Analysis
- max time kernel
110s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 17:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.7MB
- Sample260423-vj7mcsby7x
- SHA256 47fcfe4ecffea185bae3822a22163e7b27ce1ae6853fc3c19c2fb1d9d466b322
- MD5 9e8275f5c563a3f357cb91870b5bae88
- SHA1 43e86317d9de0aa9dfd909d74985a6eacddb806c
- SHA512 af1b71af1d67a05abb5ee76e0aa29eae90fa4b7b3d2bf8fb8b1e7325b348dfdc27b2d497b35b987cecb2d1c31e00f8c836c52fa211d0458996205af287452d46
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0Aj:4K5N55sgjOk9WOOjo
- TLSH T125D55B12F6A48BF5D8778075CAA1A279F9723C610F30E7C75248AB0D6E32BD19937712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4560-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002438f-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1160-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229f0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001f2a6-115.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002242d-1228.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000202fb-1352.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4560-1385-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1160-1388-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001500000002028f-1502.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1160 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4560 2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 1160 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_9e8275f5c563a3f357cb91870b5bae88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4560
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 47fcfe4ecffea185bae3822a22163e7b27ce1ae6853fc3c19c2fb1d9d466b322
- MD5 9e8275f5c563a3f357cb91870b5bae88
- SHA1 43e86317d9de0aa9dfd909d74985a6eacddb806c
- SHA512 af1b71af1d67a05abb5ee76e0aa29eae90fa4b7b3d2bf8fb8b1e7325b348dfdc27b2d497b35b987cecb2d1c31e00f8c836c52fa211d0458996205af287452d46
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0Aj:4K5N55sgjOk9WOOjo
- TLSH T125D55B12F6A48BF5D8778075CAA1A279F9723C610F30E7C75248AB0D6E32BD19937712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- Size 3.0MB
- SHA256 1e17af7630b3dd4ad364ab3c63fa981d973a363e326d330512f807b668289cd0
- MD5 7884ffea3af3ec5f8f32eac344d58b51
- SHA1 1ad3926d6389b65e448c9a0fe482e03ab647ff93
- SHA512 062a829d61fb72337b582b8e1d957d7b6cf99001e0f79cfbedd06182058de74190aab2fe68c4368dd4ba11a3673090fe1ec7f64cbada3028f1747724daf6cd12
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0AjyUN+Eir:4K5N55sgjOk9WOOjoyE
- TLSH T10AE54A12BAA48BF5D8778035C9A29369B5727C610F30D7C75258AB1E2E33BD09D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.2MB
- SHA256 890bf1e500dc40ed8cf819385a15d616d2d7f58371d3d24b8b1445dab9a1290d
- MD5 28f1236911fe554ebdb777e9d3e14c32
- SHA1 47d74bea99bb5dfccf8ad3326660f125da2ea719
- SHA512 5854e5fbd72cc37377a5a8f13e27ac58274a063acdda3451be70f979b0da69ed782e36fd8fe18d89f59c911050249d6b6304dd886b9dc2afc79b4d0fe4a8d96e
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0AjoTd9CHKyao:4K5N55sgjOk9WOOjoKCqo
- TLSH T12CF55B12F7A44BF5D8778075C9A19225E9723C610F30E7CB5298AA1D2F32BD19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 42abfcb3a6d57604b7cb85dd427cd55fccb8ee21fc309d31382f0e1d68f72079
- MD5 5597906acd304ceb41dff142c2260c02
- SHA1 7ae26e739aa36835c763fc0b54b50850a6dc5c3a
- SHA512 07e39a77735435591a38d4e6caa9dfc5e7c05fd92f073399f790dea2cbeb1c53210377f40597d96f91af5a87f053cd8d0af87f7aefeae2eda9e370a2c0d30004
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0AjKPji0Aj:4K5N55sgjOk9WOOjo0jo
- TLSH T147F55A12F6A48BF5D4778075C9E2A269E9323C610F30D7C75289AB1D2E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$
- Size 2.9MB
- SHA256 69a92c8b62f59ea8da7e64d4f76df2e11a22bedc71a95e8932e620614bd89d17
- MD5 5ac051fc0eed329d7de62444ed39e4fb
- SHA1 29c2421cfaf49b23e6f4552384704b16fb799e95
- SHA512 8aa685a88379174c37b08d8bf0efd1e3fae2fdda0f7234da23ec80b7c36b0e31e00b059d4882e9be515e58c49873017b4552850ec093432e7dc6d464806ceeda
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0AjX:4K5N55sgjOk9WOOjoT
- TLSH T10BD52812F6A48BE5D87B8075CAA19225B5333C610F70E7C75288EA2D2F32BD19977713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.8MB
- SHA256 f8f567fff9f0b680d195dd611c5000b4fb9ba464b7f45f3cec73a5591a9c45bb
- MD5 3d23a6fc70b40ee185a2e6e5c5b99607
- SHA1 013bfe655269ea633e7ec5a8f72cea05d130bd5a
- SHA512 8e47ae6077e420c7bea6a4c4a574d85a717d865f7d61db37bcc04e691ab64b32d95b2fb9af596fb529ab9288042d5b0129e1055db8828ecd0e35f1a26a1ba535
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnO4rGkPji0Ajq:4K5N55sgjOk9WOOjo2
- TLSH T151D55A12F6A48BF5D8778035C9A69279B9323C610F30E7CB5248BB1D6E32BD19937712
- MD5 SHA1 SHA512 SSDEEP TLSH