Analysis
- max time kernel
94s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:51
Behavioral task
behavioral1
Sample
2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.7MB
- Sample260730-ees1eacn4v
- SHA256 0c1eff128b59aeecb196d39335e523bf7faff70e90de186786005063cab2aaff
- MD5 1d4f115c41cabc1129f7698dc3a0db32
- SHA1 07ae05aaabeb70268d5cb8bb70d2bd043eb05fbc
- SHA512 002378aa84fd8cc312cbfafb29bdd3a06ba9766d0e7cbd70eb3b055a298213e19666dbd5304dbf46395ea94085d1f84b5ca5480565dc0f05f89805efc9d7c5df
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrM:A3kMVljR56rTPji0Aj
- TLSH T1A3855B22F6648B75D03BC075C6A2965AEA733C510F3087CB53949E693F237D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ca-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2364-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2976-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2364-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001fd86-147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216e0-816.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216a5-1291.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00090000000245ed-1600.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002313e-1757.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ca-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x000700000001fd86-147.dat aspack_v212_v242 behavioral1/files/0x00030000000216e0-816.dat aspack_v212_v242 behavioral1/files/0x00030000000216a5-1291.dat aspack_v212_v242 behavioral1/files/0x00090000000245ed-1600.dat aspack_v212_v242 behavioral1/files/0x000300000002313e-1757.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2364 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2976 2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 2364 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1d4f115c41cabc1129f7698dc3a0db32_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 0c1eff128b59aeecb196d39335e523bf7faff70e90de186786005063cab2aaff
- MD5 1d4f115c41cabc1129f7698dc3a0db32
- SHA1 07ae05aaabeb70268d5cb8bb70d2bd043eb05fbc
- SHA512 002378aa84fd8cc312cbfafb29bdd3a06ba9766d0e7cbd70eb3b055a298213e19666dbd5304dbf46395ea94085d1f84b5ca5480565dc0f05f89805efc9d7c5df
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrM:A3kMVljR56rTPji0Aj
- TLSH T1A3855B22F6648B75D03BC075C6A2965AEA733C510F3087CB53949E693F237D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$
- Size 1.8MB
- SHA256 29c78bb19750c07112f120db2147621c12fbea8bbe63c84a527a95ba704e5e00
- MD5 015acf042612561f52b0b09140b36e09
- SHA1 cde9198841fafca9314918b75d034b68da9e3bbb
- SHA512 3db1d38a7e194286d4568b6bcc59d5838d54a1a042f8c708fb4ec870da433ed7ef9b0fdd031a1d6466037fc472c3e5d5909eb71142eb7896ae0aba2ad1c8a911
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrMdTjE:A3kMVljR56rTPji0Ajow
- TLSH T12C856B12F6A48BB5D03BC075C592965AEA733C510F308BCB53949E693F237D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$
- Size 2.2MB
- SHA256 a4d89ef2e346b66880e0900ad15fe3a20f69c49970c5ad8f5b1d33de30a5b354
- MD5 2422e07282bdacc6657f9222d9a5cf1b
- SHA1 3a88cddbebe5a204001508be72dd3fc882b51f88
- SHA512 7b9de4791344cab1191054a50f46ad58d1d7bf1abe0bf29db6c44cf3c73087eeb13c7a031457b6abaf9e0e06550335394146e2f9030e5e18a578917d45fe270b
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrMe86n9kAJ9tA3L:A3kMVljR56rTPji0Aj1T9t2
- TLSH T154B57C12F6A48BB5D07FC074CA928656EA723C510F3097CB53949A693F337D19B3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 0e43adb2339281a89c09231e1bf96d0d28437446a85ce96cc08b388173b27b7e
- MD5 db3cc36a49a5f791d371aa4144d94762
- SHA1 b182ce4c8ed5fb287cbe93fadf114b6498a41fd2
- SHA512 764035d8fd993e2f443f6cdf5550ffbb3c4ba5981a3882591e1cbf2fe9fa40d3363c074ae2812736fa59ad31a1c80eb51e02bd8e456f46aa13f297efc69d1192
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3kMVljR56rTPji0AjKPji0Aj
- TLSH T1E4B55B16F6748B71D03BC0B5C5D2965AEA7238410F308BCB5395DA683F277D29A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.8MB
- SHA256 2015a7267319da572a61522869ae33598861db9037d06f48e2311acf3bf70c4c
- MD5 18088baba7e26e8793684714282592de
- SHA1 b161a5dcd2f702611d25d6a02009e8efa5044380
- SHA512 8590ef0bd370e6055af85eb53e7cfc940d80566a63d73fb03c92c11b57237d6244b4f6f8cf1c7cee9197d73ea7d46e93a9095616f7ee144bb998b0b4927dc151
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrMYD:A3kMVljR56rTPji0AjX
- TLSH T183954912E6648B65D02F8075C7929656FA333C510FA087CB53D4EA3D3F326D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
- Size 1.9MB
- SHA256 1a7fe6742c4abf12a3d334aee4dbf83f6076042ebd9c72a2ec89209e00a60393
- MD5 04c30bafc0b7c9e66ce6065d293b4987
- SHA1 3b3782ee93127e071430fb5473be1933e69d5d7b
- SHA512 8a6295d45bc1ff2a8486fbbcdc4ce4f0ec50a531f56c6fd960f5176dcd8f1c3a446f0122718ff1ac7173902db13b5e535f1a55b5b1dacafad0325a71e27ca8ae
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrMdyyCUq7lfHLJ:A3kMVljR56rTPji0AjoTeX
- TLSH T120956B12F6A48BB5D06BC074C5929666EA733C510F3087CB5394DF693F237D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.7MB
- SHA256 62d1fc88d844ab2462d1ac23ad0f912348248be83e715401becaa0eb9f902c53
- MD5 de4e3f6577f35b8d090004f5739f4ddd
- SHA1 769bc491c658b93b5ada226e0667459e9d980266
- SHA512 5167a17d59dbaf35754578062f849b336c1c7befff7c6032347cfe26243b9378a716026f46402c357020bdb03924ab8b0a776bfbced0bf5542b96848ddf69c34
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxU+aewsAj5D5TvinrmC0Le5ji0hmxNrMPF:A3kMVljR56rTPji0Ajq
- TLSH T16E855B12F6A48B75D17B8074C9929656EA333C410F308BDB5394BF693F327D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH