Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 556KB
- Sample261014-beh9eswxev
- SHA256 34d6c0e8026902040861c68d8bb4c8057283398ede5d0f9c9f75523049a773dc
- MD5 f519231b5e4d07efe7844ea01a8eb3f6
- SHA1 c49aaea3e75d55a6734eb60ea3d01d4e9c380122
- SHA512 922be897199da8cf00322ff67b373eb66c7d366b4e26538404262cfb61f7ea3864ab1b8bba1c6add8bafff4b3016570407a15f109e8c874be0223fa4bc363773
- SSDEEP 12288:KImGUcsvZZdubv7vJl33Wbgxyn+0KfOVteimHoTfzLogN:KxGBcOlYnnIimHoTfn7N
- TLSH T1BDC49D77A29C2CDCD43F9E3834EBB9D08968B6702319545FAAEB194A06BCF974334543
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Disables taskbar notifications via registry modification
- Executes dropped EXE 6 IoCs
pid Process 2420 alg.exe 740 DiagnosticsHub.StandardCollector.Service.exe 4944 fxssvc.exe 2020 elevation_service.exe 1600 elevation_service.exe 4628 SearchIndexer.exe - Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-747854149-4118156852-591593384-1000 alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-747854149-4118156852-591593384-1000\EnableNotifications = "0" alg.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: alg.exe File opened (read-only) \??\X: alg.exe File opened (read-only) \??\G: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\K: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\S: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\V: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\G: alg.exe File opened (read-only) \??\O: alg.exe File opened (read-only) \??\U: alg.exe File opened (read-only) \??\H: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\Z: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\P: alg.exe File opened (read-only) \??\Q: alg.exe File opened (read-only) \??\T: alg.exe File opened (read-only) \??\E: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\Q: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\I: alg.exe File opened (read-only) \??\K: alg.exe File opened (read-only) \??\V: alg.exe File opened (read-only) \??\I: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\M: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\S: alg.exe File opened (read-only) \??\Z: alg.exe File opened (read-only) \??\J: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\L: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\U: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\H: alg.exe File opened (read-only) \??\N: alg.exe File opened (read-only) \??\Y: alg.exe File opened (read-only) \??\N: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\R: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\X: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\Y: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\E: alg.exe File opened (read-only) \??\L: alg.exe File opened (read-only) \??\R: alg.exe File opened (read-only) \??\W: alg.exe File opened (read-only) \??\P: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\T: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\W: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened (read-only) \??\M: alg.exe File opened (read-only) \??\O: 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\openssh\lopfigon.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\ibbkhdam.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\SysWOW64\inphacln.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\lhfdikhk.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\Appvclient.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\svchost.exe alg.exe File opened for modification \??\c:\windows\system32\msiexec.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe alg.exe File opened for modification \??\c:\windows\system32\spectrum.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\qpdcdeff.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\dllhost.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\msiexec.exe alg.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe alg.exe File opened for modification \??\c:\windows\system32\Agentservice.exe alg.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe alg.exe File opened for modification \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\alg.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\SysWOW64\mljobpel.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\msdtc.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\wbem\jdbjqmod.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\searchindexer.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\ebmcobdf.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe alg.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\svchost.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\kbjdeldm.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\dllhost.exe alg.exe File opened for modification \??\c:\windows\system32\vssvc.exe alg.exe File opened for modification \??\c:\windows\system32\wbengine.exe alg.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe alg.exe File created \??\c:\windows\system32\ohhjcdpf.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\ibilagik.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\lsass.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\fgdpqjnj.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\locator.exe alg.exe File opened for modification \??\c:\windows\system32\vssvc.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\wbengine.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\WindowsPowerShell\v1.0\pldpoimc.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\Appvclient.exe alg.exe File created \??\c:\windows\system32\perceptionsimulation\anpbaade.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\snmptrap.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\windows\system32\pjgjdlmb.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\system32\lsass.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\lhbjhkab.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\program files (x86)\mozilla maintenance service\diokagil.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\jfjkgccl.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\obkakffi.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Internet Explorer\kjkookie.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\kihlpche.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\miqfjfol.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\GroupFormat.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\pijgofaf.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\jmofaklb.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Internet Explorer\pppjqpbi.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe alg.exe File created \??\c:\program files\windows media player\oiiojkgm.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\dendjgfp.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files\google\chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\hhmamjaj.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File created \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\plejakle.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe alg.exe File created C:\Program Files\7-Zip\jgpijieg.tmp 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe alg.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d16addf7775bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000669868f7775bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f26378f8775bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091ab40f9775bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc7df0f7775bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c3f33f8775bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe 2420 alg.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1628 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeAuditPrivilege 4944 fxssvc.exe Token: SeTakeOwnershipPrivilege 2420 alg.exe Token: 33 4628 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4628 wrote to memory of 3096 4628 SearchIndexer.exe 107 PID 4628 wrote to memory of 4276 4628 SearchIndexer.exe 108 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" alg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2420
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3104
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2020
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1600
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3096
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 7882⤵
- Modifies data under HKEY_USERS
PID:4276
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\plejakle.tmp
- Size 2.6MB
- SHA256 cabcc07eb9f0d5202d01b69a413e65a7535ab5080feddc0d236cccef865f27f8
- MD5 9931720c790dfb6d9d9941fc240f3b69
- SHA1 749b4e3e34f236d20c46e71d103434d10985a81e
- SHA512 dcbdcd8bb5d07dc4235a29a265e2ab37a7d7cf141580fc6dc32e924e5b7521e91e340c141cc0ab23a0496cd23ca7f3342c29e688eaf867b230c6d473ad184f42
- SSDEEP 49152:yb+632BuPkFKRrdE6oh9stBhuXjfS4LWxnOwfNwi1:U3q6ejBgwi1
- TLSH T1F7C56B03F29900D8EC59D17CB7469122EAB27C890B30B6DF0690B6562A7BEE45F3D75C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\hhmamjaj.tmp
- Size 4.3MB
- SHA256 254f67fdab23746c9b096b3976b2816e613b11fb3dbaa33cec9a74e560376047
- MD5 7de3f92486673aed93526b31d792b6b5
- SHA1 401f3c595c38253a5e5bdba1ed01be4a9951da22
- SHA512 58917744f64067d284ce124f76977b48544ab3084738c771b6cadcfd6da50999f0bbf515138e725d5459c4d77d6c0c9e24cfcb2edb622d12460442c3148a6a84
- SSDEEP 49152:OudQuVyBvNszCnSgVdQM3/+TjERZzExldDwUIDtaZHWRdpev2y/Ba76wde:qijnUdyd+RaA7re
- TLSH T1D8264A03B29940E4D049C174CE4692B2AF61FC8947F161EF3798B6DA2A73AD47B39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\diokagil.tmp
- Size 658KB
- SHA256 8087345e8b8ac00e68401468f2fd5c5feb00bbea5c93c11eec0e571809e08234
- MD5 3f6152720dd58a1c6799216de9de5f34
- SHA1 9d98ee6e5c77b6e53fec8c771942856c863a76fe
- SHA512 b216857dd2fa25f80b209bd0096c17b8c148607ab4c0c8064a18e75bde42fc165f6faa5e01b62e8a84ab688e393752e1b479e0e1955b24890c4a64baedfb9e87
- SSDEEP 12288:L1XLsswWkxy2lRq2czAKD0X0CdkRGN3loLqQteypuP0ay4KXl3QA:xXYfDtczAaY0CdiS3SFte+uPRZK1
- TLSH T185E4C024A79008F8ED67833CADE79452C533745233A4E6CB1BB94B5A0F6F38446F9B46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\gkooamha.tmp
- Size 410KB
- SHA256 4e6e6c0eb6644fe365d2b71c63492ee12876866a564581d2dcf28a344bef5f76
- MD5 80bff9b3a7814eaa5dbbf3d085705d61
- SHA1 f410f4bc8609e70eb366116589b95f330e1523dd
- SHA512 b1359b93d0c74569a8b1a8d68110954559fae6b9431c4bd9f869a3f9d11bf2e2463e596823adf1cc669c7271a8649bff85ac28de31cf5a126bacc14215c4be68
- SSDEEP 6144:Oaf3oV2NX7X3moRRVqfCM9qi+sfbpy3L3cU5E190xZBWUiuKAL3QtV8s9:OmUyhjqfks1WcU5mqrqff
- TLSH T168948C83711805C4CFB966722ABAFB4BF07A0395DF94EA446D967C3A0FB8BC5640C4D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\jgpijieg.tmp
- Size 1.3MB
- SHA256 ce13980d79be09981b30eb8fccf84bb849ae474d1c5f1b6236aab391f9b00b8a
- MD5 e4324805117ea53b42e82b2e430c1e3b
- SHA1 9ee05aacfc704e25000b0642ef61b1e617cf2354
- SHA512 e446d6fa641d11d1ad961cc4b520a3334e0b4c18bd6bae6168ad0c888588db7695b9f6195661e41c354bb4fbcbf27c67381a1e3d1567f215e475935d8228a67f
- SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWS6q8wyu2HhkXMEXBIvYM5ahPceQ8:t/ezSC6vUzPvzHjyPHaXxCYM5aSz8
- TLSH T153550825B5F88F23D0B2D0B9C5D2AA9DF9FE3042D73049FB024692682D276E58537739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\lncjookl.tmp
- Size 945KB
- SHA256 81efed9bc6341243805f5de2ca05b588607cc064409ec9067ed24a69d76ab7b3
- MD5 33597632e6033f32a467da41c063a7e2
- SHA1 db81c45d6373e57aed9306d12d6cb1603d02f81f
- SHA512 f9561c6570f39680aafe524dee109c7ba0155547f25e08083600264dd52fd52c749d36ca149b26a8eb09809ed993ec4cab61f0d3c98213d2f3ce2c3954db271c
- SSDEEP 12288:zXZNYVLeyUji0h90ZD0wxpGZIVuorHsNW4uk5z3FKBhEbEkdNe1tRv:l0Le5ji0hmxPrMNl15ZKBhcTdNG
- TLSH T156256B25F6644761D033C1B9F4D6A68EEB3130465730B9C7438AC7682F67AEE863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\nccafaqk.tmp
- Size 1.1MB
- SHA256 9bc49dd793aa8ad428481de23817d48ca1dfaa72298edf623d275b51b1ac6cd3
- MD5 16bb5dc36b9943ab5e05fe25d0f34bcb
- SHA1 2d909af0ce9765f597ae37eb3d663f18c2ba41a6
- SHA512 9215ec425d059386ec90dd6360d3d131c4261990f9b71ec8f14824003308846b4d249d6ec37167a2568654ae9d52706de2bcce12975265ac9834be282dedfd01
- SSDEEP 12288:pVJjBq33vb5O8M+l1D0hwsEBoW/lx4wf0Im98fnLmXO7bMH98K7KcLJ/aCO3:pVbqPb88hv/l+QvP7bMHJWOJ/Y
- TLSH T1E1352766F16CB221D073C079C4F2AA9DEA733C4257338AC71246966C2E67B97D237721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp
- Size 2.5MB
- SHA256 eaa43d63d46182458861c6c4f3adad0b356d13afef9d59156557c063c996ad5b
- MD5 62b0f54a1748894f486478076a65df28
- SHA1 9c85f3ac00d3e9b9fce49aa768d2090e5ae71106
- SHA512 56e60a1a7f74d20a89f10d333915b53e41eb1efa97f65c214253dc93fde70c11650da791427a3eea404afb1f830c7cd5169bede830e974e0268139021ea4ab54
- SSDEEP 49152:cCbRquA/m2yL5zgfFiV+XenmE3/zbParv:VoqJVjnmUPar
- TLSH T169C55C0976AA81A4D1FEC37886A286C6F3717A05FB319FEF4165461F1D33ED44A3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp
- Size 672KB
- SHA256 85c2e3f9233ca622ea79d8cedd73d5566f6794f4e1be7e46935358b591a4675c
- MD5 d56751b460cae9f2d3cb3cd377852a3d
- SHA1 f1b940fdfe84a95e30be69c2d9ed96b8d64ff855
- SHA512 967e7df8140d76a165a075d291636f6832671c8d32bc0ca289b9c2890ee32ee3d033faece5235f63d975269420f5b8cf3dd0e29fe492f963ccea4cf8dc468dba
- SSDEEP 12288:aeBNUbTVO86UTvCkoAXp4623E21Q4rI8cyKL2A5:aJIUTCwp462UGvI8cj
- TLSH T139E47BE69E2CEFD1C2BE8D7B56818240977234701B62A38791E5820DBEE37DD4E7C815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp
- Size 4.5MB
- SHA256 3946c0c059b7a31148aeb521b2acbe79a6cfd730d18a73546e81a3e1a2ee13ec
- MD5 7d2c9dc671e04c7a9e2fbcfea36ccf78
- SHA1 ca6c553aeaf02f657efa73d7150a8ad23063f1ac
- SHA512 84d7933c46e0f5dfaed4cdbab47ad5d2c0cc2ca0b44a6d2a617a1b0b07ce4645dd00bcc1062de2a418a7ba6ca5c716e460b43b723e61857de9764857b99ceda7
- SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJF9DN5J8NRV3THB:zQvGAdlCEL8c/FRNw5CIZY
- TLSH T1E8263A756BE880F5E0A6D1348A7E8772F7B67B031931AF4B0151C66F2F33A908D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp
- Size 738KB
- SHA256 3b1697deaa1f136e036816936293f2351a62524d0c9e2762e1299974cabe3fb5
- MD5 25a7ab9313468720f6bc4e1d5641e7e0
- SHA1 32e04114f9d561d2dca841bcd5443f8cd2e187c7
- SHA512 70d28a595078f7c10f97b9e45594e5734af8ebfff2219d5a2abc0b571fd04c79c38ac6789c469ccfd54c5af20fadc8f8d3acaf12b32489f0439276f6d70d426a
- SSDEEP 12288:FAwSfxL/2Dc3QDLLmt0LDQewsHj7iZ54Ltt9+X8BQykgl1xNRuA6hmI5S:mlewsHj7iTiX48SyR1hu11
- TLSH T137F48DE2E664C490CBBB19721F7EB705E03DD6608F7059C7E7E8B82A0B746C12738995
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp
- Size 23.8MB
- SHA256 b1398a1b4d26a07651c131ef4cf41a6333326ed73b596b68b81cbf8584826e7e
- MD5 5196e7c15c749995e233c38fe21eb2e7
- SHA1 617d9d7a02f5893acc550717f07729d010c687d2
- SHA512 5fdfd25bb78e481f9bd9ee98710aceceaa10eb74351a0618a375c12165149faffde536e7d1c25965a2ff4f729ee9dbf0607b2da386a7e94b30909efc67c7329f
- SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyGIldPlbuJH:EUEtQevvqc2W1cpV2GI32
- TLSH T1CB474A91BBE843E2E3A6953485B282B6FBB17C0E1F35A33B1179F21E1E376905D15321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\MSInfo\jfjkgccl.tmp
- Size 771KB
- SHA256 cc1527f14f9be735b5a6ccb0058eb680f010b75921a0828f13a565005ed101cb
- MD5 c5cabf435e1239aee4249e22c708da4f
- SHA1 0e032cc151214c61a631e7648eeb32ba6fcef993
- SHA512 dfd19b8917420d98b1c0d953a26e3bf6e13702ad4cad71b62f9bf7d9c53db8c5ad42e2b096de8ec338d462bfd280e7f2f2edb41824627788b17a5e4e4818b84f
- SSDEEP 12288:kSR5sqbPd1imR4nIiFqyKtLpm1EwtLpm1EzcZGn5Hl7cHTh15U0hlR6t0/5:NPUbKtLpwbtLpwwnVpczhg0VP/
- TLSH T1CEF46A4E5FA91980E97A8135D622DA1CF17378355B17A2DF2BD4E03F0D22AD8BC37A50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp
- Size 959KB
- SHA256 81a21cbe482bed8e59a445d662b00ca8a96c3560919f581a1c60425b182d0ece
- MD5 83abcc62cdc94bb12eff6c8044ccbb76
- SHA1 7771d4352cfb64a61eb6869718bc91f8fb41ea37
- SHA512 d80ca53381c351cb51c920c4e8d938664a162a64e376a666d9ff4f2d00b1144aaad952f68af6d5bf5621d7ac579377c9622bf81f3d2b47b225062e09dcd95c96
- SSDEEP 24576:oAhGLEIFoiwtA5l7S53bL0gNbZOwbzZEu:oAMPFoiq5rL0g1Z32
- TLSH T154256C81E7F941D4F5B39A7859769220E9F6BCA55E30C23E2150F51E3E3FE809D24B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\ccojdgle.tmp
- Size 637KB
- SHA256 1129eca44c31cb560353a62397c00e59c189d6c90c106be1f32a796aa9ede457
- MD5 4e3622e48e80f8108908c2c5c7d43653
- SHA1 982cb80aedfebc7709d1ef1d3b7c5f341ead217f
- SHA512 654d460773639c1f4d694801188ebc9dd43472149fc6b6521e2edc5426319af608a5438c429446f88b72d801a538072eba84a88cb2a40a909f00ff5a51f62f1a
- SSDEEP 12288:Umw5HEjsChNEBFgl0WDm+CpnRqyXjbkFJNW24CjkHyFHLNKv:RwuVOWyG9FJKv
- TLSH T174D4CF19721508ECEB6F89388B7BAC72E3B175612730972B0EA5CD0A6F273319D2D751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp
- Size 484KB
- SHA256 760f16c3caa12373516e15fb6d27598a6b4e4208053f59c4e9c7cd1417c7765f
- MD5 13afa7d6fcd42e7fab8618250399206f
- SHA1 555eca613d93ecb939a731b6b7c810955fa45a00
- SHA512 d08c696877748ccf6c761902c6977093d54cb85ea7e9144b806a426f52baad62be5d5491eacd1d499b0e0ef4808b84bce4ed4846cf5f5ce5c494a225dae9e7b6
- SSDEEP 12288:xqZ1IyMECN5D/QpqlVwlDhnW//N/hHya4S8/km:MZugCTD/QpiylDlWHN/hSr/k
- TLSH T1D3B4BE8632000F98EB79013527F5AB49E36334A2DB628BCB1AD109F94E7D6EC4F7D564
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp
- Size 1.1MB
- SHA256 b9a6b56d52d0118f1a25626a1f96c891b367ab4938aa7dcbce3968039a209a94
- MD5 237e8aa83231ada67112de1194fa0240
- SHA1 62e5a8ec2a51f9ec7615532cdef33b26242c8652
- SHA512 9c28e3f137ac0630340eb212c420ebacb8511ccb56dda664bfd6fd5104fbb4367ad0e9a0b007df6e117e2b4a5b0e5ce2fb45c9aab3ed32b59fb56528343b2751
- SSDEEP 12288:X87i8Ze75r3hauMaG6OMzsbSo5XwvsfRDs3ubQivB4UUkR+:6E757i6XzDo5gvsp4ubLvfJR
- TLSH T17A354909A2580C8CC326F0366D53CB12EEA0BB518B0255DB4F6931AF1FB7DF855BDA16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp
- Size 1.9MB
- SHA256 44500a0520ed4379c1bbd076e3b3df7477f53162c60bae36af03726650172699
- MD5 c99d34e9d36c1d0562392667f71b625d
- SHA1 5de0754d4663b9a13bc5061d9df75af113b984c6
- SHA512 6b045435a7bb84c07c4bf192efba01622258c7046399a2a665d688b4e6f24ee9986d4545decd496a68eb3957ac892f0362a687c44d82fb5e4d0af3bb376158de
- SSDEEP 49152:gQ1zFFYtkODlH8/eEZm3ef2d/MA5mxQE:/zESZmOf2d/PnE
- TLSH T161959E8AB2F845EAC42AD378C196460AFBB1782D1321D3C70455D77E1F3BAE1693D728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ink\nnbpngba.tmp
- Size 813KB
- SHA256 536d299077a6c84663896b1a94777cd913e73a86ef208f2cfd93705013fd37cb
- MD5 a92bfd286ff7dad540e1e8b52b193f52
- SHA1 014a3f94e117d5264bb1399e2cc10bbda15fd029
- SHA512 f266e7a3649502c772b073e2c34be038ea44c3fd58c023f380fc5370eabd320e62458e0b6b66c181c6d9d96cbfa168d4f7a3dec90e44951129e82c61926c302e
- SSDEEP 12288:2SUrVT6Wo07v/3XfKV5w5X40DK+RawXqNOz97Puj2hMd:2SUwWo0L//KV5KHXJDuj2hM
- TLSH T19F059D19E2AC749CE529A3348953B209E9B07CE4871D60DB24F7B33F8E37AE46575B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp
- Size 772KB
- SHA256 a03bab2fc67dc05062cc3a5610a90cbfc15b466dba1483d715ea3b1d72edce8d
- MD5 bf167d92e5ceaa0af5c1e55ebfe10fa8
- SHA1 1740e0e1e37fe8c7123a27462a157ffa3f72a89f
- SHA512 9ad3bce0e21a7acfb06070647e3ccd6636984f51916ce4eb0bf8233f17e2b1d3a98410fad1792f64808e8fa701fd3fb71b589b14e4ed1dfb774e2dcd88e7f1dd
- SSDEEP 12288:enRrNvyyBlsKun3cMIMIkzKlJa4RKO943htyDmVMtgEbcHTtV3uRHceK:8Na0sncbkzWxRKO9vDWFHTtVIceK
- TLSH T169F48C0BBBB844D5D4269175467EF345E6B27C683B53D6CB2290823E1E3FAD42939B0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\jmofaklb.tmp
- Size 6.4MB
- SHA256 b9c8588a026d86ed30f99406e9e8c9214ae67953ec77038fd413b5fc998c086c
- MD5 ce36dbeb70ead95c62d788d2a5797f19
- SHA1 8f0bffd8a09bcd023277585d3839c243c45fc33d
- SHA512 144065e495696643ead30a727ccde7545bb7c5e28c71ce825cc82651bcf7efb781a628662ca2314f4c6d5ddcbdab918c304d5b6fa17a21fb975726e92d593a03
- SSDEEP 98304:eQRQyi36YOcPJLvw2gAf+PN3Pzy64p6NC:FQyiKaJX+PN/zy64p6N
- TLSH T1BC667D03F3A501E8E05EE974CF3952229A397C5E87B892DF159476E11A72DC17B38B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\miqfjfol.tmp
- Size 6.4MB
- SHA256 17eecf57dcb37f72ea097f0854e98819f900e389f86dbfaf1923ff29a31c494d
- MD5 cae7930de7a64fb1e49a64736c3682c1
- SHA1 36958c785dfe35e7a6f1005e7dae011a9b47f571
- SHA512 a52d480387ec5ba08dafed9917c6a8a79a4d2543e868bf399405f06c7b1b59a0b968eeda48d35830a7171da9c2b3d008305904962a904c6ff5a00e9f2fea480a
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGePAaLSF259ruMHwpXMi4FqJLd23Uo:yQRQyi36YOcPnLvw2gAf+PN3kN
- TLSH T172667B03F3A501E8E55ED974CF3952229A357C4A87B096EF259436F11B7AED03B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elidehmc.tmp
- Size 2.0MB
- SHA256 94493571ef43d9db1491a209bf274750407d8b7d1341b2fbaa5912775fbca233
- MD5 fa99a3eab4becc9f7677a48e02df3a20
- SHA1 571a1a7902b2ca3d0301dcbece534025e3b29c7d
- SHA512 53daab4ed8a80e2aa2b1b10c5186e556ab2394bfd062ae83e240e0118ca74cf70fb474189b93eb313217ff5c7898c5ffda64e4e96b75367333285fd14fb123d6
- SSDEEP 24576:xhv8E1hps0+ogd2z615uCMVF1Agz6RUQ1zNOgLLwH7ReaQXx3f3zkw7r:D1hpsNoJpF1A6OU44CwH7R4x7jr
- TLSH T1E2A57B03A2B900D8F059DD7487569222EAE1BC450B27A6DF0E53B656FE77AE01BFD310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\hfoijjjp.tmp
- Size 2.2MB
- SHA256 8e21f39b4ff1b9e3fe784b92d70a6a427d08c263ed5137c1332555f435cdc23d
- MD5 cae66cde6123cb841e72dd048fa29374
- SHA1 1fc06f444dfadcb77ec63247ba76015c20fa2290
- SHA512 73982f7208253535e1cb283d9519138225dfbcfa5bcb8a5c7635359bdb17496bf01a37a735233ed223b0cd54cb222c40aafe0f331547fdb70d87e264db7e872d
- SSDEEP 49152:+SuZQIY0Be2K1RVtOnks6NMHq0D8TQm61:Q5dK3i61Ay61
- TLSH T16BB57C03A2E901E8E0AAD57C87655322E962BC45CB34A6DF3640725F1EF7BE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\lhbjhkab.tmp
- Size 3.8MB
- SHA256 a31e11e2be3b2d1a089cdab666868943749063e89d0dbfe3fd72403023fc42b5
- MD5 45f3a08db285ead80cd2573f744209ac
- SHA1 60b9529e0f536cc9881925ec70a7be9856eb8b00
- SHA512 2941327295a4504747f8c2c2fdaee08f7ff65a94694f2b858ae2e5655c90b9a516fe76f643331a098c1857782165927e6a744a15cce8ff6d8c3246a0342f614e
- SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlb4N3Oh6tznm2FQ/nho2qkrk99J:Yy5112gYy5azzVvf69nLKnhZ1
- TLSH T18D166B13F29908D8D099D1798FCA9A22E961BC424B21B6DF0B5077D12F77AE46B3D730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\obkakffi.tmp
- Size 2.1MB
- SHA256 ca2a6444d2eadd7d3cd96f95a284a45bfe0d6dd13679a79a8ee07d8b7258f32b
- MD5 68c47c37ac7bd6968ee360b792a49da4
- SHA1 e40686c0a670e2b1e69f24bc9d6b0c3d1ca4a6f3
- SHA512 ffba8f1f6fab006c86c4a1dcd367f365c542b6135d409852a8df0e05cbe743cba12c17d7179b0d49abac3c5ba5ab844dd017b735ceb39d6e90f63619ef0eecec
- SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6P7DaHGTNHu7PNU3/5W/ohL0pJC3xNM9AD10:e68Qg55nhceWu7PNU3/wExN7+
- TLSH T1F6A51633FFE20099C0FDD176BB76862196D17C618FA193DB854172061FB2AD06B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\oonangoq.tmp
- Size 2.6MB
- SHA256 53464eaae57a41f9d360882c418dcdcf1f0c6b8944ef1c0286bba3555e109574
- MD5 9ad9d1c77d41a364b625d31caf7c1a13
- SHA1 b7992e1ed1b31529e354cb5cd8562a393e6df48b
- SHA512 651ece000728ec1358b5fed4133d5ee8e6623f2d4e4360e73fa0e02cf037d6aa30ce4b8801f78d9edbaa38ac4f265467ecf45448e7a488d9dd927e5cba450bc4
- SSDEEP 49152:iB+taZ3usBWOBr4tEGw0bqx0z+n217aau1glMvCxPfnua:Qu6JmGxd2dMm+
- TLSH T195D55913EDD901D8D05AD4F8964B92F2FA61BC0D1B30AEDF0A9073D72A76AE45B39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\dendjgfp.tmp
- Size 1.8MB
- SHA256 d420212e3e931127a4a70c889f3786749bf5e4a7434ec256ececf257fccd0d17
- MD5 527addae27914a5740e74167980890da
- SHA1 513faa67c2ef1bf1fe25f31c21f8e01e9a0a1f72
- SHA512 6316f81c63750db3f3306fdb1c3985a9ec6e3a5c606ca75ed2c89e50bd9fec78eeb78731e5465c2d2e7c0f0f99277b2d73e4464af3d08b4d81873c00ae24b5d2
- SSDEEP 24576:khiavrPSLT8EARn+FgyUgd0fJY6Bei3iy9CTn0AP5+2QLcYwaQLW:khtSn8EApI0figegiDn0AP5wYYw
- TLSH T1CE957B03A298C0F8D05BDD74C7168622EB62BC45CB24A6DF0690B6551EFBBEC5BF9311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Internet Explorer\ekchdkjb.tmp
- Size 887KB
- SHA256 0b09975f32d52f1e12ef5025a6f082043eff99b88526d7c9a5bc29983d9940a8
- MD5 26f9953927c4c76cd19d53bcb10da759
- SHA1 3047066d725ed9d5fe46da5b645382233434b3bf
- SHA512 0dd57c822df5a2099f6a44bd4ae4659ea3b9e1138dddba88862a49824494fe2f59569f91c1dcef46ef12e1fabf215529b6a5226d7e2f2bed3fd44f7614c40dce
- SSDEEP 12288:XXRtRX+5OLpdNIrd4Ds5OLpdNIrd4DGKBsGCRUjX0fxACzxOc:XBrXimXIrdFmXIrdXUjXsBzx
- TLSH T16715AEC67349A0D0E9754531142A2D04A7F6AC595B102AEB3ECABB390E77FC33C76E46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Internet Explorer\kjkookie.tmp
- Size 449KB
- SHA256 76cd43444f2c70a6f351bf6f08e98b90844b93b34934324a3ebd7795ed36c963
- MD5 de646766e66d9b66eeaf23227267d024
- SHA1 0ad8b90edb70e2659d66a2c3b16fb406fbf920ae
- SHA512 9f1908eac8a868e3eeb32ce5a86d261b4e69b3fa9b0077784032b3089b9e3aa6384bfe0ff82076f1cfc944f589d319c7dc174f11a2eab4b146a0df77076f2d02
- SSDEEP 6144:JDVEjlUau56M+gulU3GN0CccTzgEmIESOBO0mxeGUselE9/bxaw4hDqLzOjW6emJ:JDVEpX0ZOFZQTx+qZ1y0f32E7OUNRf7
- TLSH T127A4BED8F39020CCD93B9B3C6EEC61B0C56572701F268B9B089951545369EFA87B7AC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Internet Explorer\pppjqpbi.tmp
- Size 615KB
- SHA256 7dea8a2899622a5aceeeaefde25e53b1de5a8fdb44b6b9a6ae9b5eb3768518a4
- MD5 2d9f97dd15a786da78e44185a51f0d28
- SHA1 6d1e480fcb380ce618d22290e6bb9e969287965e
- SHA512 9a771a87b9d7a9d98bf258bcbca2fdb4e62df931abb60c8449e17ea7451f6ef66c66c1b665b958aedbe2cacabead69bebb044d46dbd14f1a656990a8e749a16b
- SSDEEP 12288:p5OLpdNIrd4DMhxhzQN0AXVkY0cvMJC4wf:nmXIrdth/7Amep4w
- TLSH T18ED4C0C2B17CA0E0D7A957374DB6BE48613A1FDD5E849A463CC2F92A35FB3C1D0251A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp
- Size 409KB
- SHA256 9110278456001c7a5a6882b3ac90a4edfef58945d938cc8b8036c32d45e77188
- MD5 a9e63b3d21eae39373a786ec032fe10f
- SHA1 48325fe7e525885b107c8ef12c4679f779084159
- SHA512 aa07d53492d4af930b73972c235e30cc723a427a44e119cbdd0d28b60434725f14181833ae13c9a4d46c8e5931d7ebad51c007b57a4e9973670ffd9944957abf
- SSDEEP 12288:m+uk4v8st5j6DcqJB5FXZvNV924rUzVLgp:mjkywcq5Zb244z+
- TLSH T11694C043E175D2B8CD64F7395BBBBB0594F90D62AF6881C05EC07836C9BA9C67B00993
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\oiiojkgm.tmp
- Size 1.3MB
- SHA256 c656ccee641b31f4177f13b85326b55f957082a263bf25aff7cae99a0c2ad98b
- MD5 9b32cc5d4f46154ec7f289847d2c51a4
- SHA1 9d0f6e321915ffebcc5383b1810a4c5b6c565d51
- SHA512 fe49c427b631c8495b421b4748eb0062d6f0cefc23b8d1d7f0c70e95133b6f91d40497849840fd8763bfb38756b70c4992532905ade03d0b70dbd2dc29844125
- SSDEEP 24576:acP4mcvIjkGOxhKP2l71aNKbrh/8KBH0AiU1OM5f/ex:FP4m4IpOO67V8K6IOYn6
- TLSH T174555A19AEDC0086C0BA917445558E09FABDF4E91B2296FB1D70923C2F67ADC4E37B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\ddnfppgh.tmp
- Size 528KB
- SHA256 e11a269fc61408da90b3f5ffd6b8c6de587d47b696695b6537068dae6e2d2157
- MD5 f292a2903ac0954cd36a31041623bb3e
- SHA1 d23731f6c594011207c5f34559b26a4a465b1308
- SHA512 3b5933a5ca8d00524465fcc5bca208e21cc3cf8594d67fc414671032dd6dc912b38a79a56b553963a5dd549428c1a7c889f71aea6c2b8cbfc4a9898bd07a1ea2
- SSDEEP 6144:P3psmeIFsQFqT9a9G2Thqh8Xmrc5B0khCawmpdQ9/FjKgiDn3rQ0q3YAHBpPMeld:UgsfQ9G2lq3rc7h9wSm/F3jYAHBvxR
- TLSH T1ACB48D15C2803FCAC10D9AF8E39455B0B6E3BD05E2EA8697D6E9F53F3B795404AE4243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\pijgofaf.tmp
- Size 441KB
- SHA256 4deb077a9ceaacdfc8808a55a68c3e144c590d2a07043d413dc9b4b5ba233940
- MD5 44fb9a6360581616c041ce7903f59107
- SHA1 2a94cd2497a9a988642ae4bc00a8697ef92509e1
- SHA512 23a2b8103d5122d952d5018263f1334d68f1f9d8a3da554e99ce3e7c172c1ff6c515a8a8941b5cbb0159ed238046f93b0a7c113969a195b6569b8a98b60374b4
- SSDEEP 6144:XJFqPRrXNm075fXXoHgNTp+1co88aLveWJJV+nQ4wxXJorC3240TnfnpEV1CS7Ua:Xy79vXegNT+r8lTeO0nd2XJ2bnPpE9
- TLSH T11EA4C024A32426C9F31A8A3F3CF36146F7607430635F9CC37A971DCA1699AFA47A5E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clmaedbq.tmp
- Size 449KB
- SHA256 0be8a534d14d3755acd4d20deebac8733568fce0f108187fe627c233cacd10ff
- MD5 f3cd0d7ba183b8a481cfaecb6a9f2ac4
- SHA1 07df930db2913ef07989a2ebde5c98eb917e834d
- SHA512 cb9a99a837a61397dd890ca9674c7d713f66b68b3172b41f8f72c36aedf7f3c1ff5c20465637650fcc54d93dafebb1306b77a401e124ed14abe8745ac33d8221
- SSDEEP 12288:u7nkraYa9FVwNMfuwfTdey0XSy+g5mhglYS:umkFVwmToy0yg5mGlY
- TLSH T19BA4CF7D4320D0EDE11A6B38F1C539E1E21B71AA3713A59F5EED0486C258ACED2647CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\kihlpche.tmp
- Size 445KB
- SHA256 5c98cda46c664cfcaa7097afe2fe05529886d9ff4b7a7b0ec597d56b3a93a6ff
- MD5 271f68762938e6c37e04b86044b4bb25
- SHA1 6e15966e4ed47a93861cdf3ca8670a5699635468
- SHA512 261638e8a26d38f6d87a00840015f47433ff8fa3a36c7fba9e6bd9394d70f9a40c0fec87f669415383c693493b62e21820ffb5a96dff06c939c83e62d697082a
- SSDEEP 12288:9p1yvXulKES33+DsfP7FotUmP2WStRWow6j5wA1:9gXUKES3uDsn7CReWStRWow6aA
- TLSH T13CA4B03AB15633EDF52AB6F815F420464EF4E250625E88C34AE6251C0A7FF9E736C5C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ocijnkpe.tmp
- Size 1.9MB
- SHA256 ab21a67fbf6539326c44ef8944d0e0d996ba482abb280511533a97f5f5b5ee4e
- MD5 8aff443db6e305fc34b926516e747532
- SHA1 4f6ff4468f46bb71df91e43da92b48e0b0964f1d
- SHA512 ba8a64dddc75edf4e26d7d2b0db3f61c92d59fabb50b6b5f3bf5d8f090e22216283e71ec3111cddb96b39305e6b5699243b7029168145df8fe7b903fe6b87275
- SSDEEP 24576:js47VXnueVulvspdb4LM4EkYG8/IsuTc:J7VXnu6ulvKd0LMlkCIsuT
- TLSH T10B9528F2BFA0B0A9C2D16C35394AA6BCDF5B3C705E1341D336D3F32E097A29146A6516
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\ibfbaaca\cmd.exe
- Size 625KB
- SHA256 bc29f23386d035b31a8dbc24595d3efd93accf002399aa377466a25f31b5a07d
- MD5 8eb55ddfe560d93335378e4cae57f9a6
- SHA1 57bf7ecab73f89c1c2e1cc4c6bb610d8503f5afb
- SHA512 b9c69d8fbef117d2ecc444196b7586a392215d7c50ded48792c2f2b661955720db625c236b86b912e62de0cfcc01bb227b513da152219a36e367c49bfe8ab6e2
- SSDEEP 12288:y4K2B+Ob2V0NXI9bf52GbA3dcxI4qIeb9+BhL2JqAq6A:9K2B+ObISIPQH4qpR+/L2JqA
- TLSH T195D48D6CA607E0ECD42F2E3C3DF9FAF588542E60230650B3A9FA1C9B25B47959378547
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\khnpkpmp.tmp
- Size 818KB
- SHA256 3c4b04d2552fd8e1344765c2aa3250caf92266d5deddc1bd7edec1c27edc9228
- MD5 9ff6d1fd2f024f2e5df70b691078742e
- SHA1 f6970a02ae94ade043f2800b06ff3c87fbdda42b
- SHA512 ee2ad3cbca86ced731585d75f143224ffe596d00dc248510ac04f1322b6e4c9833f553225a6f9df88920831b79a66518be83cffa67834ad59744876265605f80
- SSDEEP 24576:IfZwW2KjJ4Td3kJnbsPhnzqVpZGc6Zoa1hUN4Io9:6bnJ4Td3mbsPhneV097UCh
- TLSH T1DD059DB3A28C01C4DD7A61F2597FB7345136EDB5DF90AA81D9C8B939C8B06D0741C8AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\flpnmogo.tmp
- Size 431KB
- SHA256 c179ac5e99aae5082e583fed82269555a0514db380b9e59bed8b2f613abb5c85
- MD5 36ee15da62f36f67b83b2d3cf488c7d6
- SHA1 bb5e516333e1444e4f8cb68c36eac266b8eab667
- SHA512 7352bf8980fa1920ecbaf75492a03a84783aaf445f3501cf5f3db35a71c6286fe7503f6cb82d30528cee6ae6c9e72723b845539c64aa53a49714e0a0b3cf8f8c
- SSDEEP 12288:LS0nfFn9WNgf6U9Aan3ZEkcs08AoCgL7:LS0nfFn9WGxPnHccAyL
- TLSH T115946CB4E61530CCD43A5FF83DD8B5849954E6603336E0F26CAF1B9902ABFAB4364593
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\inphacln.tmp
- Size 1.1MB
- SHA256 82419bf1b0fff541eaf1f99f0dbd6e3b1a47db53755d46006e6c3059c772392a
- MD5 3457c312b91c4a2758f8776f73a46b70
- SHA1 2c88e39d50d38bc5077ff1933558ccaf08ad8e9c
- SHA512 41363915cd984b0f6aac81e4bac95f529fc78c0e8c648d06fcf0a06b5fcf5e0b55332960627f4e2ef5b37c0768eaa524582d10e2deebc3c495738166d92bf5ae
- SSDEEP 24576:yaW1p4xXVwzcD3Hf4EwoxJe+NayJnqKrlDhAwoEa7XcfIKuTqOXNehljW:yasCyziw8Je+N/pqklDhAw1arHrNYlj
- TLSH T1D9358D30BB8EA07ED137DA303999B3A0D4E9B9A8072144E3DBD556BD29747C38738617
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ljlaihig.tmp
- Size 416KB
- SHA256 450e402432806f744c4f079e9e307911a34e8c57d94971ac00ffee7541f38f88
- MD5 4f76ff5743e99c49e04c25d7c6244c68
- SHA1 7735866645ad076c67e8f515785e5c842e0918f0
- SHA512 1bab99ee3f0c9107eba0fed9eecea967f7858cbf81cc07947e2f3ba9a3a7d2970b6f184b134c20a39e1c69750ad32f1dae62d5b0a8ce76e9ded470b69fb4443c
- SSDEEP 6144:Fjz012VssPfkiJGUjY43EC8cnQEfzQyl5YgpVp0UROinEdGzwbx:FjzyaTXkiEUjY43ECSUl5Ygf0UoGI
- TLSH T1DA948DC3B37905C0FFB96172EA7ABB08E17E07A1FE54A9447CC5783608F9B9164098D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mljobpel.tmp
- Size 406KB
- SHA256 051702c115fa416618b9754bdda388eb6503d6aa110cbbcd2b739711c46dbee0
- MD5 9e158dd23db010d263b42aeddf5a760f
- SHA1 e83568b52aa58af7d1cf5dffe1c4565752e50390
- SHA512 f1375384fa51ceec8eae1a49fd2092f9779ef04f69baa90eb67a04736f7b625a7bc7b24a73ef575d0e2dac48dad1f6e5ef6e25f3d542fd534ee888040edd71ab
- SSDEEP 6144:bm80plhWZLktbtX1pHb2inXli0X2tFbfwcJuHH9j+QSugOU/fKpiKL9GAf1xQlp4:i8KwZLQX1BPXgIwx4OAHk8gKMR21Wlz
- TLSH T179947D83614816C0DFB973326AB6BB0BB03B0791DF55B9C4ADD6BC3608B8BD564384D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\pclnbdjm.tmp
- Size 455KB
- SHA256 df8085545cc4e5c1f98fa60c5b3a317de7d92f177aec5534aab09e0eae454f3d
- MD5 ce1e40fb28ed8589442d76ea061f4ab5
- SHA1 11762756209c1ceae1d95a126ae2e59b79988a11
- SHA512 1b6505b17f8ed7f6eafd139aac09f74528958c328d628f6481ac5dfd8e0cbced00ea71c793903aa6998bf5c488da8f9dff1d99f4e79f84b9b7a9813f51e181cd
- SSDEEP 6144:h0e6l3Di33OgFY71agxa9WJCDopgRoV7jWsSnwXDTGh5i2HvK7eJjW8uggGLyGBi:h0nlePC7osJ8oVnxqOHUvK7e9z/Q
- TLSH T169A48D74E73020DCD72F9F3C39EDB9D0895467A0621690126CEFFF5A02B879A8364B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 487KB
- SHA256 d379e1283995a4a43733b458d4ade11c7701780aedd6defc08516817f3d6191b
- MD5 d1e0ff7b1bde6d5235b80e9f37f01642
- SHA1 8bb69b0d56afb9f8877df072d82fcdecb5188ca1
- SHA512 63fcfe201f4d3fc2058addaa5dd86aae192a0e1d91f7bd0bec20fa7fb3d45aad8727b1bb45f5ff8ef0617b43f0a10afa3b192911d9572792ef9fbdbe5d52d4a3
- SSDEEP 12288:thbHjfXHRswspTV8lx0snezocGFRk4VuCRuOk2:thbHjPHCwsV8lx0sOoTUIuC0
- TLSH T1C4B4BF28072D39C9E4B58F7C15B59908D2F039012316D7FF6F9602FA0B7BBD49A7A642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\lopfigon.tmp
- Size 772KB
- SHA256 8082f7314acc13b6dab7ccfa4af8d6eaa7e3520ef2182e1e50b726807c9cc8f7
- MD5 fc520b6f95de95a0605c0431c1641c7e
- SHA1 d367b883ad5b470a922b0aec579bf227023142ab
- SHA512 d62bc54da5f4cae01a290d58580b6637c8f1f2aec7595984c50c7cc3b4ce3f2b8fa537ff2d5d70554837d486bfccc3b6340aaaf1cf4ebeaa266cdb171c585de9
- SSDEEP 24576:99L3UTnziDxcAqMIV2W1FB5frdkLixWB/7JDeN:99L3ULRGpe
- TLSH T1C7F4CF17E35420EAF96B863869A75712E271F4191314DE8F33990A4E1E237E60BFD31E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\anpbaade.tmp
- Size 499KB
- SHA256 8849f92222cc0d1bb46f46e9ac1c2b21b2efbad99c7f443b24a4f2d40588f431
- MD5 c0fc225d7efe5dc74bc24a16c2e8f74e
- SHA1 b0a34bdcbcb4ea088d9548b479c8fa135b3d1be9
- SHA512 4de0e6dad9fb32f0bd4596b13a9d7c9735c73b98f2064111b4337e8f49f7f1a205aef873ae167433ca2c2a5282d4ddc576a2995f61a004ee9730116951ba4120
- SSDEEP 12288:tpFtXOkQLSEKX6FJ3qk14wxlNfho+7pysk7dg8G:DOkQLSEG6XqkKINfhvwgJ
- TLSH T11AB4CF29E1B821CDD0295278A8D751469F67B863231563DBACB1C46B3F67BE80C36373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\WindowsPowerShell\v1.0\pldpoimc.tmp
- Size 839KB
- SHA256 354c8277718198b3c30db6348c19e789162402f2475d9c46c0dc8bae7379b8b8
- MD5 3a1578368d3f4f7566cd89cf28c2dc96
- SHA1 498ac34adf6cfd33f1c61cc3c11e198995f9af7b
- SHA512 1628931b06ff645b6910e4707dc68f6ccf7cce626c5061603e60e1ab2c6aaf16ac68c9da613d64c8627682d246d32f1cb14272c73054c7e4523fe254fd94be3f
- SSDEEP 24576:HuW2KjJ4Td3kJnbsPhnzqe9Rcj7EZodiiMFEoi5coXBoGZks749MM6CCMmNuQNsf:5nJ4Td3mbsPhneEcjoZkko5coxHN7iMC
- TLSH T1E8059D97A684B2D9DC2A843CA962710117E17CBA97C557DB58CCB23F0E702C09E39E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\aoqjdfdi.tmp
- Size 412KB
- SHA256 a5295e7f7f2273da76401cb1c0267e585f3c6e5094480e9af95dcb9c24454d60
- MD5 0348586420ad09800ddf77fc9a80906e
- SHA1 4cf67ef2ced41e8d1d807eefae80b3c0b15c4e92
- SHA512 9ef40e0c8934e5c8497e2c1cfc6dc45ec38cc7e0044f4b9f3591ea5b0ba3f1b66385ba08fb5a91d09036b2a9c6ba7e17b9ae7a67d4c778de16aeecdc88b58cba
- SSDEEP 12288:FUGdpNO7mhqk7FPhjbtN0fxV6/J6nl6kT:Sciuqk7FPdbtN0fLL
- TLSH T18594C08C9702B09CD82A6BB9A3F3B2E4E85C3F2F721155BB94D857A54624391F73E14C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\apibkdki.tmp
- Size 1.1MB
- SHA256 43bb91934a33b8c1ac041ff728f83dd7796c3ce3527ef78b68939827a5689618
- MD5 c7fce2ed4632c03a390f99e91e574d1d
- SHA1 0c38f57f87c96804f458716761fb6a648a7c0788
- SHA512 d873ac046a71a906a85002c7e822a620d54b595ad9eee49025bb859aa488893de8fc04dc42a8cc33b8eb660a6d70f7fe6a8ffa1ec2e2db9b5d7a3978b1b14b0f
- SSDEEP 12288:qLQZb3C97GYnZMv5zBcKY9GMD3ys7iX0V3KA4/uiSfoBJ/TpKM3lTsDgMe2Sq:cQ9MxZKdcz9Gw3v1KTSGL/3lTsDgASq
- TLSH T1CE35293DAFE90489E17691F594A253B2A6327C311B21C6FB2445D03D0D6AAFCAB74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\cdpacfki.tmp
- Size 1.6MB
- SHA256 25a54a50a42f1ebc83772205fc03eb00d23f91117a0a00983c2a365e647d2987
- MD5 57a29595b3597664839abaabc1574ef3
- SHA1 3a3d933ee2ba2df2b6b2bcf4fc4187991a9a6917
- SHA512 82fbd6ddd65e507fdae6d6a75a278a07e2af857b9f07fa2cadf68cc10a91beb092e3dae936aaf067a69c909eaa09d641725d223f2140bb123ec06c9daac16813
- SSDEEP 49152:GF2YuHNETovZvNYf8kmj2reH2L67zZrK:H6UCf8kE2reH2L67zZe
- TLSH T160754B2927AC8094E0BAD2784DB69146E5B3B85C173CF5CBC355862D1E33AE44B3D7E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ebmcobdf.tmp
- Size 1.1MB
- SHA256 e52536c1543cd940234491b771d39b02854be7c57f0027297762c6222eae3938
- MD5 e9594c2192f9db4eea623f46692b7deb
- SHA1 d761ff9102b85c8ea53933e91da62d3d69c6b12b
- SHA512 04bcb97a68f9b9b661bf5f5fbe3a4733c41972ce8941c3445f6dd2e59a44356db2500dcc286090339d8ab7e15dd57cd6c48ba31cc7debeb941db42e549a95904
- SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiY5jMqbvMExHHqD3/Jyx:7TDxR+N5YzTfjMAFqjxyx
- TLSH T194458D6EA7A8D7D9D17F8A744A23C501EA72F411D33192CB82A0C33E0E6F5D85E76B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\fbdffflk.tmp
- Size 1.9MB
- SHA256 591b473f66ed187651e9894f11b46f274885d565f22bd64b95dabaf2dc6af814
- MD5 b75f451983de9c6ab53168eeddee848b
- SHA1 dfb85839470d3a8bdd8869a44fb77401403c47de
- SHA512 e013e4ba79d958adfc246639ea888554bf4973a5ba5af439acaca827c94f59ec0e26924ab9d047b49d380fa3871262e5b5de7da50a34fe5b937d0202a8a0c454
- SSDEEP 49152:jWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKkIKGnhNDtI:j0zuNIo/DO
- TLSH T163954A3CB2A800A8C86A8675B1411255EA71342F3F2C75D7C1B0F578AF3ADE19AF8F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\fgdpqjnj.tmp
- Size 406KB
- SHA256 4d168ed5bd4b3ded43967d9148512f691e6ac8e5a73fdb78669a60db8c7b75cb
- MD5 fce3d689a92a23d350a623b34a6622cd
- SHA1 cf048b8b2946fc3470c74821a3e21fd119e00cdf
- SHA512 97259f26af854d2d8397e5468632d97fe0109b33e781ee872df9f5c4fc00250c9eb2b9e0e94c36e5d3f216a277387d0a0d4e50e88c1f9a0893764320f6f9b3af
- SSDEEP 6144:aD7SAcpwKXKiqgXim81d93jU41Dsdxbms7cbPPNpktjtqxXj4swq3GfC27r5IB:M3iKiTXkot76XNpktjtLPf1xI
- TLSH T1D094D06B720C32C7CAAB63B279FA7B88633407674F535BC98CD9643746B46EEC144429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ialghlam.tmp
- Size 489KB
- SHA256 f6a3dead611a6dd7ee759178efb0e3e131d1ad30e6db68b60915dd54e5c34862
- MD5 98a9d0589e56ad25e49abc2337c850cd
- SHA1 688f717a105f0b251d8794c2d4ffa65457a515ba
- SHA512 79f2509d6fc6e322c93707dabcc4b4cd2b5e7544679cd02f49fcb414aecef56d97108d45819fd05759d5b840b313a1315c4c24d80807a5d5d93b1daf23ec63e1
- SSDEEP 6144:TEP3RrVtwV623M57mHm3STizQmOlBJB0/hMEieGZafREyNx9hiov4UlBveM1Gq:TEP3R/23M7mG3nQUMeGZaZYov5WCG
- TLSH T128B4C078675A30C9E0BD9E3C34DD4684C3B07260331562EF65FA8519CEB6ADA4D38A4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ibbkhdam.tmp
- Size 713KB
- SHA256 9bcdb0deefaf963106a243a50a2bfa2bcf433362295ca5a5680969ce85f31a69
- MD5 a25807011cd01b47fd1784a9848c9a59
- SHA1 96d3d631fefca15b7b82788aea531ca3560415f8
- SHA512 278da39d5a28027534fa76db641d9fbd8c37c1066ca1c1220f5bf254885f7a76c09d6a8654c47064ec1f4b34f5c32cccbd20be8d380d874f5bcfdb405c39141d
- SSDEEP 12288:pCJnJ5D3Vkrbzx5FpYtY9rNaaZ1urYW4YITMqXTLbfebGxFJzn:AJnJ5D3W/NWtY9fZgrYFYmM8/feb27
- TLSH T1FDF49E2DD2AD00D5D7B78277826A2B5BBBF3372E3B2158C71864D4352B6DED06838B14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ibilagik.tmp
- Size 1.3MB
- SHA256 ffa35a6feeb5de2ef8e73e05694b49cf91db597630bfa59a5963773cd83d76c4
- MD5 379b79f3a8ecce85892af3f41b6bdd61
- SHA1 011125a7f447a40b6441845e08e7aaeb96893f04
- SHA512 d46948ef57add7cc80604c174107c74a5664ec9bd2c5f0773473afa9af783ae50cdd5982445ea0ea961054ea7a6983bf603d7776736dfa6682cd81db0b656f2a
- SSDEEP 24576:i7NM9YDZqmWMUkPjZM48Mv6bEhsKyS8Q9srg7vmGBJ:i79BWMpPjN8DbEhxySvsrg7vmOJ
- TLSH T11C555A2F6BF84395D477D13B89D2C245F6B174601B21CACB1D62822EEE27AE4CE35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\kbjdeldm.tmp
- Size 1.0MB
- SHA256 9edbf07c1495e9e3f45f5f0f7847e46480d7eb9d33d16179127ae2253f6e5bf0
- MD5 e1fd4670cd857c5573f73f702d9ca66a
- SHA1 3b82344782a9c5412b17d6c3dd4ed3b4243de602
- SHA512 6df71ff9470e53e06181685a23232df79fa9f7ffcfca2e4b9aba49de3fa651edac64650ff24c1e84d1feae4622cc64696bbbb45061d10fef16a4a3b87e5ca760
- SSDEEP 12288:Z/jWhF0YgnJdCFaUKUiWLk49cti+R8tYnHiyxMzn4i/zMhDW6/0CqLnZtP9fp:93YgnJcRTk4yti+R5dmR/z+/BunZtl
- TLSH T1B6357C3EE2A900A8C8BBDD32450253B5A77178391FE09AC77170C5389FDAAD45E34F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\lhfdikhk.tmp
- Size 540KB
- SHA256 e859966895d980faa7f48b5a301fe242862f8ca3bb630a6c880ce35e17a2816b
- MD5 cc41417d19e5efdbf54f0570e1d1b361
- SHA1 7c7e1617e065e2a04afee23e144413e84259f4f1
- SHA512 291e6c45122e408b7918eaf001bc420b9ac2a2b61fb954e68a7c5aa03084ee71c9294223af26984b50513b49a7a21cbadbce075fc472261e697e123cc9dadbc0
- SSDEEP 12288:fjky+7Kt3qQinxcc/nBrh+65+2l1dbMgeS:fIyUu3cZh3l1dbMV
- TLSH T107C4CFF49E6823CBF0270F382DDAE2D0865079B13F1C41AB259C65292AB6BF97770745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ohhjcdpf.tmp
- Size 705KB
- SHA256 8d7eed9227c55b24388b0d6a9a2f6a5217a8fe79b80ec569feb10a3ed8cb37de
- MD5 cb5e8961376eb3c27a57367a6bcc075b
- SHA1 f7f75327983c35efda3cd9379b5ec2ecceaad930
- SHA512 06f39831dd73c8ac01e2bd6b6ecf6e2a0329960b344768bacbea0f89674a8f8f89f41d3e6b486be4a860e95235146fe8b1f79ec1b1c93a4f1041421316fdec65
- SSDEEP 12288:V/5T+RdOzMbFFTG+eEUNmSL+33onsOCgmIYTiUMxFg5mhglYS:/TMdOz0FFS+6mSL2YnsOCge2UOFg5mGi
- TLSH T1BCE49D3D53781CDDDC7EC1786A4298CEDBB130A6131696D70691F079EA9BED81A3CB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\pcpnaabj.tmp
- Size 463KB
- SHA256 1077aa2f061a8621b4d53e2ac7ed9e83d6ea5736c92eb543bd3c2f37c9d51b8b
- MD5 e4a17ce67ba4a4111c0181c561ab3559
- SHA1 74e87b51c5cdc8d192c49b4a6ad9af4339df4850
- SHA512 6fd5460b3e27bef716215d3520220f30c26e4e8ec2c5424237150dbcce3a7a378c38f83c292a576adcbd05738b538b62889f6909923f53def00ebab1c57b6c06
- SSDEEP 12288:X4n6dnJnIz7YpVkkMahp1SujjVUwO43FTj:GzUVkXatk0j
- TLSH T165A4BFA87DAA64DDDB5ABA3438BA459346607210772C60FF2BEDB479033BAD1C134D43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\pjgjdlmb.tmp
- Size 1.2MB
- SHA256 1f92bf4552670b55f45cc04ecbd7846eb894aba729b4d3c2a421f3b3eabb16e3
- MD5 9e321d6c68482de34920cc8344139089
- SHA1 3891dcc5155890a6f90a005b44e59c6c16e21bca
- SHA512 eee2ef43cb1d48e113c369c87ed16630ecc4a64bfae68e2482628505cae1d3d94d97bbe631fdfb646859f90b0c9dfcf4cf728b1307a75473dbfc3d9e93e49e58
- SSDEEP 24576:zAFs06+OmlfWNXEbToU2MN9ZmKOFKYD5lEct:8Fs060liXuF2MN9ZmKOFKYFlT
- TLSH T1C0555B6A63AC00C5D4FD937A4E86C615E6BD7472073156CBC360852E2E6BEE81E39F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\qmbbghpj.tmp
- Size 1.6MB
- SHA256 9aa5dde9eca86a3826f9ee97f5d2212a9049eea9c070995fd6334a5a6c596d6c
- MD5 17ecbd7f9fdbe035d2116327351fbed3
- SHA1 ca4183d9ee6fb59b551acf986fc219e81f213377
- SHA512 8bcb44bcc50c722ce3e4f4f8ee8bffe1efcc34e7f765fe7107a3b48731047aa84687e734de6eade27028ddef4cc3010442b8e867709076ecfcaf9cb0e13128e9
- SSDEEP 49152:2a0h2GEkuAe73q3ppo6zwwQIPDjFrMpe:2a0hNYGoJwjRM0
- TLSH T12B756CFDE69881A4D076D278C9A7474EE6B274221B31D6FB01B0813D2EF7DE44A39712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\qpdcdeff.tmp
- Size 1.8MB
- SHA256 4f655f896e8e68f2d40b84af5c0d4f4b71bbce5e18477fba98429d56f589173f
- MD5 8a379e37e90f80187738bc01b2841ce6
- SHA1 96bbdecd66fdf054e687d6ffcda44cc16cb9b536
- SHA512 f5fffa7a28512571ea6f1d2d308be3fe0a49b54e3acea5b89e5817cc6b8b8490fe68a1bcee2d35a2493eaf2f952e99f9164ffe9f878bb8431b17b19f3d341dbe
- SSDEEP 24576:rEPwhm6/7IIXdwcXrif7qQncjlP65i3VueG+upy1qWH:Mw06DIKdwc+eQnSt65aVDGByY
- TLSH T13B952A07A7EA5E94EDB3DAB0CD62A115963E7C109B34E7FF0980C92A1D32AD0D534BD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\jdbjqmod.tmp
- Size 600KB
- SHA256 faf52e15bc760ee48092e8e38565cef2d40e0300533423657a00ecb5baa90107
- MD5 c5caac92b61461a74f9dc01bc2761117
- SHA1 e7b7c34983e3e5b762cdcd62d59324623e36d736
- SHA512 f8a63e0fb8e0872a0c9cf1fb2f5c390119301404f4c12b38c34063118e6d655560d027a5b89c0af2c984ee971ecc63c558533ed93395d29598ba16aa78a98203
- SSDEEP 12288:UyoKo2eRple9p+/9tMxQ3h0lAc2Ka32sLayuljfBnME0Xi9s30Qjc:Uyoc0AposUhG44MFkQj
- TLSH T183D49D4AF25B0491D466813B8949471BF27373A0DB9393C3ED848A3E0D6EEDB7E34946
- MD5 SHA1 SHA512 SSDEEP TLSH