Analysis
- max time kernel
97s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 02:05
Behavioral task
behavioral1
Sample
2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 2.7MB
- Sample260716-chvbjaet51
- SHA256 0efa6ed66092f18a5b395a1b06e99a6df22145901215e4c7a61d5f5c41460e38
- MD5 2d4e3ec304c0688cbe7b21ad99e5bb2e
- SHA1 91216aded384496d62554a43f828a369ffcb4a69
- SHA512 c98b88ead875aea80a7344d6c1a7bd05d6e2d5a6d57b69dc4dd5a98597da99dfec99e9c205520e4043278aa1231cb90801e9f68c3b81ec68bac81324a6606e7d
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mb:A3kMjK3fkZc+fkZc
- TLSH T19BD51916F6788323D0BBC0B9C6D6AA59FA3334455B708ACB0285D73C2F276D18676736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4040-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024415-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4716-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4040-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4716-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202e8-195.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202e4-197.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021a80-1078.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021650-1290.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00240000000202d7-1714.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071d-1976.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001200000000071d-2071.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024415-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x00030000000202e8-195.dat aspack_v212_v242 behavioral1/files/0x00040000000202e4-197.dat aspack_v212_v242 behavioral1/files/0x0002000000021a80-1078.dat aspack_v212_v242 behavioral1/files/0x0003000000021650-1290.dat aspack_v212_v242 behavioral1/files/0x00240000000202d7-1714.dat aspack_v212_v242 behavioral1/files/0x000400000000071d-1976.dat aspack_v212_v242 behavioral1/files/0x001200000000071d-2071.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4716 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4040 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 4716 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4040
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4716
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 0efa6ed66092f18a5b395a1b06e99a6df22145901215e4c7a61d5f5c41460e38
- MD5 2d4e3ec304c0688cbe7b21ad99e5bb2e
- SHA1 91216aded384496d62554a43f828a369ffcb4a69
- SHA512 c98b88ead875aea80a7344d6c1a7bd05d6e2d5a6d57b69dc4dd5a98597da99dfec99e9c205520e4043278aa1231cb90801e9f68c3b81ec68bac81324a6606e7d
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mb:A3kMjK3fkZc+fkZc
- TLSH T19BD51916F6788323D0BBC0B9C6D6AA59FA3334455B708ACB0285D73C2F276D18676736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 3.2MB
- SHA256 f82f3de00f17b4418cda36da3d9d2fe929cb9357bbd52e6b826bc291d8725b9e
- MD5 f70144921d43a81eba6164f8723f3947
- SHA1 f491bc09a75d8488aeb6cd8c1765a69b8cf0ecdc
- SHA512 243888d0268d803d8f25bf686840ed306279735ebc2cafc626a6f7ec86ebababf8a02e21e141e6e9f0840f52e8a4017d13695ffbc0866d612728e028c5ee70fb
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9MbIT9t2:A3kMjK3fkZc+fkZc+2
- TLSH T1BEF53B16F6788363D0BBC079C6D6AA59FA3234450B708ACB0285D77C2F277D18A76736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 e00d0d78dec897537eb151924e6c8caaaf9a88519f5be49eba3d1a6d7d45d165
- MD5 7906ed9fc135329f8a76b206b914154b
- SHA1 666ac7b49faeeb8eb42191a63ffa5d361ad67a44
- SHA512 25a83384aa2d76c959c61ddb7e193a47d4a872f2ea64cb2714c72bd563786e36e08b7773cb6d7c75e11a640edf79bfea5f99a9c3516ff384773236e4524e7555
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj:A3kMjK3fkZc+fkZcRjo
- TLSH T1E6F52A16F6788323D0B7C0B9C6D6AA5AFA3234455B708ACB0285D77C2F277D18636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 2.7MB
- SHA256 500609cba6f3b14167e3050003091a9585fc14f2258402e031aa95bba585866e
- MD5 605aedf7bc165a07821d05cce84d96da
- SHA1 74ce605f7d16a6a73b27d7ddfc7eac598553124a
- SHA512 be4294d5c239c779c9d7a7d480a2d2d5bacab39dece84529d8c75a9a76871ed5adaf6113c5942018ce10a73fc439461df155e26852f7c84d727b3fa92fa9dfbc
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mbl:A3kMjK3fkZc+fkZcl
- TLSH T19FD51916F6788323D0BBC0B9C6D6AA59FA3334455B708ACB0285D73C2F276D18676736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe$
- Size 2.8MB
- SHA256 73ca72fdaa77e4261e5b43c834ea5df034ae10a9250a64df53630e260545e863
- MD5 514adc7b72d10dfa01748cd0d9c6c090
- SHA1 93c62bd19dbda4b0c450d06843b445f1e982a3c7
- SHA512 a81405f802ec2852386dcce9ecb2200fee745f4b2f680f26b8b94295d140d821de2a29f899e4f71b3555803d03c77d33590bc4f2c75749afdc5629ca56e3b1bc
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mb4:A3kMjK3fkZc+fkZc4
- TLSH T154D51916F6788323D0BBC0B9C6D6AA59FA3234455B708ACB0285D73C2F277D18676736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$
- Size 3.0MB
- SHA256 7b91289a858a8334a63b5239d1626bf4e46a38971fef5eeab4a54b7d8196f02a
- MD5 c2b6e3e57d7680057e93a212e4bf191e
- SHA1 41994c1307c17a5c61016e4e4db8c960759a09da
- SHA512 04053396480a985826537f82b9f4fa8b162a3dda4eef72c03eec14866aaf71ceb5d58d8a078de2b553671e3b183b9da4dcf802d687f73b1a0070a1c9cb8dc4cf
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mbhw7OB5:A3kMjK3fkZc+fkZcd7
- TLSH T17FE52916F6788323D0B7C0B9C6D6AA5AFA3234451B708ACB0285D73C2F277D19A75736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.8MB
- SHA256 de947811798792158918bb9a4036ed09e1c4d03a980cd7b6a0ea837f3a95ecc1
- MD5 34b95e42f9d29164b9f8085ae46ed729
- SHA1 b14d81f09a0e4711443675d903066ec25c2d0dee
- SHA512 42e5f5633a10fca9bf69c36fd83696cb4829564e35f7f646916b41ae84eced10be8e6799e46da3e3f6767c57b0d4856e88c092070763bd7e7b38d309152ca4cd
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mbj:A3kMjK3fkZc+fkZcj
- TLSH T13BD51916F6788323D0B7C0B9C6D6AA59FA3238451B708ACB0285E73C2F376D19675736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.2MB
- SHA256 0df69c9b57d30881f3e2c068281e658bebfa9d1abe2a087c5ecaaac551562723
- MD5 3a4128009747a27f8cd1a530922c1176
- SHA1 1f3dfd06c992be58ab8465fea84a74a8e28f915d
- SHA512 e91e7b92afc0a4cce20b1ea7eefb4ff020a8d62ef0aa253ed3833b089950f42929e7f24fce3c3df87bcc63653091e2887de897e934af1164c31fbd22b3747e24
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9MbgXpiMh:A3kMjK3fkZc+fkZcMpig
- TLSH T122E52916F6B88322E0B78175C6E6AA59FA3338415B708ACB0385D73C1F276D18A75737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.0MB
- SHA256 8dc074185554ac7dbfa817af37065aed01cb93af3c0e4b9ca93c8d93316c5a86
- MD5 39536d33a4ab5c51d9a806a98c4cee07
- SHA1 38872de2d85d663229e771de1f2de9ea2896b9ae
- SHA512 49214b418fcd18ef3b5266557367e62e9c4f090c11cb60f67020e731015c6197db0cf9c0618fc80cb64fcf260809c9b975b0adf682781513706899f8ca5c7350
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mbxi2WH3:A3kMjK3fkZc+fkZcxuX
- TLSH T16FE52A16F6788333D0B7C0B9C6D6AA59FA3234455B708ACB0285D73C2F276D18A76736
- MD5 SHA1 SHA512 SSDEEP TLSH