Analysis
- max time kernel
93s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 17:06
Behavioral task
behavioral1
Sample
2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
- Size 1.1MB
- Sample260717-vmjppsb14x
- SHA256 dccf02bf79d3857da48ff3264e6962c77936e0f9a3f9e882414c861847edcaf3
- MD5 5209e4db8174fef64f7777f0b891a5f0
- SHA1 df463ab26d9b74a6e28e61155e69636676702732
- SHA512 889cf6d81581c5bf69fcf9a39a3099c0cdd0335777b9cfa71eb6e3d1bf17867396541a5174b0a15e911857cd9a963dfa20116fbc20af14e84b9ddbaa2f53848d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1H:A3k03kB56rQI1H
- TLSH T149358C13A6840FA5D10F81349A958672EA777C125F6097CF2354AE153F72BC0AB3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4648-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2132-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002442e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4648-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2132-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a9-216.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021886-751.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002166c-1298.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000020412-1458.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003900000001e0ae-1558.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000719-2101.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002442e-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x00020000000212a9-216.dat aspack_v212_v242 behavioral1/files/0x0002000000021886-751.dat aspack_v212_v242 behavioral1/files/0x000300000002166c-1298.dat aspack_v212_v242 behavioral1/files/0x0005000000020412-1458.dat aspack_v212_v242 behavioral1/files/0x003900000001e0ae-1558.dat aspack_v212_v242 behavioral1/files/0x0003000000000719-2101.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2132 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4648 2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe 2132 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5209e4db8174fef64f7777f0b891a5f0_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4648
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 dccf02bf79d3857da48ff3264e6962c77936e0f9a3f9e882414c861847edcaf3
- MD5 5209e4db8174fef64f7777f0b891a5f0
- SHA1 df463ab26d9b74a6e28e61155e69636676702732
- SHA512 889cf6d81581c5bf69fcf9a39a3099c0cdd0335777b9cfa71eb6e3d1bf17867396541a5174b0a15e911857cd9a963dfa20116fbc20af14e84b9ddbaa2f53848d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1H:A3k03kB56rQI1H
- TLSH T149358C13A6840FA5D10F81349A958672EA777C125F6097CF2354AE153F72BC0AB3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 1.2MB
- SHA256 c589a6f072700dbede6738c14ca50235e1dce3c48baeeeb17d253691cd1386a5
- MD5 e2dbf3647540a8ff01ba41dc848fd221
- SHA1 c577668447fd6b05c2049a28296504b80d163afe
- SHA512 8f750146beaff65b91e0007e87d9db692ee73408d0793b70bba79019dd58159cb3945769bebb932d46b513fdd177bb40d23099733e1bb1f7ffe10866ca333f04
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI10qU:A3k03kB56rQI10
- TLSH T15E459E13B6844EA5D14F81309AA995B2EA777C225F6093CF63189E153F327C0A73E35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 1.6MB
- SHA256 8875e14635325e2b82312ed0e770abab7220e7b965b047c0d4b8bc095addb48e
- MD5 d603272dfc0912e97c7c78c6cacc9493
- SHA1 32705e90e44e30862cc435100bb5a3b76d5a8b8e
- SHA512 162f518ccab2f0a185121dad82087044f0157c7c956b4e45c2a547915c91905f49a15bf8a9d711734e746335e050cc94ee31d6a511163c175f43e6581f1c9151
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1e86n9kAJ9tA3L:A3k03kB56rQI1eT9t2
- TLSH T17F758C03A6944FE4D01F81348A968662EA777C561F60A7CF13549E293F32BD0AB3E357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 7a07d5cca65e5a608cc44f8db04050a4bd5d327aa0134018006cdc28514bbd92
- MD5 e8d5b4b06ba0034caf6a61a8b8c5a97b
- SHA1 6c180973d96b5e666ddeff31c0915dfad2d2e38d
- SHA512 476856faab556b5579fae4d7f0eae7ce74302c01614d1db2421fcf6a60467bd2f4071087c9c667dfd669566edfae2881cdf5c3b3c5a594fb851564306e9c6831
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1D0Le5ji0hmxNrM:A3k03kB56rQI1DPji0Aj
- TLSH T111755A16E6A44B65D02BC074C6D696A6EA733C421F3087CB1354DE283F73BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.1MB
- SHA256 70eecd6dc5b2f8b1ccfa1f00930d56e227e8ae9815efdc47882a8b2ba6597447
- MD5 f00714f8a735394657c3b4808a4694b9
- SHA1 4098ea2ca2ede933a0ac6ababf6d2fba6dc120a1
- SHA512 b781e4b579ff8ca0dbed4ff47d74dd4451281c51946b274d463b1d0a6eb2bae9a009c59dec01507014bd9228b485853ec1cb718ec117637add1d47d85a16b0f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1IN:A3k03kB56rQI1W
- TLSH T176358D13E6940EA5D10F81349A958672EA777C125F6093CF2358AE153F727C0AB3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 1.6MB
- SHA256 6ba8c2ed6cd78ea199626ac5fc29d268543c040c50e53d6c82db89a4b123ebc6
- MD5 21403b7ca484afb405b9924afd381e06
- SHA1 105f5141ed095a5319029b95499769318921b529
- SHA512 04002a7993da1da3c980fb5c3a712391f64634f38d866bdefa91dac37e0abc309c94f9fa5566c2b469ca8850d01738d22cac935cdbb78f8f0aa4896a112c4ffe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1zUOlZ7q/c9:A3k03kB56rQI1zUOlk09
- TLSH T1E3757C17EA944EE5C11F813486968622E6737C120F6097CBA368DA293F337D06F39B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.1MB
- SHA256 d019d952011d84b23cacc3b3feea9643d43fe201561c0c1df9f73a187436933d
- MD5 dce585118331a343a9af7c169c013529
- SHA1 3c04c4d12d1c54e94749a40763f538d0be6e159e
- SHA512 e442fed2f2c60c0fbbef8cd99825dd0e8445d3d2c14eb25456a338c93c4e7fee2468aedf5f27de892f06ce0361d7d24896cd8183cde26e721ee2d0c2e42dafc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1PF:A3k03kB56rQI1N
- TLSH T104456B03E6850FA5D24F81309E958662EA377D521F6097EB2358BF253F327C0AB39257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.5MB
- SHA256 3c7c8e2a075b4d6d2b5d6a7aab0d3443af829dbdffa26a886602d991eca96c8a
- MD5 fbad01cd0d00b67ac81572541cee50ca
- SHA1 16b3f51915ccc6eb71320a064314fceeeff70959
- SHA512 199ca2b81c1ca641d82e1bc6140647665f74047ae83aa7f21a9fe5a39a48a4e31c523d1734f900f87068aa4283d0b79a905f43ea6ae1687ba1a7f5100fb54d0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjie2ivI1u3npi63iC:A3k03kB56rQI1uXpiMh
- TLSH T1F3756C03A7D44A75E1BB46309AB58262AA777C225F30D3CF23945E193F716C0EA39763
- MD5 SHA1 SHA512 SSDEEP TLSH