Analysis
- max time kernel
91s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 01:34
Behavioral task
behavioral1
Sample
2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 2.3MB
- Sample260808-bzfc9sbb23
- SHA256 e205aab363c1872758b863ebdae3bc893c0bbaba41b928f3ae70f3b8666eb8ba
- MD5 35d15ca7375ac7af7b7ed1359b1179d0
- SHA1 5d296f372c88c89514050caa9ee79d07567c0b12
- SHA512 2a6ca31ab7b91e56d091db0019dc5325d53d5f3aaf5336768895b82b5f3152cd850195ed09622748bc427990ee65cef0bbf6519075c7bcdef6cf63ea42d1678b
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvm:A3kM8ljCiDeW4SkZP4sz9Mb
- TLSH T139B54952FB798E32F07A8074C592A739B9323D0907E249C7524EBB191F363C996F5329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/1064-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024275-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1064-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002352f-143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002427c-806.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021650-1286.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000230b1-1878.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0014000000016914-1897.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001300000000071d-2072.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a0000000006d1-2143.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024275-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x000300000002352f-143.dat aspack_v212_v242 behavioral1/files/0x000700000002427c-806.dat aspack_v212_v242 behavioral1/files/0x0003000000021650-1286.dat aspack_v212_v242 behavioral1/files/0x00020000000230b1-1878.dat aspack_v212_v242 behavioral1/files/0x0014000000016914-1897.dat aspack_v212_v242 behavioral1/files/0x001300000000071d-2072.dat aspack_v212_v242 behavioral1/files/0x000a0000000006d1-2143.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1840 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1064 2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 1840 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_35d15ca7375ac7af7b7ed1359b1179d0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1064
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 e205aab363c1872758b863ebdae3bc893c0bbaba41b928f3ae70f3b8666eb8ba
- MD5 35d15ca7375ac7af7b7ed1359b1179d0
- SHA1 5d296f372c88c89514050caa9ee79d07567c0b12
- SHA512 2a6ca31ab7b91e56d091db0019dc5325d53d5f3aaf5336768895b82b5f3152cd850195ed09622748bc427990ee65cef0bbf6519075c7bcdef6cf63ea42d1678b
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvm:A3kM8ljCiDeW4SkZP4sz9Mb
- TLSH T139B54952FB798E32F07A8074C592A739B9323D0907E249C7524EBB191F363C996F5329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 2.4MB
- SHA256 e148cad3a7876b1a561a056b61390a76fa79c1f15addcf5ff5b24780ca0d2114
- MD5 c9331779c8a38ee219fd5f853a8fc552
- SHA1 b0a2018a957c28d68ecf81a2d0e6ad97cc129b8a
- SHA512 7ee77a5b9ba27b56eedec6468568ea4d81045c940ae2d790f672f351ee6d0c1784d7f9a9a1eaea9e3770db58645a7b4603e163fb9558d50a5b648359bbd0f077
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmMbl:A3kM8ljCiDeW4SkZP4sz9MbzBPVAU
- TLSH T18FB54953BB798E32F0BA8474C492A739B9323D0907E249C7524EBB191F363C596F5329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 2.8MB
- SHA256 fd7c11aaabb0bd4793280832829b07c891250340f14a1496102eef7196e513e4
- MD5 9f1bbf16ed5fd3f3f1851444676bfe4a
- SHA1 1f62d80d977efd6bbb828eae96269696edb1966d
- SHA512 4b5a34d7129ed4fc30667a79a22fd1e47656c1b1d33fc33f32739206513751c15939bed4cf20667b20be2b2a690aae54b1bb1388471b418310d324bf4fd86116
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmeUf:A3kM8ljCiDeW4SkZP4sz9Mb9UidGl
- TLSH T1F4D55B52F7788E72F07AC074C5929729F9323C190BE249CB124EAB291F367C55AF9325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 0cf61368c5ce8fe4d8b18143bfba2d9251e524a0fc1af7857d709cef52458b66
- MD5 2eb86d35430fcf1aca5e6d2a4105a01e
- SHA1 dbafdd26e2632c68f18b57a68a87fd2d3482df32
- SHA512 95b681c29a95a172a47b96c3122bf53db6b4ce17b906885ac94a0905fcd14f01177ca0470df4c7f566be5110e0bf62e77939f112457e02a95a0d90b6a6ae06af
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmy0C:A3kM8ljCiDeW4SkZP4sz9MbBPji0Aj
- TLSH T184D53952FB788E32F07AC074C5D2A769E9323C4907F249C7524EAB282F366D586F5325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 2.4MB
- SHA256 5f9a64775b23c7b3ba858389c5a92624e4e7e84cca3893ed72017e9253cd5b55
- MD5 a47ce0d2fdb5ca3cdd22225559992366
- SHA1 47dcc700c4615d1f8bca47f7d47236bca3a8ff7f
- SHA512 1e7d2949872e6e785f02351ffc19941232daf43bd08b55905e2ca98f588ec536562bdc1d245fa8eaebbe03af2194e364d96b4f98ed58a0db44431c2786c17fbf
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmbD:A3kM8ljCiDeW4SkZP4sz9Mbq
- TLSH T194C53952E7788E72F06E8074C6929629B5333D0907E249C7528EFB3D1F362C55AF532A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe
- Size 2.5MB
- SHA256 1bcb45acac0c6135f90a66bd06f118a360ffa198af8cc10e75978b6f38fe81b4
- MD5 7125e112498073d778fa228ac553446c
- SHA1 3488949be1dec3ffe6d0394f972505c420d236f7
- SHA512 45788b024539bfcf80b0ad3c04028ee44fe37944439da169caf8fa9208c2c1f39d0b138aa73eef4376ecbe24e157630b3e489b4d9b5d63cc98e50bb692c3a47d
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmwyv:A3kM8ljCiDeW4SkZP4sz9Mb/TeX
- TLSH T1F3C54A53BB798E72F06A8074C4929739FA323D1907E249C7524EBB1D1F322C59AF5329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.3MB
- SHA256 ffbc5dd4d03db6cf961ff87723151a83eb226661f6cd6b4b20e8aee9ef8332e2
- MD5 e6799de1c2fe34c67eb202f4530ab66a
- SHA1 b39cb1b503ab786f07be697ab677279b757d37d5
- SHA512 6fa1db1d7d0e53a72a7f7b84b2b92fc7be1d2aa216a5ec7523e0b9004de2557b21b48dc3cc9a8290a8cbc4e7a37186ae5089f2b74deb1283325f85f4cb31411a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmwF:A3kM8ljCiDeW4SkZP4sz9Mbj
- TLSH T11BB54A52FB798E32F0AA8074C8929739B9323D490BE249C7524EBB1D1F363C556F5329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.5MB
- SHA256 fd63de262899b00993114833585c84d7ee2e1f8fb37e7e634b39a7d82686803b
- MD5 976d769e582185901e43bb6317fdb983
- SHA1 fe8debd73d5a99d4baf26874a255ae04c58e9921
- SHA512 f59ae04fcc353057c26384bf5bc33848d41b0491263aad460922e16c11a3ccd97ed619aea6e0c9a321c89fdaf0855c4a0545c418182bb2590bb460f17ae70433
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmgVW:A3kM8ljCiDeW4SkZP4sz9Mbxi2WH3
- TLSH T1F8C54A52BB798E32F07A8074C496A73DBA323D1907E249C7524EBB1D1F362C54AF5329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$
- Size 2.4MB
- SHA256 de926936fa7e2e99276d547105f3346aeb33ff17f03497aec990624769c3ad9d
- MD5 d3d3e2240dbb308f632d01a459560076
- SHA1 93899dd35ff8d90b2d0581b9f92be8a8077e80e5
- SHA512 61dbb16737a86822457645452e6284435d6e1187c0d95b6eef048f6aae35c7b0b301565cddef2d5aae7d6576b213b3ce388ef455d6a199f9682c2ad812ecbbb4
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmETV:A3kM8ljCiDeW4SkZP4sz9MbmnB0
- TLSH T189C54B52B7798E32F0BA8474C4E29739A9323D1907E249CB124EBB1D1F367C586F5329
- MD5 SHA1 SHA512 SSDEEP TLSH