Analysis
- max time kernel
87s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 18:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.3MB
- Sample260423-wsjsbsds4q
- SHA256 b441864f676ddd803bf832ed2708091ed34e2c4cb684f1681a1d68ff3ed4f994
- MD5 94e16b3483c3fd7feabf8c0c427cc1b4
- SHA1 5796858727327cfb9edaecde35c36a1bd10f46a9
- SHA512 cb1346f285dcf3a4a1cd1ab3e308bb61eaad553ce0e8cd3670d22dc755a0e3d48ecb1e735b974e050ac32e8aa56e1ab0c9fe2b0a522430f0e1e716cfd4983b0b
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556rX:hK5N55sgjOk9WO1rw56rX
- TLSH T1C7B5391277949FE9D96B0175C9A59271AA7B7C200F20E3CB1258BE1D7E32AC0AD37713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/3708-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243b8-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2700-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229e5-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023436-160.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021661-1227.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3708-1347-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2700-1349-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000073b-1465.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e505-2049.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2700 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3708 2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 2700 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_94e16b3483c3fd7feabf8c0c427cc1b4_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3708
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 b441864f676ddd803bf832ed2708091ed34e2c4cb684f1681a1d68ff3ed4f994
- MD5 94e16b3483c3fd7feabf8c0c427cc1b4
- SHA1 5796858727327cfb9edaecde35c36a1bd10f46a9
- SHA512 cb1346f285dcf3a4a1cd1ab3e308bb61eaad553ce0e8cd3670d22dc755a0e3d48ecb1e735b974e050ac32e8aa56e1ab0c9fe2b0a522430f0e1e716cfd4983b0b
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556rX:hK5N55sgjOk9WO1rw56rX
- TLSH T1C7B5391277949FE9D96B0175C9A59271AA7B7C200F20E3CB1258BE1D7E32AC0AD37713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
- Size 2.4MB
- SHA256 c498f9fcf4b95ac4b3fbd4b81b6337798cb46c5b4b35f1f93c24cf8e6339c249
- MD5 9006c8b8a3f43f048ea97747a6ffc1b9
- SHA1 5dd794c3bc11911602cb0802bcff8670912001ac
- SHA512 baca62a2c7b48f09d8d1827a90568b04e52e8ad8ee4862cd4a4202e492d74ecde0a716dbcfe3894465cc5342867caa9e98b51e7e0266c828dd86b4d59b51b493
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556rDW:hK5N55sgjOk9WO1rw56rDW
- TLSH T1D7C5491277949FE9D96B4174C9A59271AA777C200F20E3CB1258BE1D7E32AC0AD37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 e593968fa3210ea31dae8e151792f2dabe579182ae754cac3bae550a928e887a
- MD5 48823c56b65eb313c9e58d8470a6ceb7
- SHA1 abff078972211ccfd4a3a5209cfef2f797165ad5
- SHA512 7e10dcb326b1b5619f88a4b3ea4276b79ac26d7305d9907b37448c71a78e9cfc475d1f88b88ffd5e74f046e65d58daba3f3f84d7b9f472c483c59c3d2029c5d0
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556rTPji0Aj:hK5N55sgjOk9WO1rw56rLjo
- TLSH T1FAD54B11B7A48FE9D87B4175C9A59365AA773C210F20E7CB1248BE1C3E32AD19937723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 2.4MB
- SHA256 da078c3cadeeb488ed5452e8a10cdc9366148d0ace0bce4d9de71af42405ed42
- MD5 24d93d4667c4ebb8147e8e0830262724
- SHA1 00d9dd88aa931f5ba5edfd51ce7faa3fbadf8f01
- SHA512 9a9d0f97d2ffabf6c7405bc872e82f4c439458d8fccc3970210cea2d94a6c8db107e5334aa73025ebfad21e70fe26ea1abcc06fa918c64ebb755fc019f6ee9e6
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556rU:hK5N55sgjOk9WO1rw56rU
- TLSH T1DCC51712A7949FE9D96F0174CA658261BA777C204F60E3CB1298FE2D2F31AC09977713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.4MB
- SHA256 efd333a219ee111f77d84e42af24980899e3efc02aff6e35b6070ec0f9f244b0
- MD5 5bb5df9bdc3bbd5b873239c6e8d9bc00
- SHA1 1c77cb15a433975639e45373b4b304e6fdc2ec12
- SHA512 ccbeb60274566e1e9dbb53728ae0f2d23987f5c8c3d979a3cb311160dc8030869fe042303ce9e0a15d0dbb3700a04a8d36892d9d413b58773583a4542d8820cc
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556r9:hK5N55sgjOk9WO1rw56r9
- TLSH T157B52812B7949FE9D9AB0171C9659271AA777C200F20E3DB1258BE1D7E32AC0AD37713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
- Size 2.5MB
- SHA256 9a14a84b4504e8820348fcfa224e9bd85821b662ecf87192b41bc25f6f524956
- MD5 7b9d560ef36ddfd67371b56c1faeabf2
- SHA1 28e33ce04cce0e84fd376d28049abaee04ccfa9d
- SHA512 adbc1f4540355880851554b31528173f1a25d974680b4fd446df395fb2632ffc62ee42e60acdf1766788b3ed3645d0c7d079b1a970b22f62bf08e931d5c8fce2
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rNC5556rPi2WH3:hK5N55sgjOk9WO1rw56rPuX
- TLSH T146C5592277948FEAD96B0131C9A59275AA7B7C210F20E3CB5258BE1D3E31AD09D37713
- MD5 SHA1 SHA512 SSDEEP TLSH