:LhvKE1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7h:X1hpsNoJpF1A6UU44CwH7h
- TLSH T162458D13F2D910E8D05ED079875A9233F9B2B84A0B35B6DF0A9097522B77EE4673E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.2MB
- SHA256 d7cc3d3d62e1b46f17f74153abc0501878ffa519ec9d944fb77494af72842d5e
- MD5 05d8aa4342d75902f8fd1df3e043d001
- SHA1 1b3ab71564711287e231484c2997c916ecff9a51
- SHA512 e5a3515589fe74330e73fef4b93ee67f95fc33d6bd3305baed9122dbe592e8133b081dfc89660728e8e2fe804e294c7af42aa9427efa9599159b25fbb5319588
- SSDEEP 24576:w8BvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks:ESuZQIY0Be2K6RVtOnks
- TLSH T198457D13F2D911E8D06ED079878A9233E9B2B8560B35B6DF069087622F77EE4673D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.1MB
- SHA256 aaa16156eaa355c1e5d8dc84fb11bdab7ff30ffd30dca9535d983632eb1351ac
- MD5 a980457ff1ed22dfb7aee90143cb9c3c
- SHA1 6ccaad0043b45a94bd4d25004b4dbeb4dfbff374
- SHA512 5a75eaa8e3f9ad23a35661d5a25f15501dbb31197a6fd99dd8ea5b489f3df34c09b0d0293fe86e934abbf63b35dae722ed601feb0a24fab0b1e5fe4dc251e258
- SSDEEP 24576:cb4avtPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5P:cbxSn8EApI0figTgiDn0AP5P
- TLSH T13F458D13F2D901E8D05ED079879A9633F9B2B8560B35B6DF0A9087521B7BEE4673E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 fab386edd004a095cefca8d0089b6f916a615c004b96e1a21542a55ff63134ad
- MD5 1ff2d72a52f04b1ae2772556b9b99278
- SHA1 d5b7b152d496a003629a647d1658bc9beb771136
- SHA512 135f5bae3314ef283616c8f7f02f9b0a5f2ed5a4c947f253f5c2a0d367a9fcaef7342830136adb4580c5b67bc443cd400a13914d401c522162fcc5a88ff3e4a5
- SSDEEP 12288:xZokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:x70pd6FVwwyBH/DI1uI
- TLSH T1F5D4234BCF8548DFFCEF1579027253323BD919A293E26A09AF7451A7EB70111A743B28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 c27529d43f6845bb9d0a143f6c57d9d3818df0dd9eb6cfd6a15b53372dae6ff9
- MD5 38f45250514c6a7ea80bc2c95bb7abdb
- SHA1 3ccf02478e5c6fbb12cdac8822c375987cfe76a4
- SHA512 231550494478e22f873d9d192a1a414645ae1fd6f3c7507cc83277218a6ea5f1cf0e2592d820da969461175ca4a6a00f7e6db2f341094862d9ec3d149928ea04
- SSDEEP 12288:/MokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:/Q0pd6FVwwyBH/DI1uI
- TLSH T1A6D42397CF854CDBFCAF1479037253323BD919A2A2E26A05AF3451A7FA70511A743F28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 d111a55dd2981acd5f10f8e0f4159f7dae43a1d41668c3c8def02ae4afea7603
- MD5 795d6fdb1937fac35b7714a81342403c
- SHA1 558b605ac5222790be0bc0f081ecd1c334259d24
- SHA512 23c29d777fa6325e407a6ab2c2a5410771954870d3a2edbaa020e8d705b765335515f5bc5378ec81ab0b680f094fbb61acc96dbe376ea6ae2aed0c8bd023c573
- SSDEEP 12288:V8okUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:Vg0pd6FVwwyBH/DI1uI
- TLSH T18CD4234BCF854CDFFCEF1579027253327BD919E2A3E26A09AF7051A7BA70411A743A18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 2e84528ea6ee1d54609dd5727bec2c6e619b148b36d82e71e0179a7059029041
- MD5 24ca0b9fe94ece355180a17001775f9c
- SHA1 dd8f4f4e0abe067719973ff3bae1c9a1cb863160
- SHA512 2f66a68273d96ec97d65636f831f61c9aa31a44ab46a1a3226fcba01821f3cf27b980e73908efe9af3720e6632a0369b46e88f0e11e2813b2ddefcb79a8b7d89
- SSDEEP 12288:HlYokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:+0pd6FVwwyBH/DI1uI
- TLSH T1C2D423479F8544DAECEF917946725332BBF57CA192B26B0F9F2001AB6E70210A753F24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 af09afcca6e46db3868c6af3a044ccf9675ad007c746197e9a571838fd5a7674
- MD5 e0d1c645cc216c565b82fd55bffebc39
- SHA1 c76001a26d8a861ccc256fcd88129a6ce0193741
- SHA512 eb2911c8bd543f39396d4ebdc31622e6d6c6393279e41ddb3eb908c2664ac6459cf61dc346c880759eb6eb021fe6a4cb0cce409eb92d3b751f8a95145c6c8bfd
- SSDEEP 12288:k9okUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:kf0pd6FVwwyBH/DI1uI
- TLSH T1CDD42347CF8548DFFCEF1579027253323BD919A2A3D26A09AF7052A7EA705116743F28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 9d6eb8367f5f203cc2467122b4c09fdae2177ffe5240942ee04cc3a3fd1c68b2
- MD5 41bd963924c0bd5a6455287d51e506d7
- SHA1 c113747bc16381ea86a08e7e8ec479b630bf2aae
- SHA512 c853f590bac917d32cededca774713102c16a5fd2f6810ec922b61316d898bd8ee7afc2113c51f67b79ede52b6cbe398771855063896712c80acf3aa1fa00bcf
- SSDEEP 12288:HVQ3okUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:HG0pd6FVwwyBH/DI1uI
- TLSH T141D42347CF854CDFFCEF1579027253323AD919E2A2E26A05AF7052A7FA70111A743E28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 602KB
- SHA256 0ea3a2c11471e258c2e9f07a03333362d03554dcfba67d2f5e56e17dc2c8dccc
- MD5 ce9ca36846c265210f3f6bf417b4cf14
- SHA1 3a496dad99ee753cdd09f49e585caf345cbf9e33
- SHA512 b0bfc763fb326c2eda82c90884dec9e2adc6c53ea0c665bac80af9dfc6abd7105f0adfbf4f418d5f829e1f62bb9dd3e7c2550aa1a979863acc97c6d1e47f5d7a
- SSDEEP 12288:YEokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:YI0pd6FVwwyBH/DI1uI
- TLSH T1C7D42357CF8548DFFDAF0579027253323BD919E292E26B0AAF7051A7FA701116743E28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 768KB
- SHA256 430ba139eea19e98028407cfb40e9d9da81f049af242ecfc04ed2bac290dd8d2
- MD5 912abf0c79f6df3454d8681b71dcec5c
- SHA1 8343b6948385c023b072cc7d86e3a08dff3a3349
- SHA512 004a47f614aad11b9ec15e13fcf118668a9e38e2c9c66813cf62958cdf955b5e3700d41f38624d0992e72a58e6fff28dddfc6b7f7675df680afbcc2b57ace0b4
- SSDEEP 12288:uiZwbCNzDeJSDcPvy7okUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DB:RZMozDaSTZ0pd6FVwwyBH/DB
- TLSH T159F4F195B3900CF9ECA7823E89258A16D6B27C560770CA1F13B436675F333611D2EF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 602KB
- SHA256 7f072768da9b1d78716b08d992fe2ccac8bf629f801120a038833767c66714ca
- MD5 f647ef74952ba2e582e481bbcfaeaeb7
- SHA1 13904987613e0fcf8646024f9d6eb81a4fa9c2d4
- SHA512 2670e3abf4805c4c35440fe3dd5863bdf0477513a9e4bff2fcd491f09626f254f85bcc4451e5e5c45fdca1385f95a84b30eb7ad8148e4788edb08b6cd7f8347f
- SSDEEP 12288:98okUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:9g0pd6FVwwyBH/DI1uI
- TLSH T19CD4234BCF8548DFFCEF1579027263323ED919E293D26A09AF7451A7FA70111A743A28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 602KB
- SHA256 71fc33c12cdf5e8d1fdfbbd250a526701e5d179ec78cf50d6f64f3fa8603abe5
- MD5 728494f86a41389e92a19d28aed1bccd
- SHA1 36a87278ac79c27772c81a829176013f83e872bb
- SHA512 bad5b94a233bfed2922ae51c98d275a1f2798d9ee70dfcb89a35fd65473b348a9c716261009f8a1270a6d9a6642b212fa4da0c6dda7124cf070b56fb0152ca1b
- SSDEEP 12288:3kokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:3o0pd6FVwwyBH/DI1uI
- TLSH T140D4234BCF8548DFFCEF1579027253323BD919E2A2D26A45AF7052A7FA70111A743A28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.1MB
- SHA256 d8949440d57f1f1bb0284db51b0e22c189e23446de8e3fa1308aab3353357633
- MD5 35bcb6ecd1d1117a4ce8bb517f772bec
- SHA1 60fcae94f36739b4f977b3c0e1c85d14e05db913
- SHA512 d15a7f8f0f3d4888f50de52329ab4d57195cfc7e635d3f07da55c7d9fababf9fd65edf2e6a4a59ddbb372ad8b609c3d731116b606e4b2896f42b71452d424f2a
- SSDEEP 24576:e3wvtk9RX6wkyAIW0pd6FVwwyBH/DI1uI:bMnYIfd6Ha/DIAI
- TLSH T1C635D02AEBDC44E5E1B7913C89B34606F6B178691B31C6CF125953AE0E33ED45E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 576KB
- SHA256 23fbe1070415d74cc530cf6922d938d3eb848847b297d0ecc90ecd2b981a3cf1
- MD5 d85561953de19d8c5d9bc9e789f5d5e7
- SHA1 9833fe0e00f0dbde997b89a799de261ca43e6a23
- SHA512 e02bd9943eb3c60cf96ab96689d3433efa5bd9022c835c40af5f27c859bf9382c137a2b2e9df128789bf59452390d85ec5cc65ae1a6b94db1ace80131002b5eb
- SSDEEP 12288:9+PlKMdyytyFjpsTFqxiOyWu/egC7xR2Z:9Yl2xNpsToxhu/dC74
- TLSH T16DC44C67A1A841E9C0BDD0F98F039D1AFAB1341A43356ADB06E645961F37EF0A93F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 3da8474c38626f900a7b9d46f3e30a3c6fd3dc6423da524ebf5601c3d45790ec
- MD5 990ee317a7e22058e640941069281907
- SHA1 3159f0d00229ee1fef8a5c38a5b5e3b7dc68b15b
- SHA512 a5d38b8699f9e0eaf3026d19d9c7fc38d6351804322decc717d7544803d81c99316dccbbd88e40813ea3eb66f53d24edcb9ac8d96bbc2336749f14aac1778fad
- SSDEEP 24576:MQ7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYj0pd6FVwwyBH/DI1uI:MQ7JUQjXirIhCnDHUPfF/Sd6Ha/DIAI
- TLSH T1DC65AE1EA3EC01E5E1BA927885154A1AEA71742E1B31DACF1270837D6F23ED49F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 a8d924097ea65a1d954b27a1aa651650f89380c4941845495d08529ba3c5e4b2
- MD5 938be66e7387fa7d6c99dc6ede52a007
- SHA1 8967229d48c9954729d27539b193628408063f4f
- SHA512 8d065cd42d304b4cb40a38362ef7610faf809bafd6013acc8867d5751ea8f7dc06b1ee2a240c77486d1c0876f86aced6e39d8ce348e21f3d887ff23e6f87e030
- SSDEEP 12288:BKpfWokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:Y20pd6FVwwyBH/DI1uI
- TLSH T18CF4F14AC38801E9D4AE6139C7625621B7B33C6183E1E3CA57D0F57E1F75690AEDAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 dadab132eb282748c0b593ae9b10dbb1caeb102ad1059c3a2f9bc67f30d41bcc
- MD5 a9dcb41e20ec121d31b88d46cbcc3b30
- SHA1 0a821820a6dcf10224b13ee2844a5b83e862cc31
- SHA512 81e9084af93f2865af935dd8ec3cc8a823f37940de4c58694916ae032e87a2867fba1754531b667afb50d36dfea73644b76c69e2982acdeab28cfc3b60d6a463
- SSDEEP 12288:su7ZokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:D70pd6FVwwyBH/DI1uI
- TLSH T128D42357CF848CCAFCFF1538027693313BD925A18791AA87EF2052EBA970541AB53F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 1f8ae53694e1e4486acd8933b828dc718c5c6c8e6d3d1236f021f706274477ea
- MD5 0da5408637da7fe4b1c7b157f4661495
- SHA1 a467591fb0a7a96bea91299a3e4efdaf064f7eed
- SHA512 046841dadf40954c18bab47488400ccb1057aa0b483ee27eaef99dfd341646bbf36c926e4e561045ed3684350b2ea18129e4e3494a6d1a82802dd06b83363e9d
- SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYC0pd6FVwwyBH/DI1uI:ggb4mBIBhGF8d6Ha/DIAI
- TLSH T17D65AF1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 664KB
- SHA256 d351e87c38aab190c1a3a387c4abf85179e60be809902bc9dbea8c08f0c8f11a
- MD5 044f761bbff3bcf083b39325c35720bf
- SHA1 db33b03595393459e569e48b27c47df202d127b8
- SHA512 b5085eeef75a172ab22958b90ae211cd2c3bf7447ce0f5c59448edf4a9421377e530ddfc98e326f4a30bdbcf3ec97d7ab18480dc3f3e7ae89bb637ffd3d30b8f
- SSDEEP 12288:mpGuokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:aGu0pd6FVwwyBH/DI1uI
- TLSH T1E7E4226F9AD564D9D8BF8239017252323AF134A153602AEF4BA091B7DF705E0B737E18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 628KB
- SHA256 438161daa2f9662957b214374244b443dfe6de7c03f602746e9ce3563a2b4870
- MD5 5991bf3abc693da5ad9f235ebab4cf16
- SHA1 f375ffc9bb3beb6a52536a76d69a7a4d4a8e69de
- SHA512 f478738d33bd7a82d8d6b7021659cda02e7756ff24cd84a8782b9372a1db07c79bd1253200635cb1d3ae613f302cf2cd323ff1f545ccb208af46c15f5cbda57b
- SSDEEP 12288:MzokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:Mx0pd6FVwwyBH/DI1uI
- TLSH T177D4234BCF8488CAFCAF1539027353323BD515A153E26BC7AF6052A7A6705D1A773E28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 c69f611effc73242e08b1f9dc73894e63095006f8bfd87819bf1cec29bebf6fb
- MD5 925878145569964ec23b90d44434aede
- SHA1 8da0339a26aab999d67b8cdc469b0ea1c88796ae
- SHA512 00d37d9df0a7b55fdec8556bd6a1023914a306f9d0de3c2b3b11f81c5cb460f7b3ebaf2c14a47ebe58cea7a98e18385ecfee6503db472518cd04a8d9f84ec500
- SSDEEP 24576:2os8f86YJqH1Mzria7/mg0pd6FVwwyBH/DI1uI:jL06QqVra7/md6Ha/DIAI
- TLSH T1AE35F166A7E101F5D47BD1388A524663F6B2B4210360EFDF0BA88B561F236D14B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 832KB
- SHA256 59cad7c789d09d480435833c0614833c755a0476f61347d7e68e7faa039401e9
- MD5 481dd71d982fc1b68e7d2fbaff732086
- SHA1 840b5bd98db31bf826348c8d433a443c28709973
- SHA512 5a8a1928f73ef6b6e74ee6307a36b3c5b6de69937a5dedcac0a2b62a7a6c0dd9986809174558d3605dc3157833c494f6d7c5a3f16b3f32d1154950f9bf2a8c00
- SSDEEP 12288:xHvUrBFrEjwaQ4/cokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:xPUr+NQ4/A0pd6FVwwyBH/DI1uI
- TLSH T1D105F11F66D81CE5F67AA17D85928719F7B174620312A2CF02A0817F5F739E8BD3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 6e55418e30353d1ec3d2122a9aa2c0bf4fa42fa3290184410caf50e6ea6c6fa4
- MD5 85d4ccb25a482bbb234c6cefe32a8d35
- SHA1 2629edcfa88427b4ef376c80fd7d1988307918e9
- SHA512 3d61aab8877961bcd595d465ff739d098245ef02529f41dd419092fe67890479a07b4150d21d8e4a7022d123ecf6354282d6f4d0907f3e98b8e2a02413faafad
- SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnd6Ha/DIAI:NG05lO43b0BrV
- TLSH T15ED5CF6A62EC11F9D0BBD17CCAC6460BEBB23415033556CF02A486A91F27FF4A67E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 eba510d769bff0aae41a3dedabca483b495fa2aafb5f1e1a25d5661581c7a31e
- MD5 ddb3a3cb4bbb240a55e3376e22437a2e
- SHA1 30525a2c6b9eb99bc94b66db6fbed88f333a0927
- SHA512 8b6d0b7d4c891ff2e86eb5e61168211746d3a817fee834e7fa897f15afa66bf3b203a4eac506a7160fb3b94ebfe5ac35818528b38b44eb96c8326238ffb7b98d
- SSDEEP 24576:jTa5POZ3dpbWVM50JicR2hG0lasx2+47eidnu8O0pd6FVwwyBH/DI1uI:3a5POZ3wJt2pasx2+mXd6Ha/DIAI
- TLSH T1E865BF5EA7EC01D5E5B9D17DC583461AF5B1342153329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 03fb38f62d73b129e63d81108752eafbf5adb850fb5e30a1525f97d7b47316b2
- MD5 47085bcc703c8104fbeb73fc541736dc
- SHA1 512c9ef6de1c4978fe1f1b440da992503f2fc646
- SHA512 2c64d4e6cc61c169d28b6607b817f5dfd3b8d4b5e0d952c9c8b46f12893e6f5c9d0e21ba768b7b87ab5bc2f35cec4858717b03835090a929ed8b877edb36dfe7
- SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkF0pd6FVwwyBH/DI1uI:lNc/zEOVHFRd6Ha/DIAI
- TLSH T177858B1623E901E4F5BBE1BE89779646FAB1786553308ACF0291811B1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 936KB
- SHA256 d8678749fdfda5c4ce6b276b45b08a2a221ff8972b9459c75e4f663080e5ce0b
- MD5 7424aba2705ca7e4f2b4129764138806
- SHA1 6239aa158775d4924cccefa844604a7c5819a3bb
- SHA512 1804bc2451374c0fdd43e3d6cd52616a153927c63e22ee658aabaeb84f8f63240ebeab8eb89e346392554492d5e4bc150ec352e87f3717fa68a7a805d9d693ff
- SSDEEP 12288:lJHPJnJP6szeCs6Rl28dxokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4Cu8:jJnJPbzB4Sz0pd6FVwwyBH/DI1uI
- TLSH T19915E13DD29810E8E4B7C274811A1766FF71387D2B2269C719B4D5353F12EE0AA7AF18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 6fe629de56b0e0f59f82e231d80569fd9bdb237ef5891bcd18d32976aa9b6ca5
- MD5 037faf25781b7f748fff39581a51ad61
- SHA1 f61ce839877755f9b277a415141103869a111477
- SHA512 6a64bab07404f7287db151f3b7e522e412209adadcddd22b94273279e4579047ae54dba6201be6da10c94f4f530aeb36006823cbbcdc6eebaa2f5873faaa0926
- SSDEEP 24576:ECLHGL0MoeVtFumTijCmlKQWDkM0pd6FVwwyBH/DI1uI:ECLHGeeV5ijCmlDWDkVd6Ha/DIAI
- TLSH T198A56B05A7EB4184F8F3CAF5CA2294169A327C549B34F7DF4E80CA6A1E32BD1D539B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 780KB
- SHA256 4ce68af56ccc6fe08cb66909fe70f986ef0fcfac400075717beab26fda258c22
- MD5 7f4cb672c780f17f033ae6050253f36f
- SHA1 530cc4bded75748a759e43d1a3b41f56aff1a4c8
- SHA512 34af3963c1ab0481204e3b23ea1e50016b8f7e1c6f38b354fa3895d76e8068871459371eab59f1b82883111f5caa354f6436633e17b746083e6f0a1bef5dc6aa
- SSDEEP 12288:w1HFk6j5ZI7qokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:b6DIO0pd6FVwwyBH/DI1uI
- TLSH T19D05025D636600F9D0BBD03D82930112E6F274B183525ADF4B94C5BA9FB3ED8BA39E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 764KB
- SHA256 766b22aafc7f8daeaf286a1b0b6f4eaa4e63d6b3ea897dd5283dcc88a704488e
- MD5 b713dc3bb582f0f19c68838d2edcec68
- SHA1 f4a4a40f45adb656fd4625be3aa588d259b4b61d
- SHA512 2964ed170de9a6cc67382baeb8e3b0ad573fb4c25b7964142d403b3100e3c0c1d4e6358ae61216fac8ed97f51c7f6e0735f0d2680bdb3af872636bc937b866c9
- SSDEEP 12288:yG6kynokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:7tyl0pd6FVwwyBH/DI1uI
- TLSH T15EF41206978454D9F9BE0238467382316FB57C20976167CF6AA0E27F6F317D0AA32F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 636KB
- SHA256 4013fbd161b3d8060b2571c413d0c47c18e37c7efb39ab9b4729dd4c42b11b7d
- MD5 00c105e34daadb808f0f6b684e2f25c2
- SHA1 3347f8e8eb61f6f28ccd28062cfa53cbc6268682
- SHA512 a6f23d73d1b2af187e32d67dfcb28fd80bbbbd31f55c7abf45934e922490dfccebeb35fd27584228ee5fb3ae29dda09bd67b347851b32e7fb9124affa4dca3d0
- SSDEEP 12288:l+XokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:w10pd6FVwwyBH/DI1uI
- TLSH T1D2D4235BCB8448CAECAF15790232533236E534B157A22ADBAFA092B7DB701D16773F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 851ef61fc9fec260e9a6e443e2bb709332d8429fab54f4eb8ce84b6681fa4631
- MD5 2dff2e761d86f755c541eab318240db6
- SHA1 6b18aa7af6d4d1ae81dad81a7ed5d11c3f41be85
- SHA512 daadfdd885b8c301b39a06d4f9237a25f204145f2af4fdf04cbb7b3648d563559a26f92a44443fc8ca9bd5201db0bdbb1ddd525070c2951073a86d4a46c8a754
- SSDEEP 12288:ftgAHZyFDK3tT5Tr7aVLIH9lH3cpokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHa:ftgAEoTfaidZg0pd6FVwwyBH/DI1uI
- TLSH T1AD559D1DA7EA05CAE2B2D235D9721493D633B4315372D6CF2448C03A4DABED8AE75F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 796KB
- SHA256 98a0198ea86a37621d2d1fca05de5b2944d031f1d6ce9dc2bfbde2c0684b3a98
- MD5 4168ef3cda47a0a180cc77b7c841f4a7
- SHA1 678761d295ee9098f529a1bc188df4bacdae0885
- SHA512 42564d9977a07a30d7b5d497830864cdf568bbfe5de339ba1e5da3d4b500fb747baf55667d4711979bd9e7dacb0b652a1dbabdad16083eef09bfe08f3888bbf7
- SSDEEP 12288:npJcm8CNzbsokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:nrcmRo0pd6FVwwyBH/DI1uI
- TLSH T14105F14FB7AA00E6E1BB813C89524222F6B37071535267CF46A0C37E5E679E97E35B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 03fc020da8895f22c658617007820021110b68b909c8bc4eef88bccca08cacdc
- MD5 380afd678668d6f76726cb63b0f85d73
- SHA1 8a9550b37688a3584910e5885356d170d7cb580b
- SHA512 a8aa98ce7776e01531ea917d8d113afdece1f71e8956893c7eb2e2e3704b0385fc9736c0cb60891370313ca2ebb82bf584ed6fe2fe7d989d4a3ca1d8355a0e5d
- SSDEEP 49152:lDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS39d6Ha/DIAI:m3Upow8sBKBrV
- TLSH T1A5A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 cd63d4d4a26bfd0c4b8c643c0d0761497ca6e3440991dabfa44a2e33fc4c99dc
- MD5 7d70bdc85e4577c6d15ef00cdb3d98c5
- SHA1 1b1f1500a39a8f4e84fd73da70719dc440251166
- SHA512 be1a965be9c65030a378ca059cd14ec98015ce397a408b928042fdca89ae3868377c5c805f1e91d82311f055c84578a3e0187c36cb6b640bd86be815f00e64ba
- SSDEEP 24576:GTkNvNnaFeYhJNtmZBme0pd6FVwwyBH/DI1uI:GTMwBtOmnd6Ha/DIAI
- TLSH T18E55AF6EAAB846E4D1FEC6748D238512FA727461073293CB5390C13F4E279D89E76F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 992KB
- SHA256 f3820dcd132fbf484b800b86bbec755ff12d60981caf439451fd1f306827007d
- MD5 218bee19c1a60adf6f30ca124c99b188
- SHA1 8c526a82d026638d3f2db9bb42e989567e9303ac
- SHA512 fa69f5588a79793ece9521ae31c77e6d1ed855da4b9ae5c19c89955405ae90904915db8831aee0ce17e0200ae932c113e692ce4193c495a5ad1cc72f282345fc
- SSDEEP 12288:fQcMxWDXN1Dp/fshBItT1IQgAgokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3C:nD3FHshBIYQgAE0pd6FVwwyBH/DI1uI
- TLSH T12A25E17EEB9C04E4E47BD17C86634606E7B138A9032266CB06D481B65F67EE47D3AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 772KB
- SHA256 e273680a738ed86b915750686de14d9b418752aece94686405a68a6b0cd663bc
- MD5 4719d606b3547b5990e6798f44b0b226
- SHA1 fb4f77dee77a393eb31fd67bc4f25b88bfac70d7
- SHA512 5867f4bd16d539a28b4a21683568d6dfe8a4279c989a5b743f124d89c5abfaf9d75c37c631f164418e11bd24c690a9e78ff8fd980879defd176da97c4b746953
- SSDEEP 12288:FyG6b3IkxjbBzUokUtpdUW3KwUTEYH5uvWtRMU2gjlW58LgLHP3DI4CuuFGI:T6Uqjp40pd6FVwwyBH/DI1uI
- TLSH T170F4124F9BC458E9F4BA41348572823256E57C7213B266DF77D492BB8B31AC0963BF20
- MD5 SHA1 SHA512 SSDEEP TLSH