Analysis
- max time kernel
92s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 17:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.2MB
- Sample260423-vs1keact6s
- SHA256 5e5be9c01bcb4b1988b05cda88caaaae195d21823ab8df41bb208b85b905b013
- MD5 179143bdc9bf9c238a1e435de79c606c
- SHA1 5f4138e928045c540c46ac3feba03f38d34e6295
- SHA512 8f9c7c84546af0fbc1b539450a78c55edd72594e52f4d7e79e6b49266bb9ac5ace04287c7587ac7818298f6886e1d74d239bd46f640c026694d6c9e114afbab4
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rX:hK5N55sgjOk9WO1rLrX
- TLSH T147B5051276448FF9C86B0131C965926CA2677C218F13AFC76258BE9DBFB1AC05D27633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/8-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b410-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/596-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001700000002a18f-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00690000000272d2-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000028e8f-1220.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/8-1336-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/596-1337-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027aa0-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000001a611-1449.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000000476-1829.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0024000000000476-2022.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 596 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 8 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 596 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:8
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:596
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 5e5be9c01bcb4b1988b05cda88caaaae195d21823ab8df41bb208b85b905b013
- MD5 179143bdc9bf9c238a1e435de79c606c
- SHA1 5f4138e928045c540c46ac3feba03f38d34e6295
- SHA512 8f9c7c84546af0fbc1b539450a78c55edd72594e52f4d7e79e6b49266bb9ac5ace04287c7587ac7818298f6886e1d74d239bd46f640c026694d6c9e114afbab4
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rX:hK5N55sgjOk9WO1rLrX
- TLSH T147B5051276448FF9C86B0131C965926CA2677C218F13AFC76258BE9DBFB1AC05D27633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.9MB
- SHA256 524a4af4043ac2667e3c2a2d6245a2e47c8606ded691c03b3dbbc32b2f9c3b23
- MD5 71425ab79aa4fa3a4620b07539b1ce92
- SHA1 c07d9d36e7b1a68a12248f36a9f13290028dc98a
- SHA512 e8d7550ee2e63a2897a9a0eb43702363cc2e942806b0e040682eaeb201184e7eb502c9e0035693f18650b761cd32e3f115666eebcb98ee0d142a00824ad92b93
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56r6Vk0QGTvntQb:hK5N55sgjOk9WO1rLr3Haib
- TLSH T157E54A1266544FF9C86F4134C5568229E2737C118F23AFC71258AE9DBFB2AD05E3B722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.3MB
- SHA256 0b36e68e77a5e0cc7d5da6ff23169c1960250669e8a975613aa8af5d74127a7e
- MD5 68b655f9c753746a78f55c47dc5c9e3b
- SHA1 23596f7143d528022d7dcd9f5bc9fe358851ac50
- SHA512 014fad613f9e6f6e06a6362b28aff3c536511708b76a3d8aa3d3a8a5c140c77492f392e57471f2cc81d6aa903901bdebbbba32ee1b6c2a70a6df5d9f5266904d
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rDW:hK5N55sgjOk9WO1rLrDW
- TLSH T1EBB5061276548FF9C86B0131C965522CA2777C218F13AFC76258BE9DBFB2AC05D26633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.3MB
- SHA256 881252b88fe20bb61c672e79d5efd3761a4682debe98c4f4d03be27f11b21db1
- MD5 f5567d3bd476507c9bb86378d8975375
- SHA1 9b4f18ae3803ed104170edd4a1f5aa9ff74ac85f
- SHA512 31a1580468d13833f67be97d2b04c755df1e230d5d45d9f3b60251886aa44d9052858422c12ca12fb982b6d8f2c8b4a2b94a47bc24147c3ad668a2fcba2aff3b
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56r9BPVAU:hK5N55sgjOk9WO1rLr9BPVl
- TLSH T18EB5061276448FF9C86B0131C955926CA2777C218F12AFC76298BE9DBFB1AC05D27633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 798433bfe71e64c1191b9f435b3ae3b581ea43ee0605cc2eb17aa96c758d831a
- MD5 6ab49c3b3fdb6bbdd0bbad2c3048df73
- SHA1 34936e68755d177c95049725bffc8edec5133c74
- SHA512 e56211cf6d2d91616b5653d3c91def4ec085c6ee2c90e43758238870f6305b0a87f1e7167196e485eb5dc6e23be6b65a0c2f87f86e98d4da6c698fc283ad2001
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rTPji0Aj:hK5N55sgjOk9WO1rLrLjo
- TLSH T173D53912B6548FF9C86B4035C591926DA6373C118F22AFC71248AE9DBFB2AC15937733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.7MB
- SHA256 4b9e2d05fc5b16e23b53b23cc4634485a05192b4ba921eff82881eb083ffa1e6
- MD5 d29044b8e37ce52dbf9f3f7cc33f1741
- SHA1 0e5b4053eca59f2a47a6d5681ac3682bfeb6f51c
- SHA512 428c24c03e18e34a42c71a561a962ed5ec7cd70115872386b89fa6539a6cc9a4c3b6226ded6d9fd1f9b02bb8896487c2fa2b45048413cebe186b25e3a203cb0c
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rjUOlk09:hK5N55sgjOk9WO1rLrF9
- TLSH T109D53A12BA548FF9C96B0134C555422892777C218F12EFC76258BE9DBFB2AC05D36A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.3MB
- SHA256 4109acd08179c995311b848735a59ecd01aaf36d41c7d68aca958bdd375c50b4
- MD5 745475b1d8edf6c13b420578aa3a6e06
- SHA1 0eb3665160a63159bed7c3fcab9a2b1506d87267
- SHA512 0f878fbf408172279b7669247e419d8c56415e277b414b6848197019b5e681098af5159b2233e31fe35c45a7352fc1c923bbe5bebe2406d9e9819c6c7681f5f6
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56r9:hK5N55sgjOk9WO1rLr9
- TLSH T1CBB50612B6548FF9C96B0031C9559268A2377C218F13AFC76258BE9DBFB1AC05D27633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 2.5MB
- SHA256 de426208affc2e0d1aeb842fbbdab782106e0df1ea9fb23f0f0a401d6f1f6e09
- MD5 1792b944de37a8e4ff9260c23e08ecc9
- SHA1 1c30c9692ec1abd9203e50954056383daae345d1
- SHA512 bc4d0b76cf698c4ecc7de68df88c50e310c5718a67b88994b9884f53394213b2dcf75534e90760b2a065e89e7907b58588d86e0d91f7342945e207cbd314ab92
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rPi2WH3:hK5N55sgjOk9WO1rLrPuX
- TLSH T15CC5171276548FF9C86B01318965927CA2777C218F13AFC76258BE9DBFB1AC05D32623
- MD5 SHA1 SHA512 SSDEEP TLSH