Analysis
- max time kernel
85s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 12:15
Behavioral task
behavioral1
Sample
2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
- Size 1.8MB
- Sample260727-pe6ava1gla
- SHA256 fabdfbb0c1bc636db9c524a07585518baa75fa299ac22c8e9f66a669ee1f7509
- MD5 4818bcbfe55e43f8ad4d3ed61ebb7f12
- SHA1 97ed47a8e53c38c2ec5c47853b0fffd00dbbed79
- SHA512 87d24869e7e4830e87c5dcc0a316f1687b89a633f9be4a240e4751f7ca493849af1ea47580449268c176cbe1b27a83febbb6d9735f2156d8261ba5f28084f1de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyE:A3k03kHRJARJ456rapYq
- TLSH T1D0853916B6544AB4D02B81748592965EEB323C45CF238FCB13449EEDBFE26D09E39372
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/3916-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c55c-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3916-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4276-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b6c-676.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8f4-1088.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d70-1228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b95b-1558.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b801-1637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000000013e-2092.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c55c-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019b6c-676.dat aspack_v212_v242 behavioral2/files/0x000300000001a8f4-1088.dat aspack_v212_v242 behavioral2/files/0x0003000000019d70-1228.dat aspack_v212_v242 behavioral2/files/0x000200000001b95b-1558.dat aspack_v212_v242 behavioral2/files/0x000200000001b801-1637.dat aspack_v212_v242 behavioral2/files/0x000300000000013e-2092.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4276 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3916 2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe 4276 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_4818bcbfe55e43f8ad4d3ed61ebb7f12_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3916
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4276
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 fabdfbb0c1bc636db9c524a07585518baa75fa299ac22c8e9f66a669ee1f7509
- MD5 4818bcbfe55e43f8ad4d3ed61ebb7f12
- SHA1 97ed47a8e53c38c2ec5c47853b0fffd00dbbed79
- SHA512 87d24869e7e4830e87c5dcc0a316f1687b89a633f9be4a240e4751f7ca493849af1ea47580449268c176cbe1b27a83febbb6d9735f2156d8261ba5f28084f1de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyE:A3k03kHRJARJ456rapYq
- TLSH T1D0853916B6544AB4D02B81748592965EEB323C45CF238FCB13449EEDBFE26D09E39372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
- Size 2.3MB
- SHA256 fe155b55b5cf2d676c0101583aa5c74bad1e05c6844075adbf77e2e6b310333f
- MD5 662a075006a8a847da92f4f454ea2924
- SHA1 b13bea09261b11618ba29faab310de0f1f573428
- SHA512 5954a7cb06603202676a8436b1fe36d4fc5b7f4234e8eb04878b0c55b9673a8bf0b06c8d1374a5f50f9acf8c508fe60285b47dba3d541e22085ae6646e82675e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyEe86E:A3k03kHRJARJ456rapYq+T9t2
- TLSH T1DBB54A02B6544AB4D06BC1748592965EEA323C458F239FCB13949EED7FE36D09E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 1.9MB
- SHA256 7b32002d2861dea1e12057bf179025d69de4a8661262493aad7bee81071ff163
- MD5 fa0c46eacfac4f2f95b4a084949b2f28
- SHA1 2e9e0be9395bd99692f5c322359a7c0a88628543
- SHA512 d093c89383b4652dbd57e64d7451c65b59c988fa5ebfd8538cf8fdee7b7f39357c3fbb5ca5b5b629cb9f9a18a620749c1e71a32d6d87dd98bc3babf0ee02d035
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyEdTjE:A3k03kHRJARJ456rapYqdw
- TLSH T1D7953916B6544AB4D02B81748592965EEB323C45CF238FCB13449EEDBFE26D09E39372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 f06d0fe9bee48e7179648c38cce19d461f415980fa718aaa9bc931c78eba6ed0
- MD5 dfdabccc025d4e7b159cf441b70bba40
- SHA1 00bc93dd8f19710df5f048fefa102da4c48add41
- SHA512 26745039d8ffc17b7a3175a38c397c09e7bf10f35e98de9fd09908cc800bda5300b5fb9eae4778946aa5aa399046c80c9a71ebd1c2de1d2cf088f8d6bd9c05e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyED0Lu:A3k03kHRJARJ456rapYqjPji0Aj
- TLSH T183B53916F6644675D067C078C5D2965EEA3238418F328FCB13459EAC7FE36D19A3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 1.8MB
- SHA256 8f7f2a10ad95bc84803ca7280c89ca6f9fcbed0631c5e5a8d89e73ffd5a86b44
- MD5 e8076c50d5b7e53888b97b8421855641
- SHA1 b2a985cb680ec2003ad43b4fe4e96338daccaae0
- SHA512 03f422460f6599d8ded537c7a53eb0049cbf91e86990cbcdb0f82bf6eb2500f62cf3c0b11ac2d58fead90947ccc78f1bc2cef08d722090dd262cc42de0ae0ca0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyEt5/:A3k03kHRJARJ456rapYqD/
- TLSH T1EE953816B6544AB4D02B81748592965EEB323C45CF238FCB13449EEDBFE26D09E39372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
- Size 1.9MB
- SHA256 e8bbc179ecf138c2f5e8db32cf0804644befba724af710061c3df8dfaa5ee507
- MD5 e7822dd3fb63782297e880f5b0a71a73
- SHA1 5f7c195f4fc1ea392bcf07316392f8b5c8b9d910
- SHA512 cee4c771c3b194954c43dcf4d53b4cfb5933f7513508623c1563a6c4281416463c5ac614ed8c919b7f2a2f00f34a2c5cf47d929fae4b2311c857114a1c63c895
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyEJW:A3k03kHRJARJ456rapYqs
- TLSH T184952902B6944A74D06B81748592965EEA323C45CF338FCB13549EEDBFE26D09E39372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$
- Size 2.3MB
- SHA256 5fccf009255df28488cc1dcd49b4ff025a6489223f18fd7154d0b379fb96cc34
- MD5 5988726b0971f9630f16ed2d7fba6501
- SHA1 fc4c3907f3630af5156fb49be71a4b7bd4b22cfb
- SHA512 7744a00610bbdbba209cd4dd3ff893386358f950264dfd88e1bf9391040221562ce29a3a9af62408d3f6591b3499ed36de6892bb9c10ad0a7398a974a77b756f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyEpi6:A3k03kHRJARJ456rapYqJi6
- TLSH T127B50742AB158EB5F01E84348591923D96333D198FE34FCB124E7E9DBFB268459F8236
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe$
- Size 2.0MB
- SHA256 58d06b89d44849a629fcd7d44f9bc471df960c3d4c19f07e77b74673c690b730
- MD5 e2529af3145a086f567c9459613c809b
- SHA1 cfb1c1b127114b4a3ff66f1f6f8448b9f5ecc5f4
- SHA512 ef55836162c9e388195bd3a67de14c100a3d7b1fbc914aad951bfb1f29b265286d65d58521380493da08cdefa944ffcb5378c681d70a409c3eeb08a41478020a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+gEYdYCKz4D5Tvinrmh5jcAkSYqyEfV+r:A3k03kHRJARJ456rapYq/i2WH3
- TLSH T176A54B12B6544A75D06B81748592966EEB323C41CF238FCB13449EEDBFE26D09E39372
- MD5 SHA1 SHA512 SSDEEP TLSH