Analysis
- max time kernel
109s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 12:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 5.3MB
- Sample260522-ppbh8adv9s
- SHA256 021e8f7ed4f57dc46d559d07c5245004154f64f62be60e301b60c65f7aa98bd4
- MD5 4bba8a10b2809131403d9f9d31bf8f9c
- SHA1 579f9ba6d5235797ae69a80c7afae85b16add726
- SHA512 478cc36b37ddc36dba0a988590d7b5079456507afc6117ed0e440876ad1f57825021b84eebf074b9818f5381813a6d6171a66104cc34489b743244cf801bbd3e
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP43:egjOk9WOXV2VMG9rUOfkZc
- TLSH T18F46F713AD6C4661D07FBC758991D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b342-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4720-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000029d8e-1247.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2300-1356-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4720-1357-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001100000000eeac-1359.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e5-1610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0016000000000476-1858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000028e00-2056.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4720 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2300 2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 4720 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_4bba8a10b2809131403d9f9d31bf8f9c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2300
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.3MB
- SHA256 021e8f7ed4f57dc46d559d07c5245004154f64f62be60e301b60c65f7aa98bd4
- MD5 4bba8a10b2809131403d9f9d31bf8f9c
- SHA1 579f9ba6d5235797ae69a80c7afae85b16add726
- SHA512 478cc36b37ddc36dba0a988590d7b5079456507afc6117ed0e440876ad1f57825021b84eebf074b9818f5381813a6d6171a66104cc34489b743244cf801bbd3e
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP43:egjOk9WOXV2VMG9rUOfkZc
- TLSH T18F46F713AD6C4661D07FBC758991D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 6.1MB
- SHA256 e64f19552b888666af359df63212dbafd93ea6186fc94f561201f75c44d6055e
- MD5 f36c405783b3a1253cb6fef06146e506
- SHA1 6770c615765409211d7df7c2c822d9051cb79ad6
- SHA512 7e37ad16a99f4fcfa3e08e93d189ce200dd882a5c72958bb199bdbf8337993421820a94f7defb129bd610c3524bf7eda64dba572e3099cf25bc7f7c75ffc6e58
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP49:egjOk9WOXV2VMG9rUOfkZctHaib
- TLSH T16156F712AD6C4661D07FBC758992D799E5323C014B21AACB0EC0BE5DAF736D0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{5525D1F8-E5EC-4986-B0C1-A2834D87F434}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 5.4MB
- SHA256 ae78e0e23e4f3dea8ddb2f1f7cae760c9095e4ca05103d3892a03eac4f494293
- MD5 35c2ce1fa5d0dc39ff43696d2dcc26d7
- SHA1 5bd74cd192fcdc7edea25e6da8575f1f7ed13680
- SHA512 156d1fbfc4c6de37a4158500f725a7f84c7f1a4a4e97b7db90ece90386311ee86d7dc2050fb5b1979fe8678a9c9b85b4eeb6cd21b72e8af2196a8779574e3a29
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4B:egjOk9WOXV2VMG9rUOfkZczBPVl
- TLSH T16446F713AD6C4661D07FBC748991D7A9A5323C114F21ABCB1EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$
- Size 5.5MB
- SHA256 01613b33d115200559e056423851415c4bde217ca7f60cedcd5097ecd20462ed
- MD5 63e0b74b4d1dc8b4fe7528c516829e9a
- SHA1 baad040ae056e7b189bc813c5d3e51b7f9a3003b
- SHA512 18a88d34876e53cba7da6b824632f66a06c484fe0900745fc3941f22f19a15c5b5b6ed85b9bfa3b8abd6fd049ce63a90d112ab8f4d314057028d5599de68f1f2
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP48:egjOk9WOXV2VMG9rUOfkZcs
- TLSH T17F46F717AD6C4661D07FBC748991D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.9MB
- SHA256 4083ef0b78f612e18eea2eafc295ed5652ce5dc8cea004b2baeb2d074cea0b99
- MD5 2354f70914534db6ce57087da0e7075d
- SHA1 959aa591e2501b9d9a19bffa1d351bb30fe0faf4
- SHA512 672c8714370b8b9bf2ed01e1106f8a9a468f6ec70550d94999fa9b8d04fb671654265d06ecc188c94e729c944f98c11f89b0634f6983ce0bda4f45ec22490d1e
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4:egjOk9WOXV2VMG9rUOfkZcRjo
- TLSH T12A560812AD6C4661D07FBC758991D799E9323C414F21AACB0EC0FE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 5.4MB
- SHA256 e60e9d27dcf122328efae06fb347a3ee8974edccc2d3371e63fddd96161ea186
- MD5 511540613d294d59024501d0b8b7a6e0
- SHA1 3d22f6e15f3cd2e124656f1ab851c7e7b9fe78e4
- SHA512 e27a880ff7e54559fa97e9c4f5718ff4307ab60036cf81fd0928fd7577d0ab6bff2b1de2702cdd8463186023ed1b85814babae235527ef6edd61e5c717122592
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4T:egjOk9WOXV2VMG9rUOfkZcj
- TLSH T15D46F712AD6C4661D07FBC748D91D7A9A5323C514F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python3.exe
- Size 5.6MB
- SHA256 305f21ae4d1105106330f7eca2f706564eea4a7ba509e0f07b196944793ebd9a
- MD5 d516836a67daae11b6b8115af31f2a28
- SHA1 5124f60f3400a1f26ad694e74c407e83935c3649
- SHA512 a6346a51e5fa14d6d355407664ddb15a8e03e164f0622c45be27d136895b9b6f1f9bd6b13b40753b5c897e815d53b8f973f9f43f33b37a06d51c2a87ca4230de
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rUhOreW4SkZP4y:egjOk9WOXV2VMG9rUOfkZcxuX
- TLSH T18246F812AD6C4661D07FBC758D91D7A9A5323C114F21ABCB0EC0BE5DAE726C0B93D722
- MD5 SHA1 SHA512 SSDEEP TLSH