Analysis
- max time kernel
105s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:38
Behavioral task
behavioral1
Sample
2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 2.0MB
- Sample260722-ycevjstbrf
- SHA256 9eac1e2258801c346d68218ef23fd053c1fb098b36541ec4bfc6ccdd76f29322
- MD5 5ac8d33b6083a40d25d724150633c734
- SHA1 242c84805f4e7a5334420e3aee50caba80cc7b0f
- SHA512 905fc46b61a4aa01d0502d103c4dbdce47bc3b0cc99e8d58a919cc0e317b2b4c629069e478a1a8534e95a65fa6ff38d1c7dbf40cd34eb080c570e0800e1450bc
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/Wz/2v1owkWu0y4YTqMi8CtBd2QHCHmTBW5J:A3kMhT1Llj51lkWu0yPqJtb2Ig
- TLSH T11BA55A12E3F44665F0B38274CDA29656EA727C921B30C6DF1394776D1E33BC19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/5816-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c56d-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000008f19-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5816-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6152-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019967-553.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996d-552.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c86-1285.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0016000000018894-1484.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c56d-6.dat aspack_v212_v242 behavioral2/files/0x0003000000008f19-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019967-553.dat aspack_v212_v242 behavioral2/files/0x000300000001996d-552.dat aspack_v212_v242 behavioral2/files/0x0004000000019c86-1285.dat aspack_v212_v242 behavioral2/files/0x0016000000018894-1484.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6152 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5816 2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe 6152 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_5ac8d33b6083a40d25d724150633c734_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5816
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 9eac1e2258801c346d68218ef23fd053c1fb098b36541ec4bfc6ccdd76f29322
- MD5 5ac8d33b6083a40d25d724150633c734
- SHA1 242c84805f4e7a5334420e3aee50caba80cc7b0f
- SHA512 905fc46b61a4aa01d0502d103c4dbdce47bc3b0cc99e8d58a919cc0e317b2b4c629069e478a1a8534e95a65fa6ff38d1c7dbf40cd34eb080c570e0800e1450bc
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/Wz/2v1owkWu0y4YTqMi8CtBd2QHCHmTBW5J:A3kMhT1Llj51lkWu0yPqJtb2Ig
- TLSH T11BA55A12E3F44665F0B38274CDA29656EA727C921B30C6DF1394776D1E33BC19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.1MB
- SHA256 f954e5477abbad75a62902e32a5fd86d6797abc9c6b475aacf08be562e5f1c96
- MD5 fe395410b9b4fe9cab46d2de91267bcc
- SHA1 050bd89e05b909ada8d0f8c2a03f4eadd5dd907d
- SHA512 e6498438ae50eace0f0ee616cc5762e9a348bebfa5b2019c779d4edf80acaf602b74dfc72129ae331ce4f48445b570718a4752d1438ea486b46afd89293ab74b
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/Wz/2v1owkWu0y4YTqMi8CtBd2QHCHmTBW5o:A3kMhT1Llj51lkWu0yPqJtb2I8W
- TLSH T10EA55A12E3F446A5F0B38274CDA29656EA727C921B30C6DF1394636D1E33BD19D3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 ed3583af0cda20c0404ed3bc4a18ccf9dd3ee731856acba1e87c3ca7a7c4a9ee
- MD5 37322cc0de56231b5ff44fcc2d2cbeef
- SHA1 13b5a2dbec609f6e6128922bf5f194c04d059dd0
- SHA512 daa95eb62186284e3cae89161fe6f9920052af2502259c6ed9478a0026560ee2462af49c792132c4f6206beaeedbcd1725290387e7ebdece6cb2c33023f6174d
- SSDEEP 49152:A3kMhT1Llj51lkWu0yPqJtb2I4Pji0Aj:A3kMfLt51lkNPfjo
- TLSH T185C54912F6B44675E0B3C174C9E2965AEA723C921B30C6CF1394A76D2E33BD19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 2.0MB
- SHA256 2f16b340e91dfb6de68ac152d0796a19e3c4571bcbeca86780d96a2041a3cb15
- MD5 22fc0cd5043502bfec73e6170d61d0d0
- SHA1 0880932c6eb1878d91cbce92ab23ade27963227d
- SHA512 8878789cbb2475dccabbb4ab6eb7d3328ddd82640def4390cf017736cce0e34272f4fb56bc7e0f87a2f49d376f7b8bde1a38609ffa5da1c8e9e9d6b97e28d287
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/Wz/2v1owkWu0y4YTqMi8CtBd2QHCHmTBW5E:A3kMhT1Llj51lkWu0yPqJtb2Iz
- TLSH T114A55A12E3F44665F0B38274CDA29656EA727C921B30C6DF1394776D1E33BC19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$
- Size 2.0MB
- SHA256 f88ddd620850e167ed3c2dd28ac6e0782af6fdc7816da741de907d5edbbcab7e
- MD5 cfa582523f255459cf02e77ad24e7b96
- SHA1 fc3a73ee25130953791f64616336287ccff6c794
- SHA512 e1d8b4b9417b8a6b438f75f37b86eead63a727cafac5aa228bee3c344d54b7dc164e7b0ae0a3ea3d8fa202aecac4ad9e975895407d2b8aacdce05e3bcec3ef81
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/Wz/2v1owkWu0y4YTqMi8CtBd2QHCHmTBW5T:A3kMhT1Llj51lkWu0yPqJtb2IA
- TLSH T14FA55A12E3F44665F0B38274CDA29656EA727C921B30C6DF1394776D1E33BC19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.1MB
- SHA256 5744db9543326ad9ae198f97bb93563073748766364ec1d542d3cfb5dc3f315c
- MD5 2667bb2a08c90855ca264371f9fc1ad5
- SHA1 71edc492608c889731e18ae7b37bf43c71093b20
- SHA512 3ecc99c8ee4dc8c9ba6be9aa34d5e1982bcc7c0e70b1fc13730c3b6a7ccab2fd098c61435bb75027a6f756f648801439b760b54326e9def7da898d209b571d79
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpx097/Wz/2v1owkWu0y4YTqMi8CtBd2QHCHmTBW5P:A3kMhT1Llj51lkWu0yPqJtb2I4
- TLSH T1E6A55A12E3F44665E5B38134CDA69656EA327C921B30C5EF1398776D1E33BC0AA36732
- MD5 SHA1 SHA512 SSDEEP TLSH