Analysis
- max time kernel
89s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 08:53
Behavioral task
behavioral1
Sample
2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 1.4MB
- Sample260712-ktsk3se14q
- SHA256 0b160896dd453722ca5a6c3a5b94946157b945dcf3aaece27299e5ed014d5eec
- MD5 9522e0e5a3cade966747f3a9c970a8aa
- SHA1 ecfee9df2793c7ea10839f35e622df4e9f223f9c
- SHA512 a2d3f583975cedf0eb04d2472ce8c2dbdb42e0c1721aabc6774694ea01a65e78535980320bf42381305b05a97a311fda320f77a307e1a9d8ea8daeb33e39f150
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrM:T2agnTkLfU0Pji0Aj
- TLSH T16E656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB8294F36D6E337D19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/1864-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024544-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/512-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1864-40-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/512-59-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001f2b8-119.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002160b-1280.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001600000001689c-1376.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001900000001db52-1523.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023060-1871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000073d-2065.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024544-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x000700000001f2b8-119.dat aspack_v212_v242 behavioral1/files/0x000300000002160b-1280.dat aspack_v212_v242 behavioral1/files/0x001600000001689c-1376.dat aspack_v212_v242 behavioral1/files/0x001900000001db52-1523.dat aspack_v212_v242 behavioral1/files/0x0002000000023060-1871.dat aspack_v212_v242 behavioral1/files/0x000300000000073d-2065.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 512 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1864 2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe 512 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9522e0e5a3cade966747f3a9c970a8aa_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1864
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:512
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 0b160896dd453722ca5a6c3a5b94946157b945dcf3aaece27299e5ed014d5eec
- MD5 9522e0e5a3cade966747f3a9c970a8aa
- SHA1 ecfee9df2793c7ea10839f35e622df4e9f223f9c
- SHA512 a2d3f583975cedf0eb04d2472ce8c2dbdb42e0c1721aabc6774694ea01a65e78535980320bf42381305b05a97a311fda320f77a307e1a9d8ea8daeb33e39f150
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrM:T2agnTkLfU0Pji0Aj
- TLSH T16E656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB8294F36D6E337D19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.7MB
- SHA256 31a9ac46cfa90cebd05f6e46bb069255fccdbdd4b12be812e281fb23a1ebffd9
- MD5 8a9db8c7e371ed571072d983cba4e0c7
- SHA1 53b9e13cb4be2a6695d67881194fd1bc95fda6a1
- SHA512 5249d6b073acabd325b6be31e4bdfd1c34d2988c0c35275a7e3e0d83b3b6f0e1b27851bacf20df51bf035fb27c2acecbe7da2c86dbde304bbfc12a8f756dacb0
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMR3UNUpEisI:T2agnTkLfU0Pji0AjyUN+Eir
- TLSH T1EC855C26FA688AE2D0778078C9D2C745EB727C510B3187CB9294A32D6E337E59D36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 cde4947c1c8f3e7e2eb31ead1845036c99c4195831f9dad0620b9d325565dea3
- MD5 e8fce7a00f4151fa20046807a104e1b6
- SHA1 f1b65212b9d0f252c21cf1080dd07be8435c675c
- SHA512 87c3f720cf209591be54cdbab4db2428ab1d06dedd46e53fbb27b2749a805beeacca9f8800acc5c66a35b0742333d48392958ad43255c670e9ce0dc180d65f46
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMX3Td9CHKy7GZO:T2agnTkLfU0Pji0AjoTd9CHKyao
- TLSH T17C956C52F6A446A1E0B3C574C9E29646EA727C510B30CACF42A4B36D6F337D19E36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{1D3AEF70-1DB8-49F2-839D-DA72081B59A0}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.5MB
- SHA256 f7b2a9e0ad25a715dda470042592aa035255a321e90787092f07350c03e6fbdf
- MD5 267fc4f71d5315794c8b9c2c56b51c8f
- SHA1 35297f8d1a3e97773dcdfbfa5b842ba5d0f2e03e
- SHA512 533850566290f2bf78dbe4e7e3ad0c80181267df9fadc736f8fcdf97b545f84457d8481b44895e4ca47c41b3165f327eb37d2fd57f4ff0f05951886cecb5254c
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMZbBPzBAU:T2agnTkLfU0Pji0Aj+BPVAU
- TLSH T1C7756D26FAB486A2D0B3C474C9D29746EA327D510B3086CB9294F36D6E337D19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 8320e1b4596f1d090e18e840d515e058bba525ce68958ae768707a268e008877
- MD5 28b07aa211e85cf4b5df191a7a61a96f
- SHA1 c1e1b6453414b59e2b2374a048ab98042a25a1cf
- SHA512 5c1f807648ed2a6bc8f14d485ad090b1dd910fe859e42d839168b897557df4e41df1ef70ad4de906fc10f5f334b29ddf4173f0af88626260fd5aa145747c74d3
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMD0Le5ji0hmxNrM:T2agnTkLfU0Pji0AjKPji0Aj
- TLSH T15C955C26FA748772D073C0B9C9D2974AEA713C810B3086CB4295E76D6E337E59A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$
- Size 1.5MB
- SHA256 9e7338b1780bbe596ea1fc282e0ce388298b5c057e682aae151e1f9026c5a618
- MD5 1f28484fd9bc1bfcc476454229e4aaa3
- SHA1 6efa4e641c29c8023b6629dbbac3251ebb9d0ec6
- SHA512 1b06b623ae387af93abc3c6eda2edf7b60b36ee52863edc32d4df3de10f29a53d0b0b2eb7a2b239ad6c848e2fc2c0aad0ffb79aa9b4accf984e40d8193c7856b
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMYD:T2agnTkLfU0Pji0AjX
- TLSH T1AB752916EA6446A2D07E8074CB929646FA337D510BA086CB82D4F33D6F337D15EB6723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.5MB
- SHA256 7f065e941c130f6dec00f5af474902061f23623cbe5150718a3599d31a37a443
- MD5 425fafc06030228ec442592c1d3e8c11
- SHA1 906597cc33ca31efba7835dcbe86988d8a28dff5
- SHA512 cad1768fbea8a71df7d03d1290fb9a92c5662ba2f9e9b73eae0edc0c9cea9bab3c8be635438a02820d5aa136adab197809b77b0354ac9931d52eddd6f44f7bce
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMPF:T2agnTkLfU0Pji0Ajq
- TLSH T199756D12FAB446A2D1B38474CDD29746EA317D910B3086DF8294F72DAE337D1AE36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe
- Size 1.7MB
- SHA256 5e9fceccd039427d93189fe2e38081482299a1cf50d31e32e9846e24f8055260
- MD5 d403ec51454a0edcb72669efab3c2be1
- SHA1 fe44c323cbbb47ef5d52a8d01edf92a8813f8250
- SHA512 67a693356070fc06705879c4e086339703e3d4cb3ff03f9e019c5eed7b6d801f12f030411414a07bc645198664fa22ddd4b0dbe028b954ebaa9873ce0d2110db
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaWZ0Le5ji0hmxNrMfV+PAk2hMH3:T2agnTkLfU0Pji0AjYi2WH3
- TLSH T196857D22FAB486B2D0B38474CDD6974AEA317D510B3186CF9294B32D6E337D19E36721
- MD5 SHA1 SHA512 SSDEEP TLSH