Analysis
- max time kernel
91s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 00:50
Behavioral task
behavioral1
Sample
2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 956KB
- Sample260803-a645javglc
- SHA256 72abb4d4ddc13b234a4e5a02238d4012b4bfb07e12ad186f2cb7334fb53bec85
- MD5 13d407d91a0a9dc70a59e29fb24a2d0f
- SHA1 1201ff2640ea3a2d57eb41d3f64ccb03296e900b
- SHA512 4b9066f60f62a6c6d05cf19d27ea00bcec78529321d52d8ea03039a18bb7f68acd4b8f29f151ed9fa2d9452f13ed930ae0b29f2fa0c6d8466f58b5a5ec95cdfb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRE:A3mnXoZjzyaTj748BCE4aewsAju
- TLSH T12D25BF13FBB490B5D27B49705B75C713A639BC210B205ACBE3A89A591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002459e-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b29-39.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3048-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4488-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023532-163.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021712-1076.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000e00000001db14-1491.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021514-1535.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002459e-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-11.dat aspack_v212_v242 behavioral1/files/0x0003000000022b29-39.dat aspack_v212_v242 behavioral1/files/0x0002000000023532-163.dat aspack_v212_v242 behavioral1/files/0x0003000000021712-1076.dat aspack_v212_v242 behavioral1/files/0x000e00000001db14-1491.dat aspack_v212_v242 behavioral1/files/0x0003000000021514-1535.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4488 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3048 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4488 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3048
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 956KB
- SHA256 72abb4d4ddc13b234a4e5a02238d4012b4bfb07e12ad186f2cb7334fb53bec85
- MD5 13d407d91a0a9dc70a59e29fb24a2d0f
- SHA1 1201ff2640ea3a2d57eb41d3f64ccb03296e900b
- SHA512 4b9066f60f62a6c6d05cf19d27ea00bcec78529321d52d8ea03039a18bb7f68acd4b8f29f151ed9fa2d9452f13ed930ae0b29f2fa0c6d8466f58b5a5ec95cdfb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRE:A3mnXoZjzyaTj748BCE4aewsAju
- TLSH T12D25BF13FBB490B5D27B49705B75C713A639BC210B205ACBE3A89A591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.0MB
- SHA256 099a234135dc9c6a2f5b4014aab710669b9bd748af919ca61273f7b39ddc6e14
- MD5 f1791135c58ab8898425ffa1245f05e7
- SHA1 5f8476d45111482e1183de6a4de3b4e3755ff63a
- SHA512 659544dd47f7f31cb75e7fb09726e956c1b91f76904bb88567e8ec9f183fc9f15c70ab8f4dc6ca39fc55517173b9371f99f2bc1e0fec7aa7abdbffdec91cb0eb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRTzQl8Hok:A3mnXoZjzyaTj748BCE4aewsAjihk
- TLSH T10635B013FBB490F5D27B45705A758712EB39BC210B205ACF93A886591F327C06F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 17ae9c3eb6d0c2eb3fb7f169dac13f901f3a90aa128d0698577a70c911cca2b9
- MD5 276a3f77a9978a2215dcf30931ef3c59
- SHA1 de2832f0b4e42e7d934ea4b536816e65b3837c5a
- SHA512 7d6e9c986336c1afb3cd3cbfe7302b45b0694bd1cc1355a6b7176b9079c22792dbc83d93bef79d48d174dc021ba4e0a1483e53aab9b8f5f776d5256235df7139
- SSDEEP 24576:A3mnXoZjzyaTj748BCE4aewsAjK3Td9CHKy7GZO:A3kM84ljsTd9CHKyao
- TLSH T13865AE12F7F450F5E17B8A308A758612EA79BC610B309ACF53A856591F327D09F39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 827f9c2e72f163ab29c7086e1401a3e768795083d76c2e952d696a842be2f1c3
- MD5 c07311c2a70480fe18b36c0f1c6c2c7a
- SHA1 c26837e1ebda8f2a1b59a79a470dab14515bded0
- SHA512 8600527b9ecc5cb24195c47641efadbe41291107525dd349a3359140e137277c6dfdc5e4002e4663b880e2ad81c189dc3cae59a321512da76ee2a064e2e4bf87
- SSDEEP 24576:A3mnXoZjzyaTj748BCE4aewsAje0Le5ji0hmxNrM:A3kM84ljePji0Aj
- TLSH T18F658E22F6B48275D077C575CAE2975AEA3134510B308ACB9394C76D2F237D19B3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 970KB
- SHA256 54630b9505da705993feeab83dc5caeee5c3454c75faae64c77ca28df6bbb6bf
- MD5 0a69926f652a9c80302b7e633b4e730a
- SHA1 59676bb8a713c42fbfb6b27af14e2dcd2f3f2160
- SHA512 f07cc22895213afb5050a6e002de3bed25a0a7fc22d3f5fb03b24ba11be6aeee564b58c16c76bc6b5114da8c849b56b8056cd0937394c75265a9587ef4816acc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjR2a:A3mnXoZjzyaTj748BCE4aewsAjYa
- TLSH T13225BF13FBB490B5D27B49705B758713A739BC210B205ACBE3A89A591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 1.1MB
- SHA256 2e4b3dd8236fff7769901511227925dbc2e03ded45ce7e880ff5f0009eff3f5a
- MD5 65d12cc54eb62de5a0960a81229c33f7
- SHA1 ce02346a01ed5b738cd654083416e7c54ee69bb1
- SHA512 d9553dcf07168f0c48843d0472b6f0c7fa52a1af3566275869029a33a917c4363c0372f3bf7abe8e7be40ebf349b92bfb6615488930a8c0f301eb08b9df0fe14
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRyXsf3z:A3mnXoZjzyaTj748BCE4aewsAjHD
- TLSH T1BF357C12E6A480A5D16F4570CB658612B63B7C210BE096CB93E4E67D1F327C06FFAB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$
- Size 1.2MB
- SHA256 70ae691a3f61c9c3f502221d70e1ba5c5d32855c41b4bd9a17fcdc870abd3478
- MD5 edc56caa0b1de6a891ec0f95ce177218
- SHA1 538b74318af4232965b78dfaaf7290ea0ba74c31
- SHA512 a96fe8ba05f17b5748e021df3f661c2e85ca521b4963147c8f3b45f5c170b63a5b89a831be9c82fa544dbe0eba835293aaed8e529daed17cb3c10a1de5bdb05c
- SSDEEP 24576:A3mnXoZjzyaTj748BCE4aewsAj0wukOWy5:A3kM84lj0w7OB5
- TLSH T1D3459E12FBB484F5D67B45344A66C622E779BC111B209ACF93A4C65A1F333D06F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH