Analysis
- max time kernel
105s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 17:01
Behavioral task
behavioral1
Sample
2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
- Size 2.1MB
- Sample260728-vjydpassft
- SHA256 1590d053eafee23f7ed012fe75a2537e4261eb57e7bf315b2da0179657ff5693
- MD5 a1daeeab1a5a80e8e7b620efd34da9c7
- SHA1 294afc58d8ef3cd57abf064ca6ccfecd8ca0d614
- SHA512 80695f95ef3bb83d1a15f7fa9a8880831dfc8d904f03aaa071e2e35fabfd166e4bd9c33eb42d9474d9efa3b301459b3dbae257d2fab080b60e8257d4256eec0f
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrM:A3kM43NCLTZPji0AjmI1FPji0Aj
- TLSH T1ADA56B16F6B44271D073C079C9D2A69AEA7234421B30CACB1395D7783F677E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/5888-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5888-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4136-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00240000000184cc-374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b54-671.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019b2e-702.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a128-1030.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cb4-1286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f00000001893c-1525.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5e3-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x00240000000184cc-374.dat aspack_v212_v242 behavioral2/files/0x0003000000019b54-671.dat aspack_v212_v242 behavioral2/files/0x0004000000019b2e-702.dat aspack_v212_v242 behavioral2/files/0x000300000001a128-1030.dat aspack_v212_v242 behavioral2/files/0x0004000000019cb4-1286.dat aspack_v212_v242 behavioral2/files/0x000f00000001893c-1525.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4136 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5888 2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe 4136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_a1daeeab1a5a80e8e7b620efd34da9c7_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5888
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 1590d053eafee23f7ed012fe75a2537e4261eb57e7bf315b2da0179657ff5693
- MD5 a1daeeab1a5a80e8e7b620efd34da9c7
- SHA1 294afc58d8ef3cd57abf064ca6ccfecd8ca0d614
- SHA512 80695f95ef3bb83d1a15f7fa9a8880831dfc8d904f03aaa071e2e35fabfd166e4bd9c33eb42d9474d9efa3b301459b3dbae257d2fab080b60e8257d4256eec0f
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrM:A3kM43NCLTZPji0AjmI1FPji0Aj
- TLSH T1ADA56B16F6B44271D073C079C9D2A69AEA7234421B30CACB1395D7783F677E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.3MB
- SHA256 4095aa85f0754dc2f09e0ad39c653f6c3b1a694f3253ffdf7797d08a86ed0bf9
- MD5 357b393cf4fd33f94f463841ca1f91b5
- SHA1 0afcc6cd46951ef0e77284e33eb62aa2b03ac51e
- SHA512 21b774c57e7bd03c4b3da02eda664c8be2b4c8369b87c06e970f766e7dba631e2cfed7f7dd874ba3f6ad0d22888dcc4473d1d5eba6c234a11c75344ab1b24e34
- SSDEEP 49152:A3kM43NCLTZPji0AjmI1FPji0AjXT1Llje:A3kM8CxjoyI1VjoVLte
- TLSH T1E2B57C16F6B446B5D073C079C9D2A65AEA7234460B30CACF0395D7682F737E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 0018d2d5a1f957cea36a2d4169efa19629dbb0233a07f3615ea41a086b52bfae
- MD5 20a4107f7f85367b5f8476dca4140c88
- SHA1 f56af202e38459934a6bb9deac94b58d68dcc2b6
- SHA512 af8935b7fd634333c947bb4a12c48df037923968a584038d91e89b3a70c89dcbcbc56a3476f6b7b11f05b6af510cc7232985b13efe9015255b83be5caefc6aa0
- SSDEEP 49152:A3kM43NCLTZPji0AjmI1FPji0AjKPji0Aj:A3kM8CxjoyI1Vjo0jo
- TLSH T12EC54A16F6B44375D073C0B9C5D2A69AEA7234421B30CACB0395D76C2F677E68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 2.1MB
- SHA256 f90b97ab83cd3fb98bc645d5d3fc8ec1ed21dd33b5ea079013dcc637d5c9fa21
- MD5 17b2703da21081e4d6bc8ddba589ef99
- SHA1 e22ee7fc6ef2b1af5a0736d02c41b7ad9165ee31
- SHA512 05522f3afa1ff68e5da2b89a2d3aa9366d28c193b34d5f0bb050ee11dabf93579b568a4e9a83e2c0e504cfa7222806f6683fe88f8949e3836adc2538a3eb2ee5
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrMVA:A3kM43NCLTZPji0AjmI1FPji0Ajp
- TLSH T1F4A56B16F6B44271D073C079C9D2A69AEA7234421B30CACB1395D7783F677E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe$
- Size 2.1MB
- SHA256 77c9b51b14c3ab7d5cfccf0ab2bf4bbdfb984c5b7a7935c8c343b9e1821b2103
- MD5 22578a45daa3fd8f3570ae301d6ff596
- SHA1 7afd3626b2bd79f5e098f4fedee1fbdb570de24b
- SHA512 bffac24dc2ba1bf3f80672597cbc3986369c9d0f8e1b1a0017fffb9df01f9b30c885538d332188ec0de6a7d1caf338d1fc3e228b6039923f738010eeaa6d4810
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrM6B:A3kM43NCLTZPji0AjmI1FPji0Ajz/
- TLSH T1D7A56B16F6B44271D073C079C9D2A69AEA7234421B30CACB1395D7783F677E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$
- Size 2.2MB
- SHA256 951f74828926c05252af6b308590e11c723ef8937be18a68842ceeee13a41d40
- MD5 efc1656a080794c26d69ecfa6451454c
- SHA1 34c7ddb731e996d27e22cbfd274b243d00b525bb
- SHA512 07d785355c01bfa9c20be3f6ddf64eb2ee696e2aae80b07b8e912a27de686ac20e61c79598658295f77cff4a13faadc62757da01d7d6d2cfe0fc4d7b00f306ac
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrMO0:A3kM43NCLTZPji0AjmI1FPji0AjBs
- TLSH T1AAB56C16F6B44275D073C079C9D2A69AEA7234421B30CACF1395D72C2F677E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
- Size 2.1MB
- SHA256 f3ed9c7e55bd321a125748c021eba3b7a4fd5c27daddf0c18b622a0e3dc964b6
- MD5 a80e06454fcf268f3c487e79ca08f010
- SHA1 51c80fb70ce0af75dc4317c976294990228cb2c1
- SHA512 f8e4b495419605c6d89e0df49cdfc0657a18e05ac295b5929ea97ee01d8a771091f45564984724c314e09db5d9b2e9ca8e9e5696a98760bdef531a39cd22895b
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrMuP:A3kM43NCLTZPji0AjmI1FPji0Aj7
- TLSH T1BDA56B16F6B44271D073C079C5D2A69AEA7234821B30CACB1395D7783F677E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.1MB
- SHA256 90597621f94fe058c20e106d0c94b3c535953f1b00541d88ab7d6dd930f6e7c3
- MD5 8ed1276230ccb6997a929589215cd4da
- SHA1 a31fdf8ce6f7c8e9cd87f6647192fe76ae979293
- SHA512 aabf89beeee38c921b3b354d3561c9d27d59ac9803c9f37bbe1f14999cc1dda63cce0cd68774e49ab75ae43b9a364f525ab811abfab66396027cffcfb78ecc37
- SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7eU0Le5ji0hmxNrMzI13Bn0Le5ji0hmxNrMPF:A3kM43NCLTZPji0AjmI1FPji0Ajq
- TLSH T12AA55B16F6A44271D073C079C9D2965AEA713C821B308ACB1395F7782F777E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH