Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 18:36
Behavioral task
behavioral1
Sample
2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 917KB
- Sample261026-w9dmmsgw7k
- SHA256 3bfd623077cfb6867be6a10ed2cb5ed83a9283a513ee768ae038ae81e11e749a
- MD5 9c74553e85f4afa5e7afed71c9f5021d
- SHA1 85e6c2232e7b5228c2109e5e90cf8058b3a3a310
- SHA512 81817fadcc799d80e420d5fb0d797f1576f6a89d3c38ff8821e3c5e85fd09a2d376f9173660e229ffb5345c291d26ff6570da29d7549c703dac9e419b831e5c0
- SSDEEP 24576:+OGGwWBZaYfFmT+EP4fA2OVyekxdrMUPXiF:FGRWBZaYf8+x6yRHjPA
- TLSH T15E15121271D1C0F2E937043169B5CA716A7DFA701B788ADBA389036E5DB07C29D38B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe -
resource yara_rule behavioral2/memory/5240-0-0x0000000000760000-0x00000000008A1000-memory.dmp upx behavioral2/memory/5240-13-0x0000000000760000-0x00000000008A1000-memory.dmp upx behavioral2/files/0x0001000000009337-215.dat upx behavioral2/files/0x00010000000093af-219.dat upx behavioral2/files/0x0001000000009952-223.dat upx behavioral2/files/0x000100000001b952-234.dat upx behavioral2/files/0x0001000000009cd6-239.dat upx behavioral2/files/0x0001000000009cfe-243.dat upx behavioral2/files/0x000300000001a192-247.dat upx behavioral2/files/0x000100000000b974-251.dat upx behavioral2/files/0x000100000000df21-255.dat upx behavioral2/files/0x0001000000009fd4-259.dat upx behavioral2/files/0x0001000000009b92-263.dat upx behavioral2/files/0x0001000000006215-267.dat upx behavioral2/files/0x000100000000a050-271.dat upx behavioral2/files/0x000100000000ba3d-275.dat upx behavioral2/files/0x000100000000a0ce-279.dat upx behavioral2/files/0x000100000000b94e-283.dat upx behavioral2/files/0x000100000000a1d4-287.dat upx behavioral2/files/0x0001000000009371-291.dat upx behavioral2/files/0x000100000000a2c1-295.dat upx behavioral2/files/0x000100000000a304-299.dat upx behavioral2/files/0x000100000000a319-303.dat upx behavioral2/files/0x0001000000006223-307.dat upx behavioral2/files/0x000100000000bd4d-311.dat upx behavioral2/files/0x000100000000627a-315.dat upx behavioral2/files/0x000100000000a02c-319.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5240 2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 6e720d84b04e83aa046299fe8806e1bb349e630c339856b2c41e6e2820fbd5ae
- MD5 7195fa563a5380a284a74a2b5993fc60
- SHA1 999c7b6c794f52e1add799786a65ca9086faa6b7
- SHA512 6cd7ad3affe8aee5ea38c9132ec41dfb8f73adcd6a153241dbc8718de1d2789859e8c2b200fa3e95799afc1bd754a450c9ea1cc369956307554688293269d7e8
- SSDEEP 49152:Cwb632BuPkFKRrdE6oh7stBhuXjfS4LWxnaYf8+x6yRHjPA:U3q6gjB/YUC6yRD
- TLSH T118E59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 b53e3a129e67aa98aa30568b44744b00d9afecd621cd0e3fc1abcb4e4663a2f4
- MD5 ded3680041ac15577eacdb60b8b00886
- SHA1 bdad083ee5d74dac67c511d24d4106f61c0d92d4
- SHA512 b96a220442d084e7bb8b812cfa139e8156409ac5029754f7876b122f5ce866fa5fb6a389c48ac4f7dd8c530cc8ceeacb169dcde9d08ab9dd3008e09fbf3ac444
- SSDEEP 24576:YXYQDaczAzYfFmT+EP4fA2OVyekxdrMUPXiF:CacwYf8+x6yRHjPA
- TLSH T1CA250229B3E548F9ED2B817DDDB2C505EB72B8514364E78B03E486690F237849E3DB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 998KB
- SHA256 1031eb067163f37eb8e0a87960854e9f5ba2e2ffed851276dd7f2b897c7c6a9a
- MD5 2f3df19e8e7e4307ba4f64a8dd05e7c0
- SHA1 02ae11828fe730382f02168deb1c6066efefcb0f
- SHA512 d0f1ce7c5aa6a8cb1981f8be276787b11380d040b878c63d22bed38c178e925943582d90bbc35789a39c2d996492ab4bd897e21d4997135f0b4b027119453c18
- SSDEEP 24576:ZwutOW+YfFmT+EP4fA2OVyekxdrMUPXiF:Zw2ODYf8+x6yRHjPA
- TLSH T1EB25014672A54CF9EA6A8139C697C536FBF2B8022624D71F43A0C35B5F27311AD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 e2aa579e76c665f995902963d9df639b8c97d629f1a99b75e4e378ff58444412
- MD5 7c3be0686486399de86a9026bba47cfe
- SHA1 e999effd92f3bec3897837fce00ed2a945cf1da1
- SHA512 325c191f3122da87be89d04326f9b4bfb7d4b29d267dd179e8082a5b83d0ce62b430cd04b1fd23274632815dd28f7ee6f1178fdf8524988f5d20ad5ceb74e0ec
- SSDEEP 98304:hQRQyi36YOcP8Lvw2gAf+PN3YYUC6yRD:4QyiKa+X+PNIrNwD
- TLSH T125667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 41173c94a827b4bf2e19cd15be44b69bd698d6662a6bf194f283ae31e9d363f4
- MD5 1aa76976abeb5bfa6c078b076902b553
- SHA1 f5dc464534bddc23787dd7210b25550c24d8fa6a
- SHA512 17858f285e77d753e379769e1f48490eaf62979e3ec0e7e4e951f230d361d7bb115693c782baef403611fa054d9474641da8bfdee6e54a510852b6103e676d70
- SSDEEP 49152:t8+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmYf8+x6yRHjPA:Wu6JmTxd2dmYUC6yRD
- TLSH T111E5AE13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 7c8814d11eff6d01ba9558f1f36a3dfd90a2bd3172ac19518778ca0e33e08787
- MD5 8a88b3a42e64f494d9896f0155c9a052
- SHA1 f691966392fb6f145b0b27a9fc023003caae3e33
- SHA512 d174395a15b07f3b583e5e286250f6c2d523d781e0b5155c33af0575c4619c02d0461f5e6bbc41551ecdd160126f63933d79124cf96062193bc2c88fa9436b97
- SSDEEP 24576:WDwvtk9RX6wkyAICYfFmT+EP4fA2OVyekxdrMUPXiF:fMnYICYf8+x6yRHjPA
- TLSH T1FE45E029EBDC44E1E17B913C99B7460AF6B178691B31C2CF029A53AD0E37ED0AD39711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 e84afc02c4625e8f86e0e7d284054c47cf68a4bcb563cb3fc0dd2037b25a9fa7
- MD5 534fee7537486b1a530dedad43df454e
- SHA1 ea8fa15f317d9028f0c09980c43e8ca4858a4293
- SHA512 32a2950a91f7b526de4b969d49207470a5e5bc1f476c5442bf39dc971ac8ef85d50aae1919532bc582364f49317532ac90bbffb22f8527d55a81c53f5b9cc44d
- SSDEEP 49152:OYO4Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08Yf8+x6yRHjP:/ySzPkYUC6yRD
- TLSH T134067D56A1A841D5C1B9C1B98B1BCC1BFBB134090335ABEB03E546935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 2b0e040aaa769d33adfefbb7e0efd300cd2ff7ea5061c8f947851d2f3aea60b5
- MD5 da980c09a63c55a367dd7776430ff588
- SHA1 ae5ae345e7061aea6c6cae8089ea833b83a96757
- SHA512 a5143d8702298f594f7c89a8e4a30e32c01d30e931c63b0cb79994f74a0cf1070350d78d5f07db2952281946a4a7796381542c198d2b21cb1591bf9cbaa8c277
- SSDEEP 49152:Ps7JUQjXirIhCnDHUPfF/+7Yf8+x6yRHjPA:4JtglD0PaYUC6yRD
- TLSH T1FE75BE1EA3EC01E5E17AC27885154A5AEA71742E1B31CACF12B0837D6F63ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 ed1bf3026f935d2310eff51a3dfa7d15dcb26ce1ae7730f679bd17dffa358494
- MD5 9f610e95fe382a53fbc5a3afa4217e13
- SHA1 22c00b7cd0afe519c8f76bb839e13227c0132b9a
- SHA512 7a494f0b88d432e0252b751d18ee64200fc517403b35a6be1e30412de59252d550a4c3dbc37e784dbc5ad58bf7e30e94cc1c1df57e590ef6d66b7345ebc9b28c
- SSDEEP 12288:Dx7mYfHFmBco+olT4qH8Ff3QZgTOV/aeJQFldjt5x/5to2ArVyPfPOuhihP5:FmYfFmT+EP4fA2OVyekxdrMUPXiF
- TLSH T1B1052313F2A9C4E1EE3C80B2B56F89147F68B3A11358D2C7E28943594DA6F41ED78B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 56c32558ee18f9efdf5f9211ba84befba10fa1f77cbd0e088fbc4880e1b989fd
- MD5 a151ecb75e82389d2287b336297b6be5
- SHA1 9dfcac2e34c8310b79fa4fc5408a8545927c0aa5
- SHA512 ec4edc17c5b58c4006cd1070c0885f837842a53c24dd63ab9f15a0966398ca5049e340d02ccd45f1d4b2cc3a691aab710dae491f363f7ab70fe3fdc060dc688d
- SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYhYfFmT+EP4fA2OVyekxdrMUPXiF:tgb4mBIBhGFoYf8+x6yRHjPA
- TLSH T1B575BE1E22EC02F5E1F9D2B8DDAA4417D6B278160331D2DF1251426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 b807f72ff715e57f651d5d8d415c05118d5b454ced45f2b94d5ab834222b303a
- MD5 771daf2414ea65b5fe0f4f70defe609f
- SHA1 c197b67e68f3b1453f0cbca61ec7304a24744a23
- SHA512 d961de4617e3a3c85b687546febadda767d8d60736c927363b2c38dc7290451b0010601da8869c82718adc426509866f87ec6d816810b910f21a7c91ae590f19
- SSDEEP 24576:nTkNvNnaFeYhJNtmZBmTYfFmT+EP4fA2OVyekxdrMUPXiF:nTMwBtOmTYf8+x6yRHjPA
- TLSH T12775BF2EB6B845E4D1BEC6B5DE238512FA727461033293CB9390C13E0E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 832KB
- SHA256 207e7c27f012081e968eb7d0b0f466de4dd09e02a6e29fac9c412fd4c7b1f923
- MD5 789492b154b5e2adb8f227490ff383f7
- SHA1 fe58ead12acb77e5a442a075d6af53ceaa5762f9
- SHA512 a5b4a7c6e65098e0b7d81324ea9f954f581d54e633045b1757c233fcb77b1962db53fad28b71fdfb1c2b051f52177e506e3ff17899c87d7bb4196c5734751eee
- SSDEEP 12288:TyG5oYfHFmBco+olT4qH8Ff3QZgTOV/aeJQFldjt5x/5to2ArVyPfPOuhihP5:GG5oYfFmT+EP4fA2OVyekxdrMUPXiF
- TLSH T1DD05232AB1F690E0CD3DC076A5774456BEB072A1132892EF46C582794E96FC1F93CF46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 796KB
- SHA256 ead525a69b9dbe1efe904a4c0bf38fc12f8e93b57783050a0d937d3c3a35e1de
- MD5 6012b509468469f65800a13cb29aacb1
- SHA1 59c45bf13cc09274479e15819d12c1eabd9e3d41
- SHA512 77ff8156b171bdfc1bacb2ba91fe5871965bab617a9f74bf960d472e1d62a51d17a34c6c8ce54874d86c949595465833f0ec9d28516ba4f3b1358a38eff1b9ee
- SSDEEP 12288:EcYfHFmBco+olT4qH8Ff3QZgTOV/aeJQFldjt5x/5to2ArVyPfPOuhihP5:EcYfFmT+EP4fA2OVyekxdrMUPXiF
- TLSH T108052313F1A9C4F1DE2C80B2B56B49457F64A29213AC93C7D2CA42590DDBFC2E978B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 209c769143690fdffbab07b970d3199a0958d65cfb1e33477894c7818afd8407
- MD5 0fbafb91aface33234702cef8587b665
- SHA1 25b864819222d135223ffcbb5b49d28cbed39c6c
- SHA512 c6f35e72d75c87b5210f109995606e7e5acc823b92fae13ec36af84307f91b3f73406040412366a67aaaba27d11fd0db837286883a1aa2527160532146c35fdb
- SSDEEP 24576:B688N8F8JqH1vzria7/mKYfFmT+EP4fA2OVyekxdrMUPXiF:Q7eFUqVya7/nYf8+x6yRHjPA
- TLSH T10D550166B6E101F1D47BD0388A964663FAB1B4210364EBDF07AC8B551F23BD14B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1000KB
- SHA256 5984e804302443249d9a7ce9657e11dc3fbc193149cb4d51ce6d489998721acb
- MD5 28be4a9d252b88b4157e62239f6e43d4
- SHA1 c2919bc3931afd28e6aa0af56574352b58498fef
- SHA512 9155b74cae52e92f2b7bb4566282bfaf374d06c299703c488f2ddef1db4a0fda2bda7a7f12f2978db526ff7b07047cbee294db995a28e296de86710cdf6bc8c9
- SSDEEP 24576:xPUr+NQrYfFmT+EP4fA2OVyekxdrMUPXiF:xJQrYf8+x6yRHjPA
- TLSH T11525F12F72E918E5EA3AE07D9A868609F771B4621311D2CF02D1817E4E67ED4BC3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 46b4ba68bd0b137e0085a92f7801c089e9f00c87e1103c54de03924c87334eb4
- MD5 9769815b1af068f81813495756479bcd
- SHA1 3f121b1373ef08342308502dc026ab87ecf02c37
- SHA512 fb2b47efa1d22d3a4ec1d16ae275570f04ed355f4b719f4350a1b8281ba14f0d725a57d2c80e97b40b21d66fc55501bd243142945dee29aa415f536f6f6532e3
- SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeYf8+x6yRHjPA:bG05lO43bNYUC6yRD
- TLSH T117D5C06A62EC11F5D1BBD17CDAC64A0BEBB23415033456CF02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 924b6491e2dd0a6c247ab021e304e254c05825e2720a32a14164c9494636b3c9
- MD5 5598daa2d55c66f00487477bad382005
- SHA1 87da8656ef7dffa2a03a969e5ffe3f58d729fffe
- SHA512 38d6c5803cd7f6e6ad73ca4d1e5755771fbe4b95eaf0052c73a85014b388676dc02f1e6baab5fca97ea03d8cfce3612a75a626b2d639879d3b9de0cda9bfbc06
- SSDEEP 49152:aa5POZ3wJt2pasx2+mEOYf8+x6yRHjPA:+UiOYUC6yRD
- TLSH T1E175BF5EA6FC00D5D579D17DC5838A1AF5B1346253319BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 3dd5ef159d2f48fea0b7f78f19293c84cdb1bedc22ae53fd79cbefeac75ea412
- MD5 1956a427c6b39d79e207f6333fd5d224
- SHA1 daa754bfa9c93026ebf2b0c07dbb52605f2dfd0c
- SHA512 97d223f9e1487fca708262cd56a905527d83f42355104d8e2f105fa1fdfdbd83389abcd09bf4d145420f895b0bc8ed673f27d9c3c02c1bf34dbcd1339e844ecf
- SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkLYfFmT+EP4fA2OVyekxdrMUPXiF:bNc/zEOVHF6Yf8+x6yRHjPA
- TLSH T1FD959C1623E901E4F5BBE1BE89779546FAB17865133486CF0291811F1E73BE46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 2642a6ee75a49f8cbe37b1649f63c24230007d9a977ad2d58c14b892cc736bac
- MD5 a2cb8431f0163e1170844dcd7508ca93
- SHA1 4cefcc84bc35d6de875d275c26d974fc9db3ce02
- SHA512 841e95c244ecff73b4bb28cb1732d61a7307e5a1474516773ffa79811945c24a269eae3d52da2854fb62984ce94a2b6c5d29ea8ca366c3be2017c4fb62929698
- SSDEEP 24576:XD3FHshBIYQgA4YfFmT+EP4fA2OVyekxdrMUPXiF:XDVHeBIAA4Yf8+x6yRHjPA
- TLSH T12D45F13EE6AD04E4E57AD1BCDA638A06E77174A9032556CB02D481BA1F6BFD07D39F00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 8472df1f977b79d274a5566cbac09c3e57a539f539d6e06bcc2a041e5e1eee36
- MD5 f71e64a3dbfa5523e84e6de60bf74611
- SHA1 fb49ed2d90893f9bf3477e1ba7f6502681f7f9ec
- SHA512 fb7d1bed4f6f993c69d4c9883f804fa2186f735411746ecc5d0d370e5a0d0b0c6ffc2cccf89b54c7fe7046577054f2b0071b021a50d0bb446229f75d70095e4d
- SSDEEP 24576:QJnJPbzB4SAYfFmT+EP4fA2OVyekxdrMUPXiF:QJnJv6SAYf8+x6yRHjPA
- TLSH T1E935F03DD2A810E8E8BBC1B4811A0A5AFF31347D2B2569C759B8D5343F52FD0A939F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.2MB
- SHA256 2b256db15646fd20e7d8ed53b0778dc9c67a3789162f7ee38cbd3484ba4d8042
- MD5 0286eda42a6d96356670632233de83f7
- SHA1 3d7e7b3779dd49f4204050a3c61f0e7835b9e979
- SHA512 d8dbdbf99dec8707ffa49c413135da973e517b100a5379e2477006d757638d766f898ccc1520212510b1f7f01ce11b9d574b1d5b59f640adaf443a29157d0362
- SSDEEP 24576:lCLHGL0MoeVtFumTijCmlKQWDkHYfFmT+EP4fA2OVyekxdrMUPXiF:lCLHGeeV5ijCmlDWDkHYf8+x6yRHjPA
- TLSH T16EA57C05E7EB4184E8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 948KB
- SHA256 2263bea9a214d15b3119c6be09502b84516ebafba138da2c06050074e2c639b5
- MD5 b0a7f69b15798c338d9432f1c3d19c69
- SHA1 d12693d88cd80bd586b337307891845300b1a602
- SHA512 be9d250174639a748c6669c667d445d4edcd3c979a67702676a1e1ea6aae0dc595ee081a09972aa80c88a1a4acb14554e9c8ac19ef9ac5d9b3a628332935c4c3
- SSDEEP 12288:m1HKk6j5ZI71YfHFmBco+olT4qH8Ff3QZgTOV/aeJQFldjt5x/5to2ArVyPfPOuy:Y6DIJYfFmT+EP4fA2OVyekxdrMUPXiF
- TLSH T11925011D73BA10F5D12BD03A96934502E6B1B1B1836556DF47D8C2BE4EA3EC8B93CE42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 932KB
- SHA256 8e7cedb24f990d17ecb05125550bace2e32ff675c43412f4d96d1d4c255554e5
- MD5 ba4bbe68871163ed7a3328f094a2bcfa
- SHA1 a7963eddfb247fad1128b3d013e12ab0be8be47e
- SHA512 9a1ffdf49af30d4f50959b9f69d997d9754c78fda0d66768d51f09988683def1bc8cccc192800e00bf2bcfad47eee462881b376197145986ee41450c48413a5e
- SSDEEP 12288:gG6kyrYfHFmBco+olT4qH8Ff3QZgTOV/aeJQFldjt5x/5to2ArVyPfPOuhihP5:xtyrYfFmT+EP4fA2OVyekxdrMUPXiF
- TLSH T19C151202B3A890E0EA3D4175AA778194AF74BD61572493DF92C1A32E1E76BC1FD34B07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 940KB
- SHA256 2c78b6848a055873d5d9efc92a7fdc8899ac4050b1453fe94fae79db9e44b7a0
- MD5 988a4bfcf9bad4dc01781df037669827
- SHA1 b0cde186a1f07fe2063437fa63e2afe13670e9fb
- SHA512 8a1f7bba653c86aec7ffe21d27f10bf19bb9f95e10d6ff462cd76fc8f2fbda335bfbad7ebe54e8279a5713ef4fac397d207ccca10c4705f848fec2e6548524a8
- SSDEEP 24576:26UqjptYfFmT+EP4fA2OVyekxdrMUPXiF:26UeYf8+x6yRHjPA
- TLSH T1A125121AA2E454F5E93D8070E96781159A70B972137892EF72C8827E4F36FC1D93EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 804KB
- SHA256 d4bcc28102e8349f5856c00a36eb491b9c36b24813633ad4333bb361b56371d8
- MD5 61554fd4dbb1555f4b82ef3f75e195dd
- SHA1 1666de90665686dc4976b89907abb8f577301943
- SHA512 21472c44556923cc4dcab1f04c19f8f3b3dbd010dca777f1506627e2a4e67585b52f1e7f565eea3f63d98bfbae6029a0a26487ec5e82c76ad72e4de6c3b6f086
- SSDEEP 12288:l7LYfHFmBco+olT4qH8Ff3QZgTOV/aeJQFldjt5x/5to2ArVyPfPOuhihP5:RLYfFmT+EP4fA2OVyekxdrMUPXiF
- TLSH T137052316F1B590F1DD2C80B2B52B4945BF70B2A1136C92DB92C942794E9BFC2E978F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 6af2e79d475d0e69ef1096f65d73d0f52d67438c89b8e8eb060b212f1f0e2cd2
- MD5 8069463354353f794fb1a1704e1130b0
- SHA1 9116f2fe7e88802981e9e488fefc861fc5b4c1e9
- SHA512 9d3eeeb16c426371d7d5fcaf5ed8cbbe3451daea8349822f57c81cd635f5b9cecd96b2dddca9a59bb274e80acf57ac94e67b46aa249b26e0958196643af396cb
- SSDEEP 24576:Jug8BoTfaidZ5YfFmT+EP4fA2OVyekxdrMUPXiF:IgZTrZ5Yf8+x6yRHjPA
- TLSH T162659D1DB3EA05DAE2B2D275D9625493DA33B4311371D6CF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 964KB
- SHA256 3f76c60a40093910f5ed56b87efc7ea6c01e258626ef9d32b5ad767b6a544f86
- MD5 00b5a1f235dc41ba07b5c35c8824b0cf
- SHA1 adea870c751a9d194950a869b87ac264bd2f223c
- SHA512 795ab88bc40efc6a4e259d22669ab969e8d6e4501238dfcc944dbb394aecc8f7b864344ab577f5cec985d648ae85f084e7198f836dacb330b5a4afe91de20e81
- SSDEEP 24576:MrcmRgYfFmT+EP4fA2OVyekxdrMUPXiF:GcmRgYf8+x6yRHjPA
- TLSH T16725010EB2AE00E1E57BC07CC9464545FBB2B0712361A3DF4295837E4E67AD9BD38B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 6bba7307ece594db99db1dccea64953ae28f6722672ce24c0822e12c46805203
- MD5 0622672088f49aeb2ed9a49acc93716a
- SHA1 efb354886ad5166591c9ebfc955eec48c9b21d52
- SHA512 fe00d74440ee80cfa8c9572d33fe2f9eb13d79c8d23d74b7a2867ecb39acec0c61dd0233a1b2c3af08339ee3aca5132862a41480284661a1db5fd5b0f67fb4ee
- SSDEEP 49152:jDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3lYf8+x6yRHjPA:43Upow8sB+YUC6yRD
- TLSH T1B3B59D3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C178BF1BEF19A39F56
- MD5 SHA1 SHA512 SSDEEP TLSH