Indicator,Data,Notes
sha256,cca5ae87cd710a8fbf994addb0abc8bf1deb222214d4831289885de23ca98924,textinputhost.exe (renamed rc.exe)
sha256,c1bec59afd3c6071b461bb480ff88ba7e36759a949f4850cc26f0c18e4c811a0,TextInputHost.dat
sha256,f682323a2c543abbe12c21a77ee93b49444381fa33f76c67363c84764ca4c675,sc.cfg
sha256,506b21588541243f3ddd5acb759bf20a3bf06fd2fea455066866154bc5e59721,appmgmt.dll (Stowaway)
sha256,4ae29b8124f6221dab934ac04afed2acc8b17c6b35120d568bad8658cbca01c6,check.exe (NUPAKAGE)
sha256,56F0C8047203147D9B9A888EBAC8F33B14AE198182A13913A0F93652DFE2052A,appmgmt.dll (Stowaway)
sha256,b708dd11942c3e87a8987bdf83f7ea603425ae75fc25a306f54f1087df4198b4,swprvs.dll
sha256,f830c3771d35237b4a63b946d7a0d187f5aaa4240e965d74070b7d72b6fba210,winbridge.dll