Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 14:00
Behavioral task
behavioral1
Sample
2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 917KB
- Sample261026-rbbm6ss18m
- SHA256 509bd3d68551ef3ab9617e4211b61396f78bce7b7c1faaaae847a1abd8eec310
- MD5 bdbd8410a82a435d64750c0f69707ccd
- SHA1 9d5685da3eacbedf44d15c19c48e54f063800754
- SHA512 df910330eb746fa225b47b71af73ab535c5c1c7caa13bdbafac4504942bed0ab464814fe97a55a5db0eb09d97d4961358bc06f7baa041c5e0b62e236f96c3afd
- SSDEEP 24576:bqGGkWBZL0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:uGpWBZL0lr1rq31XDJPG1YhQOt69
- TLSH T17415121273C08072E5632E3196B08AB1667EFD315FB44AEF23E113295DB47E25938B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe -
resource yara_rule behavioral1/memory/2324-0-0x0000000000FB0000-0x00000000010F1000-memory.dmp upx behavioral1/memory/2324-13-0x0000000000FB0000-0x00000000010F1000-memory.dmp upx behavioral1/files/0x000100000001700e-220.dat upx behavioral1/files/0x000100000001704b-224.dat upx behavioral1/files/0x0001000000017bd4-228.dat upx behavioral1/files/0x0001000000017431-232.dat upx behavioral1/files/0x00010000000233b2-243.dat upx behavioral1/files/0x000100000000c514-248.dat upx behavioral1/files/0x000100000000c535-252.dat upx behavioral1/files/0x0002000000021ab3-256.dat upx behavioral1/files/0x0001000000017ec8-260.dat upx behavioral1/files/0x000100000000fa6a-264.dat upx behavioral1/files/0x000100000000c3fc-268.dat upx behavioral1/files/0x00010000000177f0-272.dat upx behavioral1/files/0x0001000000017816-276.dat upx behavioral1/files/0x000100000000c8dd-280.dat upx behavioral1/files/0x0001000000017854-284.dat upx behavioral1/files/0x0001000000017ec2-288.dat upx behavioral1/files/0x00010000000178ce-292.dat upx behavioral1/files/0x0001000000017039-296.dat upx behavioral1/files/0x000100000001797d-300.dat upx behavioral1/files/0x000100000001799c-304.dat upx behavioral1/files/0x00010000000179a2-308.dat upx behavioral1/files/0x00010000000180b2-312.dat upx behavioral1/files/0x0001000000016793-316.dat upx behavioral1/files/0x00010000000177ca-320.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaws.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2324 2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 04c799044ef2bd478f2019dd038366916562404add65d000b2b2d7ae6f5eadb1
- MD5 885bed24ac9081ccbfd78372178d2fd3
- SHA1 b06b076446cc22588a27ad2cb7787b09916cd8e6
- SHA512 377ba74b54cc3ad1b815f24626e7b32fe20fe465566159b0342c6573892ea77be8336832e990e795d0f43ae9ac8e2a83427219014bbb789e9d4c5e64a65098e7
- SSDEEP 49152:kXn632BuPkFKRrdE6ohCbVBhuXjfS4LWxnh0lr1rq31XDJPG1YhQOt69:t3q6AjBgq83BpGmi
- TLSH T14EE5AD03F2D900E8E06AD578D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 23363a475bd0fcb4b1d1f00c74208d10db4426a1e69e0143fabd7a7e424133de
- MD5 8192cf87759d80ffe8cdd8ec64a6ac6f
- SHA1 456b979028446d73ceff24da4edd39de6dded442
- SHA512 a958936ae7b9a3cae736bcf342727eb36ee0b99b35677ac75146f6c08e83175c488dbbf83cce0392a3ef1d5a55a1cb2a76983cb518e4e27021a9a07d93fdeb13
- SSDEEP 24576:HXYEDDczAs0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:HDcP0lr1rq31XDJPG1YhQOt69
- TLSH T144251225A3D008F8ED63927DC9A18516E773B89587B0EB9F03F085250E733985E3EB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 998KB
- SHA256 a783e613c79f5d629e23e7de621da83c784084a1c8185eaa6e250e9617f73439
- MD5 d8a228c0cf050dbdd1fe7da04d4040cb
- SHA1 ad2d988eff85dd42c254c53e7bc0060b39a8b06f
- SHA512 35475949d22b39c30bfc7b73336240a168f7335837319aea3e2894dd4c0129bfc3911f164596d02a94fd3e653c58eb3a77be37e1baa27fe6acac2f9d1775a401
- SSDEEP 24576:ZwutOW/0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:Zw2Ou0lr1rq31XDJPG1YhQOt69
- TLSH T16A25F14667E40CF8E9639679C6838136F7F2B8122A75DB1F07A0C21A5F77361AD2DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 d2e8a762f75c8c6258d0996926f7829118779d95b4c61d9777c300585f64cda3
- MD5 f7b69f40822ec529042c5f24b026a2d3
- SHA1 6a38e95e64051fdc58711adc7197b65cba1dedcc
- SHA512 a09c73f9945d255b1e98e9005373a08b3e384983a9fed508bcb878685a05f26224d6d49a0ee3a61709cd25e88d966284d2f821a1b7db2df2439d61fbccc0bf71
- SSDEEP 49152:09+taZ3usBWOBr4tEGvI2Wx0z+n217aau1glS0lr1rq31XDJPG1YhQOt69:+u6Jmuxd2dSq83BpGmi
- TLSH T13CE5AE13F2DA01E8D05AD578974A9233FA62BC490B34B6EF0A9073552E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 9f0ab88ed15b107787214797a4133192964b58a3013a0bfd6d23950a41de609f
- MD5 28c4259931ce965e84a27aa8c9779bf4
- SHA1 1dd19952876ee4d3ac61b11ae189c78787d6598a
- SHA512 6ef9b6be6397b958d777dcdc072f6977c7df6d96e589f57ab0baa332e3c2a0710df5e65c149d3e95361f9ade3e81cdb3e3001e2443c2ecb44f822f8fa9e96f55
- SSDEEP 49152:BP4m4IpOO6768K30lr1rq31XDJPG1YhQOt69:XppOODRq83BpGmi
- TLSH T17185BE2DABDC0095D0BB917886658A4AFAB1742A1F3286CF1160933C3F77EE54E35F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 f5ed8eeb7f7801cb2afef182851e9b9200ee0b9cde1fcc329c349caabd0981e0
- MD5 8d3ad7cd6bc62b22c988cc4b02de2bce
- SHA1 fa752797c02edfa78949776d7cbba0ff1b5da5f2
- SHA512 da8cdc27c10eeaea78959bcd6698e69d117eb3c6adc85d6fe7a40ed3c5a509c8bddda531e381f21e678fecc5700b776bed621f699ea53ac0261500552faaf3ab
- SSDEEP 24576:LQ0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:LQ0lr1rq31XDJPG1YhQOt69
- TLSH T189052343C7C55628F613BFF2E38045AD338F79668FB596DF1AF3111410F8BA5A89884A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 5ec972b62029ae0826f2d18f028e7f2b8384440d93defd3effbb144851102f15
- MD5 301320e65e8c459dd2323e2dff6adb6e
- SHA1 f231f263fdebb006976d7eec670bf67d0f8289a6
- SHA512 dc1fecbe0c4fdfdad617af2023bfc93189f99a5aba82fad6e7ef4f5a16ddf352beacb808cb0b0667ae506652b8ab4d14ffe7f984e11a62b94d37ad12cc2e5148
- SSDEEP 49152:0a0h2GEkuAe73q3ppt6zwwQn0lr1rq31XDJPG1YhQOt69:0a0hNYGtJwiq83BpGmi
- TLSH T12295AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37EE44D3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 7d581c0d22efb3e797a59f3e5a0f2558607d63f546b1a906673c7cf7ab5cf9bf
- MD5 f89ef8a14c33e1a6f5465a72e62b520b
- SHA1 42933642937351080de0da7a58c82c249ee2a975
- SHA512 e787f5181c18b63785802cac31300296486fcb25807d7749e205cff4cfa12e9329527fa6d14cdc3ef7b2ff4654dc675fddae2679b00fbdc6054ec02383f12fdf
- SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYhjMqbi0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt6+:iTDxR+N5YzTTjM50lr1rq31XDJPG1Yhu
- TLSH T15675C02EA7F815E9D17E85799B238512FB727821033193CF42A0C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 849KB
- SHA256 21d56d253d7121de7960ac302a89022c2eb3f50fb02e4e3b97d727d9be312c1b
- MD5 762c6eea6ed10eb99be24326609b64ae
- SHA1 4c3f54f88a8391b53ff4c2098533c7e62ab9c044
- SHA512 ec3065e47a3c4930fa476bc91fd5ae89460370a54d83fa4dd80a5bee8c9270764efa15a834711aaaee817581130d89aba1130471d9b0913c7ae532667f422cd4
- SSDEEP 24576:BhbHjPKw0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:BhbHj90lr1rq31XDJPG1YhQOt69
- TLSH T1D905126B17DC2198F132F6BE9681454AD372BC26172193EF17E281390E7BEE45C78E81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 4d739eaecb2659e66488fd86dcd576d47185008f856410669de983f5cea83262
- MD5 258841df00bcf25afe54fe6640a4b2a3
- SHA1 3d393e2b86dfb8b46c600b6fde5455f21026fce2
- SHA512 f168bcedb6f3951dd289ca1d02e3c93b6eaf1d8be96b64da2ac5f539bc65c1bba7eea18e94ad67d0f7476cd37331e1802f0834935bc6c0a8c7c33203f664f018
- SSDEEP 24576:j45g5JcRTk4yti+R5dUR/r0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:jig5aTk46pUR/r0lr1rq31XDJPG1YhQ/
- TLSH T10065C02EF3B910B8D8A6D636450147B5BB71782D1F209ACB0170C538AF1AEE85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 768KB
- SHA256 69c813a1d4cd7c9cd3afd84aff589d75c20fa9750ab650939ce9024c6782bb15
- MD5 c1d622230909195ce19a543d346b106f
- SHA1 cb31305f0affd1f6b10b232493bcc4bf369a230d
- SHA512 ed81baded8857bf6478c045b28a2e2bf0c5c6f8f6ab5ce5fe851c9258156a36316530ac9c8c04e3c8d02225d77c8fa5bdeeeedca8aa53a011eaed94210e4bbbb
- SSDEEP 12288:iTd0XVkwWIDKimAq31cfIR2DD90aBIg9wP3gqMNkqR8+97r2Sok50c+CO1lbvyvo:iTd0FkwWI1rq3Sw2J0aag9wP3WLx/Ahx
- TLSH T123F42343C7C15268E603BFF7E38045EE738A7D569BBA57EE0AF3101400F9B6660D8889
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 e82461873cb68674278ef4d10f01ec6713e6fb8809404d9cd37fe02546de3c40
- MD5 c47ccb14101ff916b011bb525074dadd
- SHA1 62ca41fbfe6077f800c2c12af6641772c138104a
- SHA512 13b72bd8e0f40d98efffeae9901fcc07f6b1642bdd5b5a26678805d892645f0d29b180967615dc80bf42dfaad238c613448380204b5b8f2734b99242d1f92f04
- SSDEEP 24576:qHL3UTE0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:qHL3U40lr1rq31XDJPG1YhQOt69
- TLSH T111350242E7D400F8E967E27DC9A28516E3B2B85D0774E7DF03A94A251E637E24E3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 861KB
- SHA256 2df26b7da7406f015e2b7e566a41beb4e414d304c5671000b91775bbb74ff3f7
- MD5 b3c78ef5b9d05daa2b668acff3cb04c9
- SHA1 1e23178ff04eeb4bec67e65d828e24a76421c76f
- SHA512 8fb03e5559246f42211087741e1a779b41e4dc6d13be98e9430a1146de24d5ceae504c04796ebc490d392eba10ee9cc03557e5a2151059805fbcc79934db2817
- SSDEEP 24576:xOh0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:xOh0lr1rq31XDJPG1YhQOt69
- TLSH T1D715121637DD10E4E522B67DD682424DE3B2B8660B7257EF06E0817D0EA7FF86C78A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 7bedaf70f7d5b101c898a9d26ddfce85d059e6dd82c9ed60af2550cd4e04fa67
- MD5 8d5a87b18aa96c77085d69e4e70127ce
- SHA1 ffa95617e5555c182e16876a931fd164c3aad1f7
- SHA512 41222c696105df7465a461ac21a2b02a56d02988e7b20b5dfd661c597cd44e2bf0f5a1f754a52b3b935829e3f27e28cb418fdf1ee86b6713be56493a02f29126
- SSDEEP 49152:W7cBWMpPjN8DbEhe0lr1rq31XDJPG1YhQOt69:haq83BpGmi
- TLSH T10485AE2E6BEC81E5D577D13DC9928246F2B2B4611B318ACF1162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 69c95f40102c32ba666071390539dfb1be89596684627a60c53dcd9631123463
- MD5 584561d90bb602902eb10f54c85026f4
- SHA1 51565ff8609c68c1d2a2f5366540b2a0d31f1bfd
- SHA512 981f2525095bc676f28145ff4166e26585ceeacbf15bf16f8e2b8a0ea616695f253af03ff17c7a67c15f3b688d94644d696c6ac77c2e04a081f3be17a7cad73f
- SSDEEP 49152:4F2YuHNETovIvNYf8kmW0lr1rq31XDJPG1YhQOt69:96ZCf8kLq83BpGmi
- TLSH T12E959F6A27ED80A4E0BBD27D45B7D146FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 919c98726251837bc19064f574585fa024c3dd991a4cded7ed3d8327b2134985
- MD5 432c3619732d0cd5b8b96788607865f3
- SHA1 8d5604dd9614f7d1fb6080c2434aad53912e49fc
- SHA512 3049ae767451830ceb60204c1e275a34cade550a17bc7232238f0a08b711ab4bb9e5fd18efe5e9b8d001fd124d01fc79ff169ef282c684e588776010a5077de8
- SSDEEP 24576:vTMdOz0FFS+HmSLY0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:t0K+HmSLY0lr1rq31XDJPG1YhQOt69
- TLSH T1A835F17EA39D14E4E53BD2BDD6438906E6723466032266DB06E0C0792F9BFE4397DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 49d2255304a9b7dbf95008993526fb23cc0d2fd27b45b63aa66b62dc214a8cde
- MD5 37c8adf283e0aa3e4474af8f45ea423b
- SHA1 e65953115219373f564ab0451a01cd251f1101b5
- SHA512 fc43b294c214894f60737cba868a4c23353ced39054f018894ac08f950e8d86c2e76cb255e46fbbb729a147501ea4c1c322086c9bf4ea9759ddd9a912dfaa550
- SSDEEP 49152:PFs060lBXuy0lr1rq31XDJPG1YhQOt69:lBjq83BpGmi
- TLSH T13B75B02F62EC00D5D07ED17E8A96C91AF3B1746707255ACB0160863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 5d865e8c8f5ee9a6a4ce228f84c04abf14b21f613d4ff0cd89021aaa9c6ed97a
- MD5 14c2ec57c247d9c0b1efd6d552dd5359
- SHA1 895b1d2c101b83a71a959328504f0566004825c7
- SHA512 92f86a23cbddbcf2b4edb91b1f5ca1446a3085f13b8711f94db940b68bb38daff069e146e499e966251b13a8f061307a87b4cb5cf7952f2def6affabecdd8584
- SSDEEP 24576:SJnJ5D3W2a0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:SJnJ5DG2a0lr1rq31XDJPG1YhQOt69
- TLSH T1FB35E12DD2A810E8D477D2B4825A1796FB72387D2F226ACB18B4D5353F12FE09979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 6280fd6d801f9bef6b005eaf892510423e0e5a3f590c3100269feacae8083964
- MD5 c99457111cf6e156474f54e22906bc79
- SHA1 05ef66dd63c4291f99266205aa17d9283a759134
- SHA512 da40cc4b26c409b734d556349a9b173c3232cc956cf48a154cabf6a3d4ecc6a8e0b016ba513ec4938a1c38195a2fa5be8456037c54df3c47b145a73237a6bb41
- SSDEEP 49152:bF06DIKdwc+eQnSt65aVn0lr1rq31XDJPG1YhQOt69:BZq83BpGmi
- TLSH T174A56C16B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 98bccd276ce23ccfe6fe4989b926ea9d0646f074a3162e17d91e0bd65c0383d4
- MD5 b5b24174b22cbf2dd2a4b359a2b752b2
- SHA1 cedf458130ba6557ebaab9131e7682ee3a715b12
- SHA512 340ebcb27e081e001841193610d2e5f0882fbaf28b4108880df3bd1c74f017fc46018674062232c852273ca6eaba15502c15ea49f748deb2b0abba73e5017bbf
- SSDEEP 24576:hiV0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:hiV0lr1rq31XDJPG1YhQOt69
- TLSH T11F05125B67DC70E8E122B57ED2808549D3B2F4715B6227EF06E2813D4DB7AE92D3CA40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 902KB
- SHA256 7abf3f66ac488d450b4f15b355720f132c081ebf91b85f0246c19782f729d9a9
- MD5 4927d737f2f8039520c69e93502a7031
- SHA1 649ba9210a91244f6fb0ddffd4a29ef858859d63
- SHA512 35a93b2dcadc1c309c399bb0ceee7fb99e5edf483f51f04448281a50c661f04ff362bcbf81527c1301fadec20937c3b2336fcccaaa4db884f9bd93946845e7da
- SSDEEP 24576:dIyT0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:dIq0lr1rq31XDJPG1YhQOt69
- TLSH T13E15230253C46094EA636A79E79241E99776BC319F3093EF05E1E23D1DBABE0A874F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 825KB
- SHA256 359e3ff6c80782874901673ce23e0af360cb4f4c63e776babefe9d58fde365b8
- MD5 33b5644cbb52a68b00af86e4f8aa6448
- SHA1 42ed6378ddebcbf1939b6da39eb0efb376ceb702
- SHA512 dd1333a3af5de85e5733c1196f0c053cd30323c8dd28c4978c09c7dcbf741f1b4cfbe50d1e24cd0e8a2c8cf0e9b32d0af08cda1624fc2bfdeb0abc9a5f0891d9
- SSDEEP 24576:Ox0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:Ox0lr1rq31XDJPG1YhQOt69
- TLSH T13D05230653D430E4F423BAB6D751019A93B1BC3617755AFF2AF1C1390BBABE5A478B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 2a5bd47fe70cb6dd9289883bcdb576fd3c3f6efb09853d0c51c85a6b92596e22
- MD5 1eb4ffa2d6b3072146391556fd313193
- SHA1 8a97286051ce02c7378af4e969f0f4f3ff5deb62
- SHA512 b302c09f99f3d1f95e4bcaab1f0718e03992cdc47a6b2facc557ddad911e5131333c27370d94d1ccf724abf5f9e13db16296303a8d8f80fa28dece15ba644f69
- SSDEEP 24576:A+0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:A+0lr1rq31XDJPG1YhQOt69
- TLSH T104F4234397C12168EA03BFF7E34045DA63DB79769BB566FF09F2913440F9B666088C88
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 53d1a438b09200e6e6e6def6fb26809558ac325504d6789e7c7e3e9f6338de66
- MD5 879fb243cc315cee8fd28152ce72be5f
- SHA1 ccc7ab311b93ef68b2b5b0f75ac23a1dc3ee2461
- SHA512 7fecc0c25d23bb2cfd54cc4e73d3b45ae4cedf93bd35967448e2a5c35b627947b047d3be72c38d07862ced09b301d0cd1549e978843f9dc75f4b0c5d3ba6c884
- SSDEEP 24576:nQ9MxZKdcz9ew320FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:nVKi20lr1rq31XDJPG1YhQOt69
- TLSH T1AD659D2DABE90599E173D275D5A240C3A673B4311B31D6CF2448D03D4DBAEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 962KB
- SHA256 1a9fe6f49355491d18c73c1dfea4f36df0501ba4ceb24c0ed8e2ad6d7c937ea4
- MD5 e888d66c147c2f3f3cbccfbeaea70caf
- SHA1 2fc483bb35a77515e3f20e2a37ae97751d9bfea2
- SHA512 d0ba6727f2daf9b9108f8d00642322930a66292211984f0903ecf89c2dbcab735dcddb55636abdff497ba2d8488455dc1b30212a9cdfbc8d8678d6438ab351da
- SSDEEP 24576:oyoc8Apg0FkwWI1rq3Sw2J0aag9wP3WLx/AhC8yOt69I:Foc8Apg0lr1rq31XDJPG1YhQOt69
- TLSH T1EC25F11FBBA940A1E122923CC9818745F7B3B0305B6257DB56D2C33D4E67AE9BD38B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 8df580bfb1f851139c06623358fd323de44d663cf4255dd2a42bcef2f8fc7d50
- MD5 611e1896d22ed3b46cfe0c5b11a0dce5
- SHA1 60753b8b56d622d1d782c1f54e3555a3d46758e2
- SHA512 edae2c0625714c812cfa69265368c72fac84cd843df4cfde4d69a9c2e9dafca15764c9e228248e89dc28fc406250fab524d3bdf597174c5eaa80d19b086f0a28
- SSDEEP 49152:7IcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKB0lr1rq31XDJPG1YhQOt69:p0zuNIBq83BpGmi
- TLSH T184B58C3DA2F800A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH