Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 15:21
Behavioral task
behavioral1
Sample
2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 917KB
- Sample261012-srtdlab12t
- SHA256 d559f50c810e9a57777a51a17963224fefa60c2156e31a00232f70eaa3b89e79
- MD5 9884441ebbb436804f761984c7c83d88
- SHA1 5650c90c660b71190b9514ee1953104f53f7a3fd
- SHA512 d67434c51e3509c09803d8e5b7512fc725153afd2072ce1fef5eaec11b12b3be07956b0fc5905ae8d3a6e765f42e5b13831f3a18a30a53c4a084a7898cb54ac2
- SSDEEP 24576:/VGGTZBZIEAxUi62B0TFUrcTb8sOQd0Lg+/niF:9GOZBZuUi0yrY4xLGF
- TLSH T14315121131D0C1B2E9B35A3416B49A315A7EFDB84F70999FA3841B6B5F702828938B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe -
resource yara_rule behavioral1/memory/1340-0-0x00000000002F0000-0x0000000000431000-memory.dmp upx behavioral1/memory/1340-13-0x00000000002F0000-0x0000000000431000-memory.dmp upx behavioral1/files/0x0001000000017010-220.dat upx behavioral1/files/0x0001000000017066-224.dat upx behavioral1/files/0x0001000000017bd3-228.dat upx behavioral1/files/0x0001000000017430-232.dat upx behavioral1/files/0x0001000000023463-244.dat upx behavioral1/files/0x000100000000c517-248.dat upx behavioral1/files/0x000100000000c538-252.dat upx behavioral1/files/0x0002000000021cbc-256.dat upx behavioral1/files/0x0001000000017ec7-260.dat upx behavioral1/files/0x000100000000fa67-264.dat upx behavioral1/files/0x000100000000c3ff-267.dat upx behavioral1/files/0x00010000000177ef-272.dat upx behavioral1/files/0x0001000000017815-276.dat upx behavioral1/files/0x000100000000c8e0-280.dat upx behavioral1/files/0x0001000000017853-284.dat upx behavioral1/files/0x0001000000017ec1-288.dat upx behavioral1/files/0x00010000000178cd-292.dat upx behavioral1/files/0x000100000001704b-296.dat upx behavioral1/files/0x000100000001797c-300.dat upx behavioral1/files/0x000100000001799b-304.dat upx behavioral1/files/0x00010000000179a1-308.dat upx behavioral1/files/0x00010000000180b1-312.dat upx behavioral1/files/0x0001000000016794-316.dat upx behavioral1/files/0x00010000000177c9-320.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 1340 2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_9884441ebbb436804f761984c7c83d88_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 667f99df1058b438169768bb414cdc54639c15919783e0263529f6884361d807
- MD5 ef16496c43eb65467b1896b1f83c39b2
- SHA1 511389285a65953a990c3707d17b1180f3b89a6f
- SHA512 90953b726b22e4c0851c1a4a1aff5b34839be31f5710da28aedeec61c9a5556fc52fd60191ac901248eff1a749abeae465107e753d4fa5c69274b759dc23a78d
- SSDEEP 49152:Yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnlUi0yrY4xLGF:y3q6gjBxv4xL
- TLSH T17FE59D03F29901E8E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 316d53b4be3d1f1d1569a6025551ad116519dc567d13724c4e82a60cdcf16354
- MD5 9eddc5d127f88ade719ed8397fda39aa
- SHA1 7c1bdcc96092cd0c83d220e230fe5684c5007918
- SHA512 d941cfa79fab274fe5e2d9a6babdb132320893ac640a9427f8ae57a6fc3d0058190fe36581935b90a68c3676c4008d393ad60daf6d7cf796601015239b117af1
- SSDEEP 24576:bXYqjXczAKEAxUi62B0TFUrcTb8sOQd0Lg+/niF:tXc1Ui0yrY4xLGF
- TLSH T1C625022877E049F9EC6BC27DC9B28516EB7378894360F74B03A499661F233885D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 75d2f28802b650ec94aa9a7f86a30580ea56d67a7fca3f54106e3127d6ee1fb9
- MD5 e0d2af1d00a50644d3391785ccbb8e30
- SHA1 8c02e948e68a3e08c3eed21b62b94fefbbf26b11
- SHA512 bb180b55aa2b1c347c94b191835dcd23b97d21f1bd2715ad7c15f254f29fa5821b47a43ebfa375d5e5bcb0e1a1d70b5017dd2f5f5a27550a0a80525b0a1d9e9c
- SSDEEP 24576:3wutOWsEAxUi62B0TFUrcTb8sOQd0Lg+/niF:3w2O5Ui0yrY4xLGF
- TLSH T15825024A36A40CF9E9B7923986A7C536F7F2BC452621D71F4360C65B6F23311AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 b26b672ce29267d0cfa532a384e0db94524fd5f8ab99b192ae1d133470327e93
- MD5 2d10dcea14d1c034b95ed93039f00844
- SHA1 844454257679bf001ad50c5089845f1439dd64b9
- SHA512 955984ac9560a04c3bea72b88354777028071b5a8411f4d62ae6ca2276f1ffc497e287d3029195cfac253bbb5678c518a46d3995a7b09d0d332fea1bc8716d11
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Um:yQRQyi36YOcP8Lvw2gAf+PN3WoOtAm
- TLSH T1B4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 8d6ba99360b2c40de299cc58e480dc770d80b55f03290caad3f2d59d5eac4548
- MD5 268d6fc6839f1b33fb77bb7d823724f4
- SHA1 f3a4a7ac24d746db4947770c66517551c47dece7
- SHA512 95007e25292e06a7ac18843ecaf16131a878f760dd74cb8617fdd1e08e59f68f076ad7f1e7de7b50961b11a30d7cff71dd91590b0cc8647306c80332ea7e7147
- SSDEEP 49152:5B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glpUi0yrY4xLGF:vu6JmTxd2dKv4xL
- TLSH T19EE5AE13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 2002cb1bf0e778a8c8627ef9f2985e59bf125ebb024ed93c98bb9ff06ca2e599
- MD5 e4b73c1b27821605c747550df30801ee
- SHA1 f255506337311d060383a63f096d05a0174e23eb
- SHA512 155839f482a9cf5fbdbc1686bf8c9c0a0414948db946d340a8d3d513dd67eb6b97182e69af2ee0ba209bbab42c7178214010f85b9115086d04716bd86a2a3719
- SSDEEP 24576:/cP4mcvIjkGOxhKP2l71zNKbrh/8KBKmn/tpattF774DzhY8AhYikM4HfN:UP4m4IpOO6768KD/t4tn72ztA1eN
- TLSH T15585BE2DABDC0096D0BB917485658A49FAB2742A1F3286CB1160937D3F77EE14F36F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 ccdf135991f553167760e79ecdf628ef7c63de440d991827cf49e7d496b4bf7c
- MD5 ba3f340f226d5a79d1a36b0f7aba4680
- SHA1 9d4d99cf3e3bf7c44605e1b2305fdf2f814ab33a
- SHA512 5a1e220b241e277b6c2b711c811348b4e7e727c48e1056984b1ce2d3cefa327187a4a3ac19a548a69a915501c5c2e77f033ce918884a1f4e8c5a187e27862322
- SSDEEP 12288:LGWEPnpOTIyU0o1Q60PRkOboxKOCxa/alRrfv8ce608O5OQC2l1qL9G+fnnNs/qI:LVEAxUi62B0TFUrcTb8sOQd0Lg+/niF
- TLSH T1E405335A3560D334ECFEEBB9137696391E2BB9CCC650F50FE309A9A76B60106407876C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 cf3d2b73c0495c796ad99b3aae2303bfa66f4b8724e64a0fc44716452f442971
- MD5 3d8859aa813da4723a34558dacc65d25
- SHA1 a9c462ea9be64566637f2371e2bb778be06070b0
- SHA512 ccd8922ed93529725fb65a5a7aa46efff1f7e20e4165e3f06e9fe7ca8ba625448f9b7cabe4253450fd01ef9aff1976bdd535a2e473ea8e3c2fa06b9f9c0f62df
- SSDEEP 49152:Ha0h2GEkuAe73q3ppt6zwwQP/t4tn72ztA1eN:Ha0hNYGtJwKoOtAm
- TLSH T1B595AF1EA7DC82B5D0BAD278C9A6814AE6F2B4260B3156CF1151853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 4b09b882c75867309a466e732f753de97b0f2f27182e92bcacd293ec2a3f34ed
- MD5 15bfc9a9b6a5a8a6f1b171956d26fea2
- SHA1 3d32793a6949463490a72815711e88576fe6fbb4
- SHA512 320bda236ed7672aa2e6f55adf65dbfca3b218d511f557c14a34b26ecac2716db950d2dda6638e37bbef376458b814283efdb0e20ef4d6283576138a627cab97
- SSDEEP 24576:X1QT7EcpfxR+N5AWAz3ooiYhjMqbGEAxUi62B0TFUrcTb8sOQd0Lg+/niF:qTDxR+N5YzTTjMtUi0yrY4xLGF
- TLSH T11575C02EA7F805E9D1BEC5799A23C512FA727861033193CB42A0C17E1F6B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 849KB
- SHA256 90e5cb921b689666dd3e77e90193e96d6a6ab652751f4b335839bf9e04db12a5
- MD5 718407ced1f93ddf40171b5af5b26750
- SHA1 467046c38d23101069112229a53c268d0431bf5e
- SHA512 c97ecb553d811e9f7b4f50ac38963751caff63e94cc5b1423ef3a630478883be6a8338f4aa230c7b64a0380741a1bbc84f51962dd623dc11b39bd610f100df53
- SSDEEP 24576:yhbHjP5EAxUi62B0TFUrcTb8sOQd0Lg+/niF:yhbHj1Ui0yrY4xLGF
- TLSH T16505127E36AC12E4E9B5E27D96A2460AC731BC9D0311E3EF5391827A4F27AD50C39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 36ae24528bfb2e0b9c42808b7a40171531616bbdcf20728fee5c5bd5bb717f56
- MD5 4a66de355cbef22908873ff70b77c736
- SHA1 3d3640740d26a86fe0697203db9580bca0ce9cc2
- SHA512 be1d7b29b69601622ece3eb7aed2fc781d8a4982b6c2c36515360665cf9bbde3d81aa8a4b82f9d84d5770e5a777a00fc909c4696d101ff88e6cd566e0fce0018
- SSDEEP 24576:QbJgF1cRTk4yti+R5dUR/DEAxUi62B0TFUrcTb8sOQd0Lg+/niF:QFgFmTk46pUR/PUi0yrY4xLGF
- TLSH T1FA65D02EF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C539AF0AED85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 767KB
- SHA256 5c7d475ae9a2d2d9eabfd0a1e7df028a9b64db3f07c9e1539815247794995c82
- MD5 acfb0f52335d434553e5f912b0ac2911
- SHA1 67685406a63f8c2ecc27983e23d70c725fd1511a
- SHA512 71505a81d14438b34453b9b51546386e9025d28dc61025437b2e099dcefb67ea828edfccc5687f90edab760b5aebbd850fb350e2000ba94c575f80fd38d70776
- SSDEEP 12288:cWwm33/5npyItoRXtwI774DGv9XEDlYwIWQk6FzC3cfYumckU14i6bW6jN:cWwmn/tpattF774DzhY8AhYikM4HfN
- TLSH T193F423DADE4590C9DED394B21DFB3005D3E7B916532B0A6A0A802CBD56F5F23A22F507
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 f4b0848891852494bbc02b29b04b8c79763e59734fa45978155972e0bde3a382
- MD5 917dcde08196a281ed89aba69eb251b7
- SHA1 3e9e27d1635523bd1d25adcaa2f9145d8ac28c44
- SHA512 406263752394d6470e9bedb188f9e9eb1135d7bdc985aabc8352678f8e81871a9532303d6116a5ec8ad9bf4e6079a4635ec1c45f9f944e969aa43817b838d4b3
- SSDEEP 24576:3HL3UTtmn/tpattF774DzhY8AhYikM4HfN:3HL3UA/t4tn72ztA1eN
- TLSH T148350155EB9400F8EDA7D1388DA69506D3B3B85D0324E7DF07A44E691F63BA24E3EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 861KB
- SHA256 abd19fdf1d5d8c425073d31ec29a1e4e2e7c4b43a13f763810b032e29a0ce4be
- MD5 49d159d9ca1393dddeb41d2dbb3193d4
- SHA1 17c3bffa992449934f42c758e534dfc107473d27
- SHA512 e9a2ef7ef04e52f6e3c60fbea91dae4c54098bc641fd234ac192303a8c27d5b79c247337eebc034b1c95685d3b9a54b521040956f47e628a47c1b34aed32b8d9
- SSDEEP 24576:XOSEAxUi62B0TFUrcTb8sOQd0Lg+/niF:XOoUi0yrY4xLGF
- TLSH T11C15121E36E911F4E87AE27D86A2430DD772B8990711A3DF439081BF5F53AE85C39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 9fef275844246652ef0ed95d7f19f3ad659490b152f2e4bfa4c2755146989111
- MD5 7aa4318099f4d3b60f730afee5d7c1ab
- SHA1 616da2322dc4c88a57f0b62f04708563a556e1b7
- SHA512 4b654570a6614a969f4afb280d50e889d7aa7c03a4cc5df76bd6052b6ce12ec9cf247e74162733e1764b99d285bab0ad8dfdd50d51023cf5c65e01eb69ca6846
- SSDEEP 24576:y7NM9YeZqmWMUkPjZM48Mv6bEhsImn/tpattF774DzhY8AhYikM4HfN:y7cBWMpPjN8DbEhM/t4tn72ztA1eN
- TLSH T16985AF6EABAC81D5D577D13DC9E28205F2F2B4611B318ACB1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 aa55879fcea6161d8e7adbf311e1cd58d8b31a7512e9ba480a565578b078d2a4
- MD5 6d62fd10abac23ce8f3ea059269b44b0
- SHA1 311ed634c082ffe35dc780b1d1363fadaebac797
- SHA512 73d639cdbb5671d9d3195852199a9d4ba2e6ec10a20306de83dcb0c0fe94e7ac06932d9d17cf4b96da81e47cc44c1859cb84de6768a73bc3c5c439387526df2e
- SSDEEP 49152:bF2YuHNETovIvNYf8km9/t4tn72ztA1eN:66ZCf8kAoOtAm
- TLSH T1A1959E6A67EC80E4E0BBD27D45B79146FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 5347282ff4383e14885bdf827e15a9188951c003a1bbed1ffc5ce743557a72b8
- MD5 a5e2ff60c52d1ac2c774d7face635249
- SHA1 b16ae1580b3eb90e9c464010f1e9c3bc35b2e399
- SHA512 ae9e697e7c880428ca13c0be7a4f0aee1fd620ab628a036a42281b66fb0c53a11dbabbf0d4599126efb54f339d0dd7359b24017b9ec748974b639e24075506c6
- SSDEEP 24576:HTMdOz0FFS+HmSLCmn/tpattF774DzhY8AhYikM4HfN:10K+HmSLp/t4tn72ztA1eN
- TLSH T11535F17EA75D14E4E87BC17D9A539906E6B33462032266DB0690C07D2FA7FE4793EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 f86cb0909a25c2dc2d60b73aa2199258255a755b47305b87c70f5b9204fbce92
- MD5 208b571d8fbdc4e420e6eed99bebc72f
- SHA1 862da52314481b95160a471f529e86339637df17
- SHA512 405be544dea5a332bc36bd53bcbe61495d7e3c6cf57c9bff457191c90c6b076b1d3e682ceedc7319a04d4a1366d9af99e03f38f65ab7263a9dd2e04e4e77364d
- SSDEEP 24576:PAFs06+OmlfzNXEbToumn/tpattF774DzhY8AhYikM4HfN:YFs060lBXu2/t4tn72ztA1eN
- TLSH T11475BF2F66AC00D5D47ED17E8997C91AF2F1746303255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.0MB
- SHA256 f2b13ff65cff4f1b0beb6f2e3cc08c7efaa0a48889528dd91b6015517a1591b3
- MD5 14337883f9f1e50f3ec64958ca0ffc13
- SHA1 9141093ecfb19f2bf373c5e8f7582a59dfa10770
- SHA512 a19bbff2b938e220e2c2697ef263cf7cc69dfdf047df3136979d3dd47f8963b777a58c507134ee45dddcd109043be49ad4a1a2d2924f93bd78daf2f49a96a6a3
- SSDEEP 24576:oJnJ5D3W2jmn/tpattF774DzhY8AhYikM4HfN:oJnJ5DG2a/t4tn72ztA1eN
- TLSH T11235E16DD2A810E8D4B7C274859A2745FFB2383D2B2269C718A4D4353F22FE1A97DF05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 50b20c199ecde72009e5b7f2c6c71075e9622603cd8a571daa018a5a6577aa82
- MD5 120ca524816b0699181c60d124d9a70a
- SHA1 9405f24d155839700893e0fc4106df9ea77016a5
- SHA512 3f6022a208e8f8ea6e2370edb349aea0a4c62e91793d262b0516831bfddf89b6c4b3ae6a974e664a0bc2c45b6cc90c41a4b6c148ccfdc45d696cb0c4bf955088
- SSDEEP 49152:AF06DIKdwc+eQnSt65aVr3/t4tn72ztA1eN:UFloOtAm
- TLSH T124A57D16BBEA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1D33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 9be2ed853506c7f19199a281512ae19b5c0a63b3c27abf71c77a32aa65315d8f
- MD5 dbbf8cb4810bbb1eb6cbf0408969a864
- SHA1 b6c4c7378b3fd9d1ce70e5f8dd1a25be7fd5e40a
- SHA512 f546039e52b657653910eed09ad7e5cff0b81cdd59abb2b56e57e2786e8e3757d877c888e444b9927120295f9168182815e383c843e4e201ee15260540be41cd
- SSDEEP 24576:yifEAxUi62B0TFUrcTb8sOQd0Lg+/niF:yiDUi0yrY4xLGF
- TLSH T17B05226E36A8A2F4D97AE17D82A18605C772F0A8571177EF4291C27F4F236DA1C3CB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 902KB
- SHA256 3872dd99e04d99c232782fbc6060b307888a3859f746f3cb6e278d0618214492
- MD5 cdda9fdb02bf5e1d12e770f77eb7c776
- SHA1 a901e2ca8eadba9bbd44daa0c5644c279b59887f
- SHA512 4bafe5f50b94f4622b012f7b5541cb73d656b40d9942b9725648b7da94444e825b2122c0c13b435924486f88764e6bfb37768909ea0df97b0ad83499979b378d
- SSDEEP 24576:9IyiEAxUi62B0TFUrcTb8sOQd0Lg+/niF:9IDUi0yrY4xLGF
- TLSH T158152309339092A4EDFA967D967342658F75BCA88B20E3DF9180FA3F6F327455834B14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 825KB
- SHA256 0f91a2eae0468b2c2c173873e4e2469b13e09a670e617ec24a8390e6e33673b0
- MD5 9cc4bcb527f834c6142dbf163584c001
- SHA1 f52c382ac86f33d94891d941b26d6157943f1c13
- SHA512 c2d0e121553307934c6a4ef9e91f0fec1b3166bd2ee3a627fc75464842c1ba759a0ef195b8545fd796b36cc2fa82971ba31625b6ad7fbd2ec8dfb8a1f7f2645a
- SSDEEP 12288:bdJEKEPnpOTIyU0o1Q60PRkOboxKOCxa/alRrfv8ce608O5OQC2l1qL9G+fnnNsF:fPEAxUi62B0TFUrcTb8sOQd0Lg+/niF
- TLSH T1CF05235D32E462E4FCBAD279977642168671BCAD4320B6FF22D4C9BB5F326C58038B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 9e21bdd358f8096d00ea18a083946b8267dcd297dd828507c041a3b7f04d927d
- MD5 9c4a06219fea1f216ed3716ec4bec2ba
- SHA1 c9909bf85561be17e3679aaa4bb12c6e879523d0
- SHA512 f76ecb93f067481e210b25bfca3ca609d5c93025db89a20da0f47f942fcc25c94bdfab3573251ca8fe72184885e028b9a7145d00a654be20a7dd636bae60e5bf
- SSDEEP 12288:CbVm33/5npyItoRXtwI774DGv9XEDlYwIWQk6FzC3cfYumckU14i6bW6jN:WVmn/tpattF774DzhY8AhYikM4HfN
- TLSH T123F423EEDA55A0C9EED394B21DBB2504C3E7B426171A197F0AC06CB947F5F13A12F806
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 41241c1b6eca5f265e7d5eba2567888af3d6e6ee0c4f55e54c6b4ce52070108f
- MD5 fdf3e8363c42e919bb87b7588cd6973d
- SHA1 5b555ca288276d34410c3bcb3bed53623dac2fa7
- SHA512 71ad16fb73ee392bc6f720394abc089e0115b6eec213280d82db1ab856b66c81ef9746e445083d362c5aa5428b167556b9b252c39a7514e5ce9e14a8a370de9c
- SSDEEP 24576:9Q9MxZKdcz9ew3imn/tpattF774DzhY8AhYikM4HfN:9VKiJ/t4tn72ztA1eN
- TLSH T1A7659E2DABE905C9E173D27598B250C3A673B4311B35D6CF2444D03D4DBAEE8AA78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 961KB
- SHA256 86f9105b265bc3d12fba3d478459168e27e7121213f3084b0865a39597431951
- MD5 2a138472cd97950ebcdc8b928382d3a8
- SHA1 e1bee91390c3829ddd6f05fec0079592774bb171
- SHA512 a0a33b786dd365baf00c4cefbdde4adb51b68be2b662c67cb2774e1978d5e0fb8f9caf597370c78981402cf1085261193c5aa74ed8b58992cc738ba7f9b17b6b
- SSDEEP 24576:+yoc8ApSmn/tpattF774DzhY8AhYikM4HfN:Doc8ApZ/t4tn72ztA1eN
- TLSH T1E125F15FBB6940D1E5A381388D968205E7B3B0305B6217DB1681C73D4F77AEABD39B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 42e3090c8132a22a7f41c195afca27133f7ee4da42f71b3b94ead3e663f804b5
- MD5 230e58eccfcf9520b4cff6f286e7f425
- SHA1 267fa893377cbcdf8558061da86accf3eafeb1a4
- SHA512 9e139ab5c90f0da9d88185257c7b3dfa113180074578de764563a9870c940c63bc66b140b151ec4f9127a2869179b36e9b98d6cc325a70dc4d72a7cb3f7ef158
- SSDEEP 49152:ltcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKl/t4tn72ztA1eN:w0zuNIXoOtAm
- TLSH T15DB58C3DE2B800A8D9AAC375C5461365EA72742E3F2055DB01B0C57CBF2AEF19A39F15
- MD5 SHA1 SHA512 SSDEEP TLSH