Analysis
- max time kernel
104s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 14:56
Behavioral task
behavioral1
Sample
2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
- Size 2.2MB
- Sample260727-sbfskavfpc
- SHA256 1757e8929176353f80ac1f16d8daf8f9753bb7ce80e55b662f066d9739be4813
- MD5 0f82989341aa6293c2a1440b0bd97b18
- SHA1 44393496635f1089974d0c8e04468c3e8e594b84
- SHA512 dfc14cacb246b0ee640163ed2440d622abead8ee49947f532947250c092881c27b53a8587e37e76dc72be09e55ab4b5ace54ae9749e71c596d545bb8c53b1c2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPYac/jYTqMi8CtBd2QHCHmTBW5Dd:A3k03kHRJ7qJtb2I756rP
- TLSH T18CB5F712E5944671D06F8074CA919659FA333C418FA28EDB1284FFBDBFB26D099B5233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1340-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c36e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c36f-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1340-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3772-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001acc2-1291.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f00000001892b-1527.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00090000000066aa-1878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000000164-2105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000001c45a-2176.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c36e-5.dat aspack_v212_v242 behavioral2/files/0x000e00000001c36f-13.dat aspack_v212_v242 behavioral2/files/0x000300000001acc2-1291.dat aspack_v212_v242 behavioral2/files/0x000f00000001892b-1527.dat aspack_v212_v242 behavioral2/files/0x00090000000066aa-1878.dat aspack_v212_v242 behavioral2/files/0x0008000000000164-2105.dat aspack_v212_v242 behavioral2/files/0x001800000001c45a-2176.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3772 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1340 2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe 3772 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_0f82989341aa6293c2a1440b0bd97b18_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1340
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 1757e8929176353f80ac1f16d8daf8f9753bb7ce80e55b662f066d9739be4813
- MD5 0f82989341aa6293c2a1440b0bd97b18
- SHA1 44393496635f1089974d0c8e04468c3e8e594b84
- SHA512 dfc14cacb246b0ee640163ed2440d622abead8ee49947f532947250c092881c27b53a8587e37e76dc72be09e55ab4b5ace54ae9749e71c596d545bb8c53b1c2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPYac/jYTqMi8CtBd2QHCHmTBW5Dd:A3k03kHRJ7qJtb2I756rP
- TLSH T18CB5F712E5944671D06F8074CA919659FA333C418FA28EDB1284FFBDBFB26D099B5233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.5MB
- SHA256 beeee105e4bde3b6d29dcaf6cdb1c48c341a9e0bfdad295782f471c7280a2097
- MD5 523899a6711b799cadea89ab3ed771b9
- SHA1 e3a8b70cc5a1f9a084c58966def19a962f083cdc
- SHA512 9c702b76455cda56e6523a6bd609c28b4a33aa2e755236ca72b33521b4b5e210bbc4d4e059b9aa95172bf94be1f26c06b4c9eb28cc231caa80823036473101f5
- SSDEEP 49152:A3k03kHRJ7qJtb2I756r/djY9L6FtLNw:A3k03kHRFvrVDVN
- TLSH T17CC51812E6940675D06F8134CA959659F6333C418FA28EDB1284FFBDBFB26C099B5233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{32D54D7A-68C8-4A48-B601-5B27D66D3DA0}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.4MB
- SHA256 62c50cf5a93294ff3dba85bddb9507bbca1efb6de02290ab3399e1f49c81a915
- MD5 5b8c7c2d66971dc728149c57145e5adf
- SHA1 ee28e71007ff059508dfb5a935712d40c513d96f
- SHA512 3166f25e22524362cde9da3dcd132eb6ce4ec6749dbb9f072a3e973fd12bd90d8aaf0152c151292138af2337e2320419f910fc97da154e4e5738e44464ac271f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPYac/jYTqMi8CtBd2QHCHmTBW5DJ:A3k03kHRJ7qJtb2I756rbMu/v4eY5Op
- TLSH T148C51712E5A44671D06F8034CA919659F6337C418FA28EDB1284FFBDBFB26C09976633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.7MB
- SHA256 a7fb2199c2c461a0efd49e866268f87bf52b5699267b86a44a0521645451c283
- MD5 a9428f63f445ff24feb6f141efedd3e3
- SHA1 477be238e69a58a16391ead3f54a11d0549afb85
- SHA512 6d64923e67b33484e4e9f0a55d42f21c179fde16a5cb366219c91558be5f482c83307311b13cc3396f584c8449dc42ce0be7da53d55ddefd3dd7290d59c3db2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPYac/jYTqMi8CtBd2QHCHmTBW5DV:A3k03kHRJ7qJtb2I756r7Pji0Aj
- TLSH T179D50712E5A44771D06B8074CA929659FA333C418F628EDB1284FFBC7FB26D19A75332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 2.2MB
- SHA256 ca792fdf02c4211fc966292a7bb8b60f976e54ddd894e8df50e01cbd18f749cb
- MD5 e13cd2b83a29e4b991fe629d17a8075b
- SHA1 6ba208022f1bba5c1c813ab351bec1cca2f79718
- SHA512 fc6bfaf81e42f7f665a318438893fbb925514e8538d014b90ef11ea430b2e7806e04e8780942703ad97360f9bd38176c795475169d15e14b39e277347f44ef1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPYac/jYTqMi8CtBd2QHCHmTBW5Db:A3k03kHRJ7qJtb2I756r1
- TLSH T1DBB50812E5944671D16F8034CA959659FA333C418FA28EDB1284FFBDBFB26C0A975233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$
- Size 758KB
- SHA256 3395eda4837aeac02a186e06f27dd148cfdbd4688849b29f96a0bfedd89fe4a3
- MD5 9f04c875dc8684764a1fe7d8b1156387
- SHA1 1663f81456148a1545b9046a4478a36ae6071117
- SHA512 0f30f1403e5d20b4d6326e9c9a646ef8915a765c73e227bea846c50cd062569e95b28fd4a7251d75641d19d03b029854ad797fc7f75c315755fa2a564e7fe21b
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoUQ2Rojsu:A3mnXoZ643mnXoZ6i6cMJlCUQ2Rojsu
- TLSH T125F49D03E79500E8D10AC1749AAA9A32FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.4MB
- SHA256 f6a8be2e44c5d1be5e5c0b7af4f913ab19a42f22a06bfdc3bf245a311188f085
- MD5 cf29c1fa70aafce22eb1a5258c25c89e
- SHA1 0d9e7a305ba2bc279b26b79206ab671e8511074c
- SHA512 9b1ed1337cb4363a696a637afaf6ced08d2c45fca092f0176669b71f29de220511c627942029d75e8ede2c7cf73860691dd8af88d7c6ba279c6f97a4515c16ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPYac/jYTqMi8CtBd2QHCHmTBU:A3k03kHRJ7qJtb2I6
- TLSH T1B0657D17F6A442B5D067C079C5D2AA66EE7238425B30CACF1349C7282F63BD1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH