Analysis
- max time kernel
97s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe
- Size 3.1MB
- Sample260718-b7erpsct3n
- SHA256 6be4eb252c8cfd4bb0ad5b1b27f4beed33c2155e83d29dc8083d82449c50b43a
- MD5 de77d67a721fa9d7898eafb30ab472e0
- SHA1 74a86a94dc15b5e6a7b05ee2875bd236940d39fd
- SHA512 654dd304082d18f03417eb0e5ff6c42d5b694384c100d22f69c5f8f8b825fd09818966e42661b2331adc20bc7da70d64947f8e93165493625ee5a53f018a85ac
- SSDEEP 49152:4DHXAWSytLoqUUK9NO8xmN3Aek03noj45wlDTMcY/v85D:/stsFUSOeUJF3noxDxW8h
- TLSH T168E55B12E6504471D52A8231CB65F999763B7D2496628E0F32C1FDAEFFF13816E62323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2560-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c52a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a364-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002e000000019cd4-1245.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2560-1966-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4648-1979-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4648 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2560 2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe 4648 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_de77d67a721fa9d7898eafb30ab472e0_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_r.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2560
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 6be4eb252c8cfd4bb0ad5b1b27f4beed33c2155e83d29dc8083d82449c50b43a
- MD5 de77d67a721fa9d7898eafb30ab472e0
- SHA1 74a86a94dc15b5e6a7b05ee2875bd236940d39fd
- SHA512 654dd304082d18f03417eb0e5ff6c42d5b694384c100d22f69c5f8f8b825fd09818966e42661b2331adc20bc7da70d64947f8e93165493625ee5a53f018a85ac
- SSDEEP 49152:4DHXAWSytLoqUUK9NO8xmN3Aek03noj45wlDTMcY/v85D:/stsFUSOeUJF3noxDxW8h
- TLSH T168E55B12E6504471D52A8231CB65F999763B7D2496628E0F32C1FDAEFFF13816E62323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 f51776648967ead269e3b6aaf00091b34e02857bf45541f3f77085b8436d6a0d
- MD5 a45a01d1f24d9f1242c72a821a005cf9
- SHA1 6e20b3dd35c7670afa3988b41ce1105745709d8d
- SHA512 caf7ba83081941d80e74203ca5ca40591667d985331a64a251ff9896dca8a6f3802beb73943e28267e8052df7c0f6c13752d6a7f917a462e21cd1bc1b1a9bda1
- SSDEEP 49152:4DHXAWSytLoqUUK9NO8xmN3Aek03noj45wlDTMcY/v85/Pji0Aj:/stsFUSOeUJF3noxDxW89jo
- TLSH T160067C12F6604571D4268231CA91F999B6377C1097728E4F22C1FEAEBFF27815A66333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 3.1MB
- SHA256 bbdc0f020431e33d3e6680c023ed50a6d6a164aac2a417ea671ffd3f405fe1df
- MD5 9cb54433c035b5bbe5cb568f99f26ec5
- SHA1 4ef9ac511e73b0ae525125fcb14071f2146a8f31
- SHA512 2312f5e2a72609bfd7a601ce27c8b7b701cec153805e138b2a5fc7355d286f5f7886a3c775b23e197819237b3e569a5e1a76b5dd6567f9e903f647013c00c77c
- SSDEEP 49152:4DHXAWSytLoqUUK9NO8xmN3Aek03noj45wlDTMcY/v85Y:/stsFUSOeUJF3noxDxW8a
- TLSH T199E55B12E6504471D42A8231CB65F999763B7D2496628E4F32C1FDAEFFF13816E62323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 3.1MB
- SHA256 1e48b6985505efcdae611740b23f2d6dad24e47cec0a5f508fe2f26e8aff5868
- MD5 0d3fa063bcc240e827247b4c9a0f2ef7
- SHA1 b4aa70dbc394a464794f391b76d05c6880ed1ce8
- SHA512 dc880f6c00c65f835d85198ee10bc65a7c48282254dd0fdbad5a228ae130c342a6195c61f015a3c2a5dc011432d421796f0e94663a0a71d8b18d906904466d1f
- SSDEEP 49152:4DHXAWSytLoqUUK9NO8xmN3Aek03noj45wlDTMcY/v85o:/stsFUSOeUJF3noxDxW8S
- TLSH T1E1E55B12E6504471D42A8231CB65F999763B7D2496628E0F32C1FDAEFFF13816E66323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.2MB
- SHA256 8e62203ce694e971cd3977c55949a5020c6c98b40660219f080f8b025418c93c
- MD5 d8f8b9217a780fdabbe77370a53596a8
- SHA1 0f5ccff0504593adf4e652874752a04872a146ff
- SHA512 79df0cd98c89a5a7637264c3c239559cc02db5382d0e8515b45b3a11491b87ce5443f38d297f74deaa16951ca48e741da2e4ea882f0b4d42d93b515c3f309182
- SSDEEP 49152:4DHXAWSytLoqUUK9NO8xmN3Aek03noj45wlDTMcY/v85B:/stsFUSOeUJF3noxDxW8n
- TLSH T183F56B02E6504471D56A8230CA55F998763B7D249A624E5F32C1FEAEFFF13816E62333
- MD5 SHA1 SHA512 SSDEEP TLSH