Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 18:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe
- Size 23.8MB
- Sample260805-w8e43stdqh
- SHA256 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a
- MD5 8447dbda1f62326ddfe5c02025aa7733
- SHA1 331c20574eb41bfe735806042a9b4aca241e742b
- SHA512 a52a02dd1ab8d2a221a4f0eb065cfc0cb6fde225c533c01fb3518259b31b8f5ed1638c081e462e295fa48a5b669562aea07be2598a6b4f15850288b100ea1557
- SSDEEP 393216:TZpx1YT5NI2T5NIUT5NvuqPGRdwVJUKcZEvfqLGz16fsoxTqeQt8yYjuPjZpxy:DYU2UUjXubwYmvCL86XqpmJ
- TLSH T10D473386E1075897F22E7CBB18C23BD935FD15684825CF935412E6FBAF88B6248732C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 3748 GLJF227.tmp 5404 GLJF227.tmp 3308 GLJF227.tmp 6128 GLJF227.tmp - Loads dropped DLL 8 IoCs
pid Process 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 3748 GLJF227.tmp 5404 GLJF227.tmp 3308 GLJF227.tmp 6128 GLJF227.tmp 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\XceedZip.dll 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\SysWOW64\~GLH004a.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File opened for modification C:\Windows\SysWOW64\VB5STKIT.DLL 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\SysWOW64\~GLH004c.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\SysWOW64\~GLH004e.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File opened for modification C:\Windows\SysWOW64\Msvbvm50.DLL 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\SysWOW64\~GLH0046.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File opened for modification C:\Windows\SysWOW64\ST5UNST.EXE 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File opened for modification C:\Windows\SysWOW64\COMCTL32.OCX 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File opened for modification C:\Windows\SysWOW64\msvbvm50.dll 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\SysWOW64\~GLH0044.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\SysWOW64\temp.000 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\~GLH0048.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File opened for modification C:\Windows\OMSVCPAK.INI 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe File created C:\Windows\~GLH0000.TMP 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJF227.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJF227.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJF227.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJF227.tmp - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CurVer\ = "COMCTL.Slider.1" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.2" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\TypeLib GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\Version = "1.2" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OM_Addin_Delete\Shell\Open\Command 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\ProxyStubClsid32 GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.2" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedCompression.1\CLSID\ = "{4C836512-BB70-11D2-A5A7-00105A9C91C6}" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\TypeLib GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\ = "Microsoft TabStrip Control, version 5.0 (SP2)" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus\1 GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Control GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877896-E026-11CF-8E74-00A0C90F26F8} GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000} GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8} GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.2" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ = "IProgressBar" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{97177EBC-0C54-11D0-B407-00AA00C14969}\5.0\FLAGS GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\ProgID GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ = "ITab" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA40-E020-11CF-8E74-00A0C90F26F8} GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D624E3E0-720A-11CF-8136-00AA00C14959}\TypeLib\ = "{97177EBC-0C54-11D0-B407-00AA00C14969}" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Programmable GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl.1 GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CLSID GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\ = "ITreeView" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7} GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.SBarCtrl.1" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\ = "Microsoft Slider Control, version 5.0 (SP2)" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ = "ITabStrip" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ = "INodes10" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\ = "IColumnHeader10" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\ = "ITabs10" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\TypeLib GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.2" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.2" GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ = "IImages" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1 GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D91-9D6A-101B-AFC0-4210102A8DA7}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\5.0\HELPDIR GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib\Version = "5.0" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB79768F-40E0-11D2-9BD5-0060082AE372}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000} GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\Version = "5.0" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\InprocServer32\ThreadingModel = "Apartment" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider GLJF227.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX" GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AE-850A-101B-AFC0-4210102A8DA7} GLJF227.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8} GLJF227.tmp - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4608 wrote to memory of 3748 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 89 PID 4608 wrote to memory of 5404 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 90 PID 4608 wrote to memory of 3308 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 91 PID 4608 wrote to memory of 6128 4608 0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe"C:\Users\Admin\AppData\Local\Temp\0e63fe25dc7404368c7daa88518f6b7db49e50c387b06a552125898f73b1b80a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp"C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp" C:\Windows\System32\Msvbvm50.DLL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp"C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp" C:\Windows\System32\XceedZip.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5404
-
-
C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp"C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp" C:\Windows\System32\COMCTL32.OCX2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3308
-
-
C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp"C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp" C:\Windows\System32\Msvbvm50.DLL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6128
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Method\OM30\AIM30\AIM30FND\Menu\Xml\~GLH0103.TMP
- Size 1KB
- SHA256 6c18cf641000ce59c6aefb5dc0266e4bd357a81c64d801a507025801242168fa
- MD5 c2f8ab508d85a2d93dc4d197197f21c1
- SHA1 cf663666578390b6b901b7f9566ea5a866e14dde
- SHA512 e93b99936720ab78eb20e6293bb9d8f06708cfda028db129903e30f709d2bbe3b474d8fc072c163dc083a7b1bb9affef3b05a88e874d9dee56a9c4e1a0d1108e
- TLSH T1CC2195E80C909906137385A47D98727FAC11F6615E8B247534ECBD287BDF88DB41EFA1
- MD5 SHA1 SHA512 TLSH
- Path C:\Method\OM30\AIM30\Menu\Images\~GLH0169.TMP
- Size 131B
- SHA256 d760464518c2609738264105e0af3dacc0ca8e9a63c11316c6669647fd35dd38
- MD5 23989f85c57a3463dbeb06bcc144be34
- SHA1 675437710155229b956a6e7562aacd47b43302a3
- SHA512 604f4f31c5b59723cc5951e40a138e1bca3ddf7fa37a1b4e73afe9b49164baf0f060326c87273ec0873e1bc59caf9c0174762f513c9a9d65a69420d76eb0e4c2
- TLSH T1B2C02B48770CC118C25180B0EC0DDC90004366A4621101386A080104E950A704C2460C
- MD5 SHA1 SHA512 TLSH
- Path C:\Method\OM30\AIM30\Menu\Support\Install.log
- Size 29KB
- SHA256 b7927fe47c258a8117991e696af342178b1cd918f14c59921547f8a8f174ad82
- MD5 1db1128b46d8d2710ff67897f1a2b6ae
- SHA1 618db7e12ca54b6487dc049880e047bff2dafaf4
- SHA512 9658b1c0e80bca4e3b6b6e6e1dc9e5d561e6b878c115fd8b906ec83806907d97883918dbb934024d35e996812f810fb1b53eba9cc47833b9cecaf4a6cdd215d9
- SSDEEP 192:bu47cgk7wj0+/4FxRANuW/nylsCzlXEwNdpQqIYk9kk8dPLdOArsOgCeJWy2/2U1:bu47FuJ5FpJccJ5
- TLSH T116D2B9E04DA623D93B59A3AF25C0B919127E42783DD72F29BEEF208830505F757E46B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Method\OM30\AIM30\custom.doc
- Size 56KB
- SHA256 6194c309e522366fc449fec7547231aa2a854ac0fb57d2557e83ea08a0569611
- MD5 a32b7048f4b120051876ed7badd50c08
- SHA1 dd8d86db23a06a31c13c18691cc4da3cef446a10
- SHA512 b848c1c2ddf11501b09d5842e5d7ffd89bd6964394d9ee870a75c7ab776a6511864df7bed9f6bc628a499238c26742d809d50c82eb9688e7b584ea3afd72720c
- SSDEEP 768:488jPptkCMiurj/t1uASximrHO+/MRBkrtQ08yqF6mmv30:488jPptr8riASxi2S6mmv
- TLSH T1E043730ABEA54A17E2295B70097A8A545771FCD17E36870BF09C727C2B331F02ED1BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Method\OM30\OMParms.ini
- Size 178B
- SHA256 115022dc5c038eddbe6270f53edbd0bc0e8d3127324cbab26107050881291e1c
- MD5 131bdb80e6a53cc44a685a02563ae4f1
- SHA1 2101be081c4129f9098be1413ee6d5b588c08f5c
- SHA512 3b434e9ed858de91e283222763c8c9cf7fe34f03a5b2072e17669b1176173196645c42ab0f705a495b53e0b95665af78fe026df929d32b9bc7187965a47b64fc
- TLSH T1FFC0129A3E13D31047EC926E44410585969265C5045B28415DE9845D252985E124A269
- MD5 SHA1 SHA512 TLSH
- Path C:\Method\OM30\PJM261\Wordlib\OMGuide.dot
- Size 87KB
- SHA256 603a4a230f1243fd3daa705d4ce72097fddc61837faec4b513aa3b352882db46
- MD5 e4e6b01b70e73d2b4605da2e7fe3281e
- SHA1 9f13c9ae846fec0ddf3397ab2e711b9123db5a41
- SHA512 4d6ff39ea5ec1672c00062e44c92b1ba400e876642678dd4ed2b318ac22493fadecbea4984e152d73bc9374326979760734ebe87c4687d26e7894a62ffed5083
- SSDEEP 1536:XgLMqjoRz1/jW3vg89p7+ivrcdIXxdXoYSc6z8hU8:wL/joRz1/jWfg8GigdyxdXoYtB
- TLSH T15393E952F192C32AD2E206375CB7A2FA7738BC156E264A0B307C733D2F367548A25756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMLOC.CFG
- Size 132B
- SHA256 32d5705ff23432ece2669f53ae1e6252b0f3bc3eb78272328eee8376c3deb1fb
- MD5 c07d87ebf758bae055ed7fae73bab214
- SHA1 5f0a91c0e4f1beb5375f1d64ddac39a7bc3e476d
- SHA512 b71ea416116ac48885f4f878769945f02b697723b3d1f74c8b451c83fef3638e23c9d0da50ab9462c0884572c631250ed76fc6f77d1ac29950483321eeb2ee54
- TLSH T117C09BAD1D4309055D8E735C1013014023D552D911574715D6D849C116464196518355
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GLCF1F7.tmp
- Size 155KB
- SHA256 bb487118b0a800604e143d8e3424e2ad35eca9c687669fa5b1610c9ba5f50a31
- MD5 c9b68c644e8f0467205cef4518d0f969
- SHA1 0338be23971b16940a17306a911fc1e9cd187b0b
- SHA512 84b5aea631b7d3ce5832d84a0e13ef149192a6d690d4c6d292608fc3eb59e55c1411fd601684dd742c830d5299b815b70cbd28de446dbf29832f163879fdc935
- SSDEEP 3072:IHtaa1I+0zUjQw+fXEZXX7EJDa3pvNtIpjS7EIwKKUvOmSaVWGgVhFOzV4t0:keUFwEFAJattEUjOgV+ozVy
- TLSH T172F38D0AB54881BAD59180BC20B577F1ABBF6C7046AB9DC3CB509E956CF4AD3BD25303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GLFFDE1.tmp
- Size 8KB
- SHA256 3e0c4e282a232b65f22911a4ab25c7b8f84660dc52a2a2bc4f1a90892ad02472
- MD5 ee137aa648f5a30f5522a48c176bf13c
- SHA1 965505b48beaacbc4cdc6ef3442ec3a9bb1f1835
- SHA512 09b8af458cb8d4de05ec60de699b2daf55444235892b29a2096a6e632399003d2c0596f38b1b6be0df545c7e39c7709797d7a9ac3901177a0be3d5e7d74dd7ba
- SSDEEP 192:8KEqyABKf6+qIhfY76isZ7J3HUeJsoKpVJP9OPsD:8TmZ9IhwUl3HvJHiVJPE
- TLSH T11302B63B61D25CF1E04243F06624BB2D62F98C7503583062DF625777AEB86A9F927207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GLJF227.tmp
- Size 2KB
- SHA256 49833d2820afb1d7409dfbd916480f2cdf5787d2e2d94166725beb9064922d5d
- MD5 6f608d264503796bebd7cd66b687be92
- SHA1 bb82145e86516859dae6d4b3bffb08c727b13c65
- SHA512 c14b7ec747357c232f9d958b44760e3a018df628291e87de52b8174ccc4ada546eba90a0e70172d1db54feca01b40cd3aeaa61b8a2b6f22d414baad1f62e8e54
- TLSH T12E51560786A4DDF3C5C803FB02C3500675EB497927EB800A0EF7551273730949778712
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\~GLH0045.TMP
- Size 1.3MB
- SHA256 4aef0066e8e4bad65018ec85d46b902303155ec2d8f049f3803e571005a90ff0
- MD5 eac679185ad621eeace9b6b286372f27
- SHA1 fba2529446d2955068d2268965a407d19ce3bf50
- SHA512 8a9ac3ff45754466c794c37683537abaa5de66bce8cffeecafb98b8da2cb1651bed9e4870217cb94f5645b272b04e20705848d132fcd719ad9213fa5b9e50a81
- SSDEEP 24576:Y97ZKs/ln70J7lsyZYtxxSHao82NgdqGE3KaIEr2nOdu4m5:M7ZViYtxW7No2Ka5r2Oduf
- TLSH T148557E13B3C48076D7E254348A57767A77789D25DA20AD4F2BD03E6E28373412B2BB36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\~GLH0047.TMP
- Size 245KB
- SHA256 96b177d4552401840b0c91f3912286c696e1ab18593612b181c17aac2fb78eb3
- MD5 ac33134d9c0a7425423ecb1af8b4cb18
- SHA1 b602818e3409f87ff4a6e0d8e8bd14d81fc12bbb
- SHA512 7304fa2c1ee98acac94089164bb0223d73a1160f6a689be5c504499f29e5b3062e2d1b7e2e5cfcd032a48a5ad2b5eafdb08c55111e03b020a693fe3e38fb8981
- SSDEEP 3072:L2cw3tnbRoyyFyycA2oxZHdOaXNJwPYUqqJdc7ITjTvmXUPij3QFY6OBavUPDHCU:63BRoyyFyycA3vOaXrUqj3H6OBavfqU0
- TLSH T1CC347B0377D281B7D6620231A96F67B9ABF5E2312E2EC6431748464C7D32BC5E75238E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\~GLH0049.TMP
- Size 70KB
- SHA256 3e0575270e3d64248cf097178dc4a5e22fc07f9567e6e3adcee9db5019fd445d
- MD5 714ed5e4095af389d1c20d1e19fde793
- SHA1 f452b49a714b720779d4718027b9afd9b98b4562
- SHA512 e06918dcac3d8702b7ec9d4cb4fb33b787ec93fba8b956ffec20628b121cfdf8a740f4f25e7f482dd00b52587a520f95bf90a5f4d9218df4833ca8174df323cf
- SSDEEP 1536:K0+U0fO8ZwdnrK44EbYbRNTXUEztjUUB1bKhqWWv:Kr1ZwdruBUwtdB1YqWW
- TLSH T1C763F702F2E1C233F5F256791DB82BBA993FBD342B3199CB9284196E1C711C19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\~GLH004a.TMP
- Size 29KB
- SHA256 79f4cded8b29ba5e1ada817322268b5aa4bc1593f39ca9c8be514788709d5168
- MD5 f17ccc7123909fbb13158003edc68034
- SHA1 f06989a733361ea7f8ad464f4233c4103c6f8ef9
- SHA512 632eaf9bad7aadb96e82d458885ed60e28c6544949f0af84502f3f10184cbef26f772f5fc2b6e27e4938f8b414384f56dc5579db7f838acc8dcdb631ee5ecb98
- SSDEEP 384:sycQ7Jlu6a8rPcREvJNdV5uoybPbjZOz4NBty7/AX03wwd7Ves8jwCWXLr7WX5Ro:PlM6prmExNNwlOMLG/O0zesT2R
- TLSH T10FD22C03E78186B3D1DB4A3C20AB2B2FB2769F2057E655C387235EB965B22D1513934A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\~GLH004d.TMP
- Size 590KB
- SHA256 2ff4299e691fcd32d2514e3fec22eda2741b111872f6675feb076ebedde57e4a
- MD5 b4882ca12de7af2487ce05235f47f0eb
- SHA1 85a6a5f10979d6fced8882aad2d09c32c697500d
- SHA512 24733d810186192b899e5bfb122bdb8fb4b4b58ec1a5b2f175130d29cbb3b2c638278d13178a86897a31b872416c5e8b55e1b6219765fcd5f118f1dacc58c0cf
- SSDEEP 6144:+BQycMRDrSrsezVgBV9iWDCUUgdxxn0L+u6ys/PrjIeacP9fFf2Jl/3fMm1KryYI:QJPiWDCUUgdxxn0L+u4jI6P9fGV
- TLSH T1B2D42902F7E49022E4B61D301A7B2BB61B727D846D35D65F6784336D1D72B81AE3332A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\~GLH0000.TMP
- Size 26KB
- SHA256 94ef91b4c7864bd1ecc0db099e58298708bc5d22da40132ebb1c17feb4675964
- MD5 89cf6af0a2a1cfebc82851c20852c121
- SHA1 9106f4ade6a696d5f98968bce895333ad5dbd9ae
- SHA512 af4a484b9bb8850c29fbfee1784b3cd3f78e6cbb419ad49262c28be16b31b5e1b43328c3088ae83f202ad2941062fa94325d77078f5c8e07a11a3fea1b56d627
- SSDEEP 384:S2p4jGewJXucxt8U7fAETozP7vTn3BTgcMBevbNE/srnCLV1x01JXS+vSpHWPJFn:S2p43iecxtloHvb3BUrkTDuLuy+vRJF
- TLSH T178C21805C76494F2D4BEAB3F43B26B0FB13E6EDA4344D9D300E025749DA36C5AB39296
- MD5 SHA1 SHA512 SSDEEP TLSH