Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 10:19
Behavioral task
behavioral1
Sample
2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 920KB
- Sample261003-mcjb7axyfv
- SHA256 9c3e2c1c176dc595530ab72059866228e79aa9b030e69b37a0790cca11fd9279
- MD5 71e06660b29dfc4c7b0c2848f55b59ec
- SHA1 7a0033460ae0f043e16c793e7761248fe61256d9
- SHA512 5ecd1a960968d7ad8754eddae1430956c8d8a3b93061ab982ce3087592779d5a0afe5f68d00cdbbee4abe3685a729df1472ee4596fec55b37ab3d7cbd13ec78d
- SSDEEP 24576:pqGG/NBZ33oiOFB55IMbL80k000XpKYwd+ciEXdq:8GqNBZnbOFB55j/300XIYwcmXM
- TLSH T13415125176C0C4B2DE23593089A18AB168BDFA311F244AEF7396673E2F357824D38767
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe -
resource yara_rule behavioral1/memory/2572-0-0x0000000000D70000-0x0000000000EB2000-memory.dmp upx behavioral1/memory/2572-13-0x0000000000D70000-0x0000000000EB2000-memory.dmp upx behavioral1/files/0x0001000000016ff1-208.dat upx behavioral1/files/0x000100000001703f-212.dat upx behavioral1/files/0x0001000000017bc8-216.dat upx behavioral1/files/0x0001000000017425-220.dat upx behavioral1/files/0x00010000000233bc-231.dat upx behavioral1/files/0x000100000000c50f-236.dat upx behavioral1/files/0x000100000000c530-240.dat upx behavioral1/files/0x00020000000219cb-244.dat upx behavioral1/files/0x0001000000017ebc-248.dat upx behavioral1/files/0x000100000000fa5e-252.dat upx behavioral1/files/0x000100000000c3f6-256.dat upx behavioral1/files/0x00010000000177e4-260.dat upx behavioral1/files/0x000100000001780a-263.dat upx behavioral1/files/0x000100000000c8d8-268.dat upx behavioral1/files/0x0001000000017848-272.dat upx behavioral1/files/0x0001000000017eb6-276.dat upx behavioral1/files/0x00010000000178c2-280.dat upx behavioral1/files/0x000100000001702d-284.dat upx behavioral1/files/0x0001000000017971-288.dat upx behavioral1/files/0x0001000000017990-292.dat upx behavioral1/files/0x0001000000017996-296.dat upx behavioral1/files/0x00010000000180a6-300.dat upx behavioral1/files/0x0001000000016789-304.dat upx behavioral1/files/0x00010000000177be-308.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2572 2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 a78536c00717479f7812c66b136751fbab09e05ab7a9db19bb51242f917b756a
- MD5 6b10ec6982b09acf07c86ca1b3192f66
- SHA1 f4a3b1f9c4f320ec2271b4ef93a3867e7444cf2c
- SHA512 9955ee64c34a590f7b3d62d0139df7a6c666fcf710eee50bee14c8b3ef216095c6c5f6ac9ad6b8439fcb5fe6283ceff27b5134ce0f7a7a2fb0ef421f79840de0
- SSDEEP 49152:9b+6C2BuPkFKRrdE6oh7stBhuXjfS4LWxn3bOFB55j/300XIYwcmXM:DCq6gjBXxhk6IX7c
- TLSH T184E5AD03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1021KB
- SHA256 ec9b4cfc81f2566355e539a74bd37cedf9385267e17fc091f7a205b225ad59ac
- MD5 51e62cb276344cd3c17a211d27090e51
- SHA1 8c4cb02b2de426192f85076497a9239840319a40
- SHA512 faaf2c96ee69835a90b131096fe5538b57e6610d83d8e0efd4bfa9baf88f4c3016715a30d30c817bfc01c37ddb3b090a8d3af6c48a2bdf2c5a4d32e1cca0b935
- SSDEEP 24576:qXYpf8czAM3oiOFB55IMbL80k000XpKYwd+ciEXdq:L8cvbOFB55j/300XIYwcmXM
- TLSH T1E0250269B7A409F5ED67C27CCCA28502EA7378524360E79B03B4D9391F237885E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1001KB
- SHA256 e04e1d9ff9aecd4c4eb9404d2c79eee6e61c534b638ef6b63fd84343f46f3127
- MD5 30c1dd8cc840b0aac1c2962bcb97cb3f
- SHA1 0be9307f107427e82ed4d92a5eb29af69d940af3
- SHA512 6a05b2ada2767315ad3931a2d8f939383f91be3d18f326049cad0fad3b1d6627e246fc872df0c62da35d5966a0d6999c28ad06d86dadf4a64464ef77ec5ec7b4
- SSDEEP 24576:OwurOWM3oiOFB55IMbL80k000XpKYwd+ciEXd:Ow4OZbOFB55j/300XIYwcmX
- TLSH T1AE25028A77A41CF5EA639638C5878536FBF2B8122620DB1F1771C66B2F273116D2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 9461c9100cbf16f131d8816a64ce975ba52cfc2da9836c0064603e785c7df5fa
- MD5 b72708f28a058378134e62487f225686
- SHA1 5485dc2fc3d35ca4c2eae6b2a6c8684acfbe4669
- SHA512 43045db21ee9202faf0fd1dbc2a7ae1e25d9f19229820474da2633b7f6b0ff6784815697ca10a780839bceaad8eb0ee4f5a81703a45b2f9d39ae0d83a1ec0d5c
- SSDEEP 98304:CQRQyi36YOcP8Lvw2gAf+PN31KmlsfFag:ZQyiKa+X+PNwmlWag
- TLSH T1B4667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 cca82e8411ae688d25e20261b2b58fd4ca6da10ac1a2c3948c567f6244011821
- MD5 2df8070f5132be04512a36045ae88803
- SHA1 c7779d337344888102feda6f73409c143f880192
- SHA512 12a747d3e68e30578029c89aa1ffea5a32a418e5de5bdaf3fd95e2962d5167b51f7bea5ef5770c5bd5763e4ff20a1fd0cb2546fc1a33ccebca877ac4ff4c49a8
- SSDEEP 49152:Wu+taZ3usBWOBr4tEGp0bqx0z+n217aau1gltbOFB55j/300XIYwcmXM:/u6JmTxd2d8xhk6IX7c
- TLSH T12FE5AE13F1DA01E8D05ED578974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 29badcb1170641c5680cb457943ee1fb82e24488f42eeca33b406c38b48dd5a3
- MD5 a5fc4a8834e04f77525d4a79e56a1a59
- SHA1 d416e05e11e8f0f3b2e66be9b941a4760d1a4083
- SHA512 de897039f8f43624ea325a33448233fe66933975eef5b21aad35f3d5adfd5153f2564ef53302e040275a3bda46d95f5e1703ae38811219143aee22c57cb800f2
- SSDEEP 49152:WP4m4IpOO6768KrvUDjJl2bKzZ6u6cUOyDS:OppOODRvUDjJl2bBu6hOo
- TLSH T1C985CF2DA7EC0095D0BA917485658A5AFAB2742E1F3286CB1160933C3F77EE54F36F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 782KB
- SHA256 2112eda9883c24787e4b9df29a1ea7ee04c8d4d6a6d35231ae2d4c6fa461bc43
- MD5 74f99947c00d4df40728ff7a67c4e519
- SHA1 3e9128d231c06295670c0a06c3b7236a2c77de6f
- SHA512 dff6d46dddb39d4367bc30490f0229373742e87ef1535e7bfe6f3e66070368ec3bce281caed0581b0de0e95ade1c4266e61551e4ad9b57ebb80fb67ddcda43e7
- SSDEEP 24576:Qn3oiOFB55IMbL80k000XpKYwd+ciEXd:Q3bOFB55j/300XIYwcmX
- TLSH T1E00523D6EA2DAA71EF13EAB0C5470896B8BE13B7061095EDBD23F479231FE014D1471A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 848c49605aec095df996f49558de203d70aa86faf68e8fd5fe8403c380cb2a9f
- MD5 89aaa6aa86c33041c891b18a245e5ae9
- SHA1 426507703a66a1d7af1b54db4dba70a7bf1b2240
- SHA512 69a1788d2312e224c1cec73c4f08bdf426b25c7d25d5c263733031808912a0b1bdcd092c955f76bf8f85543889d6386d794dcbb2ab0a35c785f5d5a2956b93e4
- SSDEEP 49152:da0h2GEkuAe73q3ppt6zwwQ7vUDjJl2bKzZ6u6cUOyDS:da0hNYGtJwkvUDjJl2bBu6hOo
- TLSH T1C795AF1D76EC82B5D0BAD278C9A6814BE7B2B4261B3156CF1150853D3F37DE84E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 884a6485e61ff21bb95440cb6887ca172f2c7eb57c88de913a167f78e8b1cc52
- MD5 818e7a265e470842622b75027d963744
- SHA1 a89aefe1cbf985431754f451d9bed6c7992e170d
- SHA512 1fcfde088987146212154f6a9a6b23196e4953ddb4908cd53e5bc528918b1e3d2e2e8fe175e5c53791f1b8725a66afe37ea61e0118979df9f351ab241bc30ebf
- SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYhjMqbJ3oiOFB55IMbL80k000XpKYwd+ciEXdq:OTDxR+N5YzTTjMabOFB55j/300XIYwcp
- TLSH T1E775C02EA7F955E5D1BEC5789A238502FA727861033193CF42A0C17E1F2B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 852KB
- SHA256 99d112f685b06408188fa1367e90d756fda08d859119fd62f629b04e235bbe26
- MD5 ca1c319ed933740016dceb187c8d49b4
- SHA1 6212bad61edd1c303dc5cabe553842b7bf89416b
- SHA512 bfe4844cd123ce3cb2c333fd7d206f074ddcf92c1696b2a2773a76b1c318e9959f103f213820887f2390c8495f3ddf2f45f40dba85e69baf3b5f4e521a48d9c3
- SSDEEP 24576:whbHjP423oiOFB55IMbL80k000XpKYwd+ciEXdq:whbHjJbOFB55j/300XIYwcmXM
- TLSH T1DE0512BE666C21F1EA32E2B8C5424946E7B179761710A3EF2693C17D1F2BED40C38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 d99999a26b11f6d7cc538c37e31c467965d9d9d9699d6d6cdd7f407513009296
- MD5 8284aa139e772d4d941e6c11860a31f9
- SHA1 93330e4edffbb55829b7845392054a59dd53bacf
- SHA512 36a030531aa38926a7061a7bfaac31b6960665cc56f6e3a52bfaf80794b6825591a219d4f0e67be00afbf9feee1a2121478e31974d213d43d37ea22a5812b2b7
- SSDEEP 24576:vOegnJcRTk4yti+R5dUR/u3oiOFB55IMbL80k000XpKYwd+ciEXdq:vTgnaTk46pUR/GbOFB55j/300XIYwcmc
- TLSH T1A865C02EF2B910B9D8A6D536850147B5FB71782E1F209ACB0170C538AF0AED85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 771KB
- SHA256 145b2c11ab81a415cc2278ed7f780c8854b15f936008c6e84388d3954c2a7b8c
- MD5 5c4e038fd755527ca41f611c9e81aed0
- SHA1 2c17af5ab198de09998a358d4d6d180ae782e2fb
- SHA512 6f16a2dea5ff8ccd5e9871636110d3ab214d4d5b83f0df4b2203f7a6af012e150529d9fd2b99b4852285d2745b0f24838eb742c737c66afe0193fd9d8b690ee9
- SSDEEP 24576:2S3oiOFB55IMbL80k000XpKYwd+ciEXdq:2ybOFB55j/300XIYwcmXM
- TLSH T129F423DAEA29AAB1DF03EAF0C54709C6B8E903B711145AF86D77F879230FE050D18759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 54bc372cf300c48164c74fc49f6cd8166098d525d972c56344b618ea3f3579dd
- MD5 8b2ba0807cd6cf9c0437dcfc7af3ceae
- SHA1 d9cd98d03da796e605889a879f1d9495784015cc
- SHA512 14bda8116349ec0856829dcdac6f35c7d3155911fc54477dddede961c9b53ef976e133e58fe467fcf4af645b86ad1c78453b6f4420e05273b35fcb5016cbfc0c
- SSDEEP 24576:4HL3UTYvUbm4jWeoy2b6zzZ52Hu6cUOLcfDS3:4HL3UsvUDjJl2bKzZ6u6cUOyDS
- TLSH T18F350154F2B500F4E8A7913DC9AA8523D773746D07A0E7DB03A84A591E132ED8E7FB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 864KB
- SHA256 c2f1ea8182ce8b072da8320ae60b2f73cb138173712e9cf12b418cd2aeff1d37
- MD5 159fe3eb4a808fb51782de047740b693
- SHA1 c5b3e49b72b8e78d6e56dbda278cc075da3c5344
- SHA512 372b285b5b50060ba30a2231d18c83e559a03934d06ebd78c4f3a5470b693d787c1f79469961df1f24b9482a7cd8e3b2bda3bbf834394646bddf53bca6c7f073
- SSDEEP 24576:pOS3oiOFB55IMbL80k000XpKYwd+ciEXdq:pOybOFB55j/300XIYwcmXM
- TLSH T15015125A36AD20F1EA26E178CA83464AE7B17477072057EF06A2C07E1F17FE85C39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 d3efb7c351da441664c7e2950ef0b0599915efb64e9ed62a7fc6d8c8d94e6b6f
- MD5 8085e0e93b0bbbc48d1360999312c9da
- SHA1 04e20351fceea4ce25630a507db5c48d3af41308
- SHA512 57f45a86691a5385fc9fa6cadfbe85b11692dc13d91d11445c4f9588421b2bea3871dc953d2cec54f5ab63adb42e17ec070d36ce9db61333aebd2f9a8295f406
- SSDEEP 49152:B7cBWMpPjN8DbEh1vUDjJl2bKzZ6u6cUOyDS:OxvUDjJl2bBu6hOo
- TLSH T1BC85BF2D6BEC81D5D476D13DC9E28246F6F2B4611B318ACB1152433E6F37AE84E36B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 b3f9a01b8e99dda36d385422d11bcea10fbec89f822c85873266229000cd0986
- MD5 fbc2eb4315ee41d20823f95451694e52
- SHA1 c6e23f3abff476fdfc64c8f2910ba7dc1bac4009
- SHA512 19800f1b0d04a4737a3252fb4ba0997e34951a4e1527cc588766ba55a42f694de8b4d405e9b5fa993992c49985fdcb5d7649594c76c1fff22ce6216d418fc82e
- SSDEEP 49152:1F2YuHNETovIvNYf8kmKbOFB55j/300XIYwcmXM:Q6ZCf8k2xhk6IX7c
- TLSH T140959F6927ED80A4E0BBD27D85B79186FAB2B8511B3056CF0255862E1F33AF44D3D732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 007b954f05a551be2ffa01f7bc64eb428c971159706925c3d143d49a2de51568
- MD5 f51a26678ffd39f8cc08e8f1d7498d2a
- SHA1 237cb96dfde126f0cdc324ba51d84ca062cdd8eb
- SHA512 a5733177ed6c753247add0804fd16488c47ab1cc0d0e90cedc9c5a19b9a8dd61561dacd9eba16e136801bb13d30f0441554ff5bfea50c8c921b5780cb1744330
- SSDEEP 24576:iTMdOz0FFS+HmSLc3oiOFB55IMbL80k000XpKYwd+ciEXdq:u0K+HmSLsbOFB55j/300XIYwcmXM
- TLSH T15835F17EA76D14F5E93BD27CDA438906E9B234620321A6DB06A1C0793F5BFD43939B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 aa0456047f8578028233f703d5e0445d7b7b790beb71b9b849699ea62c22ae4e
- MD5 d74349b3d65b0b824ae151f4f73bda47
- SHA1 b752c59fc32367e7bd12500c64735a5e31c7d98e
- SHA512 4af5b769b3d9f6bb026e039ff9a7ba8f49afa7a9e68ca8213ed192550bdb574666ac88f6116c5467f841f21986c1d2bbd46424b32768c363ada97f4e0d2c3999
- SSDEEP 24576:aAFs06+OmlfzNXEbToOvUbm4jWeoy2b6zzZ52Hu6cUOLcfDS3:jFs060lBXu7vUDjJl2bKzZ6u6cUOyDS
- TLSH T13375BF2F62BC00D5D07ED17E8996C916F7B1746707215ACB0260863E7F6BEE85E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 a03440378dee2961cdcd91556b6ae67fd0931b89d1c77e1a81e85c38a68ec128
- MD5 baa2bebb004bd7abfdbc0d50ced7f4be
- SHA1 6ab5548f06f5ce08b1126c13aed3b0ec75b5900b
- SHA512 c27d410ed91bdddf5e04b1fa1705f1ab7f05d90698d153e943c5e07690172252da61a37333aaa284b4643e3c6ea5738c3e41aa3d734dcbc5159b122f9311db72
- SSDEEP 24576:/JnJ5D3W2KvUbm4jWeoy2b6zzZ52Hu6cUOLcfDS3:/JnJ5DG2KvUDjJl2bKzZ6u6cUOyDS
- TLSH T1FE35F12CE2B810E4E4B7C2B4819E1796BF72343D2F6169C714A4D5353F12EE49ABAF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.2MB
- SHA256 90cc574802279e99143b1ae5c5779cbe9b4f2724affd0a6d896492ec0bfacb1d
- MD5 27f5026b9cbd7cc304f357027c43ca1b
- SHA1 10480b4530de864c15dfb78eef6a3146e79df2fa
- SHA512 7256a8c50f1d98ad57a6b6dd9f30a4ba64b97d02e0c625ed79320fe5bc1cf18492c2df3faff7b3dff26d9750fd2bd9e56bcf43b231a6186de6b39429e084ffbb
- SSDEEP 49152:aF06DIKdwc+eQnSt65aV0vUDjJl2bKzZ6u6cUOyDS:CqvUDjJl2bBu6hOo
- TLSH T12FA57C15B7EA5294E8B3CAF1C962A1169B327C509B34F7DF0AC0C92E1E33AD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 854KB
- SHA256 5a5e0761445aef7df56c0467f6c0ba2df447bdcafb0872d4cb6f2e6fd175b90e
- MD5 876d628d035abe2544ec3624f3f39efa
- SHA1 8ae554fc0da69a515a93455dab14615003cb322a
- SHA512 a004401c7f8ef8090b0a0ee009269813ce63d2a0ab00544bc4e00352e733ce869f11c4700aa1eca433608e32d41aa69275bb86922c1c7ccd5eefd2620f01bef3
- SSDEEP 24576:yi03oiOFB55IMbL80k000XpKYwd+ciEXdq:yiUbOFB55j/300XIYwcmXM
- TLSH T1CE0512AE6B6CA0F1DA26E178C5824585E7B2B072171027EF5AA3C13D1F2BED51D3CB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 905KB
- SHA256 496c9460121ad9ac388fab464ac02e972c33b3d282d67d89eb1109c40150b84a
- MD5 a3b7fc0ff51202b0c2561b818f3851ea
- SHA1 81130450227d1e094f6b932b15cafeaf9b97ed35
- SHA512 f0d0385c946b02559cbaccfa5ea6f6f62f547405f9877d9460a1bf8caec4c4790aa4efff7f0bd51b365f668bedaa940158bd5ea9bfefadf2fd6406033715f60b
- SSDEEP 24576:eIyP3oiOFB55IMbL80k000XpKYwd+ciEXdq:eI+bOFB55j/300XIYwcmXM
- TLSH T18C152289A318A5B0EE669674C95305C1EDB57C321B2097EF64A2F53E2F3BF805C34B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 828KB
- SHA256 d95eea66062aef183defd62dea26275ccd6b71f04c911604e4083967e4338779
- MD5 cf45e86d68a2f2713100a99330c7599a
- SHA1 2cbc851ce450eb6d4c82fce3d63aba2509034855
- SHA512 4db748f56b84d292030223acc417cc660bb42196970f0739cbccd08e9974b66f89665178135f66dedfba8d19a369343d9d8bfdd6854122d3e75dee72effc2f1b
- SSDEEP 24576:D2u3oiOFB55IMbL80k000XpKYwd+ciEXdq:D2GbOFB55j/300XIYwcmXM
- TLSH T1AB05229D67A874F0ED23E670CA170586E9B07477132466FF39E2D47A1B2BEC44938B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 777KB
- SHA256 624a5f7e7f007637435819b331506e43ec505e1c1156e0e8b08f306bdce9cb2c
- MD5 1734a0528da42962ded942d59ecb78e6
- SHA1 93d95352c8b71cb63bac11073e2e87c34bc367c9
- SHA512 7eed51dd487425b34e87c899fe4079d44de0e8784829ffdb31af4beb87f27487ced6415ffa4eb9b3c99b01cedef5822f96ca3354d61c1800bc787612ba0d038f
- SSDEEP 24576:b/vUbm4jWeoy2b6zzZ52Hu6cUOLcfDS3:b/vUDjJl2bKzZ6u6cUOyDS
- TLSH T1D705236431B61355FCE165B7E5AE51F30BA3733AABD021AB82C0296959210DD8EF7CF0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 b9f6a987cdf8b3f97020851b8358a87199219e2fe85ddbf15f99e92486b1fa38
- MD5 172ee5fd9f229cb2f5d6634e72194e15
- SHA1 6fd7b88f23fee273f8d60440f10951860e5d877c
- SHA512 9bc8887767b3b0743ded6a0b5dcb245fc5126ae5cd399e6f0cd8f95516cf72f2f24eba680897a60dd6bd1e6d5f30230684b88253f50be6b5812330d303713dad
- SSDEEP 24576:UQ9MxZKdcz9ew3AvUbm4jWeoy2b6zzZ52Hu6cUOLcfDS3:UVKiAvUDjJl2bKzZ6u6cUOyDS
- TLSH T1F5658C2DABF9058AE172D279D4A650C3A673B4311B71D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 966KB
- SHA256 4b07e0cda53320a5c9ac88f894afdb903a42ca61d35df6d2c0fabe3f5cf17461
- MD5 70b827aaa394bb2c05ccc06896b91b5c
- SHA1 6966526ec450bf5466699295b20fc3667e88df71
- SHA512 ada5b73536120e98453f8f33e7a99b9039951ebaceacfa3f5347281fec57cb49e63421da4cc0ad26da60f7b71fc0b3b20acc07bdad27e0ffce160a97e87cefcb
- SSDEEP 24576:gyoc8ApYvUbm4jWeoy2b6zzZ52Hu6cUOLcfDS3:toc8ApYvUDjJl2bKzZ6u6cUOyDS
- TLSH T1C725F11F777A41A1E0B2913CC9898296EB73B0345BA163CB5280873D4E235EDBD76F61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 1c92cc03303a9e324a3548f022e002af6907081e2cd5faf0d27a763ee711e0d8
- MD5 13cade29a4578493a9122c6a9b214aad
- SHA1 30966b7f925ed8d5dccdcaa6f5b546fc50520016
- SHA512 e8d67c6d664c95cd4d0deaf05aa94f0f341dab18c25fda9acabd9b8253664522832bb5df6ad54e7c40789917e33ca82ed7d1aceb152c836e2db863b5d5391c7a
- SSDEEP 49152:QWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKLvUDjJl2bKzZ6u6cUOyDS:C0zuNILvUDjJl2bBu6hOo
- TLSH T133B58C3DA2B800A8D8AAC375C54513A6EE72742E3F2015DB01B0C57CBF2ADF59A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH