Analysis
- max time kernel
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 23:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
- Size 4.7MB
- Sample260703-2173sads8m
- SHA256 ea2ff84b6f5302b3cf265ab5dd44d4d820ceb311259a49ffec8b23e7a73dc45c
- MD5 926486b6bf116a00a7496f8f6936ecde
- SHA1 3e7062432b3ddc084e6961125316e244c68f3ed9
- SHA512 8606a82d94b7d70b360b84440511be252fadf0b861ee953636b74e286c7652fd1f3127487dc01cc88a20ccfb45bde93ac59f8f508af22124d42e8137c37b77c4
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWl:smAE9695ta1v5HoeX
- TLSH T172366B11B7E48A72D0B78575C8A6A756EA727C510F3087CF1350BA6D2E337D1AA36323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2668-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c5c7-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019999-560.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abc6-998.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001acc4-1236.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2668-1414-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1128-1415-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000006549-1896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e7-2127.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1128 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe - Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2668 2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe 1128 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_926486b6bf116a00a7496f8f6936ecde_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2668
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.7MB
- SHA256 ea2ff84b6f5302b3cf265ab5dd44d4d820ceb311259a49ffec8b23e7a73dc45c
- MD5 926486b6bf116a00a7496f8f6936ecde
- SHA1 3e7062432b3ddc084e6961125316e244c68f3ed9
- SHA512 8606a82d94b7d70b360b84440511be252fadf0b861ee953636b74e286c7652fd1f3127487dc01cc88a20ccfb45bde93ac59f8f508af22124d42e8137c37b77c4
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWl:smAE9695ta1v5HoeX
- TLSH T172366B11B7E48A72D0B78575C8A6A756EA727C510F3087CF1350BA6D2E337D1AA36323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$
- Size 4.9MB
- SHA256 134ed143820d550e48a6c7f38059d59c8fcee80594093daff5534a9bf712be6c
- MD5 c3142f272d17256cb7e243dd8f378a53
- SHA1 bd8500008cafca0b47ec8edac45a8a80964fda96
- SHA512 57d868a0c20dff33501fbf6049bd665b5e6d8402d896d94a0b00897454413d47e236341e58f636a5b772a0c9cc0e704280a438278a51a7365acffbbc0906167e
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWY:smAE9695ta1v5Hoecsa
- TLSH T178366B11B7E48A72E0B78575C9A6A756EA327C110F3087CF1350BA6D2E337D1A936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.3MB
- SHA256 4ee439d272f3ab36317053e8b23f6f80278d2fa23b6d9630bd7bcf256a97323b
- MD5 a316a625a56b9ba2a9131ef25d04aacc
- SHA1 18abad165f0158c1ba9c20d03be169f2ccfc7bca
- SHA512 45046c5b248073386deeca842a3c8fd626445fc81e88b2611d795fbd2ead8f62197d63f24d4377b09251449b4a912a9d7022d5a186f1d20fb6faba544909f95b
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWq:smAE9695ta1v5Hoe/o
- TLSH T1B8465A12F7A48672D0778575C9E6A75AEA727C410F3087CF1350BA6C2E337D1AA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 4.8MB
- SHA256 deda6d234a001fa1060b9337fef5000b1d26d3e82b2080cc870e687e7694c90b
- MD5 4440e2607d70b8ed9f459f2aab5f2029
- SHA1 da04fb88fef83455e0e4ec2d4284c1fe24f36f92
- SHA512 d54e87433ad09979530ea313747d2cf3147f5b2b13615c7eee9f12fa921e7135bd4f46995d86042de964ddbca17aed8073c772e9d11bb4da57f430ec21b513b3
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWB:smAE9695ta1v5Hoej
- TLSH T16C366B11B7E48A72D0B78575C8A6A756EA727C510F3087CF1350BA6D2E337D1AA36323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
- Size 5.3MB
- SHA256 91675e53c1a1eff1d893fa239655fd6194382df70bfcb19fe965928c59b9f4dd
- MD5 60e2d3414578d0c2edd58018f685e538
- SHA1 db31b9ee7f2a6841b0975215cdc734ff19eff83c
- SHA512 9611497f51ec7861969ccc6d579bbd047030169fd4ed168a224a654309f4a0a1d71a8d3efd8d00d30ac2ab338a359d6432dfeb80b0449f75c5344c8c8a5d9428
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWa:smAE9695ta1v5HoeBm
- TLSH T14F466A11B7A486B2D0778575C9A6E766EA727C410F3087CF1350FA6D2E337D0A93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe
- Size 4.8MB
- SHA256 e8beb8a21fd4fec66d6f62d0bc4a82daca8cc506e15ec392dbd0bf07dd9ff558
- MD5 7d23299ba451f664c2b542f37a5957f9
- SHA1 e10546df2c8e1b9be867c23de514d910f24e3279
- SHA512 963e2c4630da52564d185f0851ed4e051814d5f21ed200254930ce04667513a1af5538d06592b322a60df6df5db8019d3a4819266c8f256ed20771e11c8477ba
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWD:smAE9695ta1v5Hoe9
- TLSH T1EC366B11B7E48A72D0B78575C8A6A756EA327C510F3087CF1350BB6D2E337D1AA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe
- Size 4.9MB
- SHA256 4e78c6e4efcd6f72c63214c47e6cf8e34e3bc874d5f6e039e6dccfbc45de1f64
- MD5 66f5e04cd08f1fc292e85bca8ec14e6a
- SHA1 d26beb554c29df9de3765ed91c0493983b5fd33c
- SHA512 549dda57c048b672df2fc472ec57caad0c9d1c23848f53df901fb35f351c886aaf31b6af94f6b7f9bb4bf6adeb4478c8dc780aaf305c84a3ded28eebb71c21b4
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWk:smAE9695ta1v5Hoeu
- TLSH T180366B11B7E48A72E0B78575C8A6A756EA727C110F3087CF1350BA6D2E337D1A936723
- MD5 SHA1 SHA512 SSDEEP TLSH