Analysis
- max time kernel
95s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 14:41
Behavioral task
behavioral1
Sample
2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.4MB
- Sample260808-r2jfpsea29
- SHA256 044fa61ee223f54651c9f6f5a9168d8c032f8a05a8564eebf2a44d0d38b4ef0f
- MD5 38ba5bd2440c2ba145fa5c3b90428c31
- SHA1 64fd98dc5822d5abd0cc4ad83f4bc0d5c22c4b13
- SHA512 8e68efa30fab5995e96e7eb67f73e5969a0c95d672e2d5a8e214cab3e9693d576609ebff3a02f7849c5fc235b808d0f0fccf90739bbba6afe675cf13c58eb3d8
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyE:A3kM8ljLpYq
- TLSH T17F658D22FB748175D077C4B5CAE29756EA3538510B308ACB9398D76C2F237D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/2552-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024259-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4672-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2552-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4672-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002208b-1002.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021634-1278.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000227d2-1522.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002315d-1772.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002428d-1951.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000006cf-1979.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000162db-2122.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024259-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x000200000002208b-1002.dat aspack_v212_v242 behavioral1/files/0x0003000000021634-1278.dat aspack_v212_v242 behavioral1/files/0x00020000000227d2-1522.dat aspack_v212_v242 behavioral1/files/0x000200000002315d-1772.dat aspack_v212_v242 behavioral1/files/0x000700000002428d-1951.dat aspack_v212_v242 behavioral1/files/0x00060000000006cf-1979.dat aspack_v212_v242 behavioral1/files/0x00040000000162db-2122.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4672 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 4672 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2552
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 044fa61ee223f54651c9f6f5a9168d8c032f8a05a8564eebf2a44d0d38b4ef0f
- MD5 38ba5bd2440c2ba145fa5c3b90428c31
- SHA1 64fd98dc5822d5abd0cc4ad83f4bc0d5c22c4b13
- SHA512 8e68efa30fab5995e96e7eb67f73e5969a0c95d672e2d5a8e214cab3e9693d576609ebff3a02f7849c5fc235b808d0f0fccf90739bbba6afe675cf13c58eb3d8
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyE:A3kM8ljLpYq
- TLSH T17F658D22FB748175D077C4B5CAE29756EA3538510B308ACB9398D76C2F237D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 1.8MB
- SHA256 f70157456e2f4d0a16c2cbf54943bbdd2c4bc5e9dabf6a78fe49d794fb265721
- MD5 a942c5b743bca58fcc97cda1174614c6
- SHA1 b2806ea0e3f1acd2ac74a9c47d772c8baeab250f
- SHA512 379d97aa8c2a2c6bc282df097bc829db3280c093247b9fe9a190026df7890b52b2e1fa583404864149610e3ebe335b9dcf28ac2d45d747c039fe9527dc02b424
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEX3Td9CHKy7GZO:A3kM8ljLpYqHTd9CHKyao
- TLSH T107958D12F7B481B5E073C575CAE29716EA7238510B308ACF5398966D2F337D19A39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.5MB
- SHA256 e662edbd2660e3e88c206261d50769046af35c396c440b0b296cd694e4db8316
- MD5 996227ebc3047c5686126be2af8fbe08
- SHA1 4ec829132ddf1717e1336f69f9943f72279bff2d
- SHA512 45cf75fe3b5e1dfc2d16ede40eb1eef6c90269c8552545de66fb364a5d6df9d4640f1f3098dc57940ea80d3d9d26243c5a38f86fddca719a1c2a9ad60aa6d1f3
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEdTjE:A3kM8ljLpYqdw
- TLSH T14B658D22FB7481B5D0778575CAE29B56EB3138510B309ACB5398C7682F237D19E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe
- Size 1.5MB
- SHA256 68a11ed219d4800b30af5ae88bb648d0fa3de7580f46c5baaedf8d6b591844d8
- MD5 4131c28965340253d1e8a3e98489d43c
- SHA1 c4473557ee33a14fe152cfca5b2aabbfb6daa2be
- SHA512 b91653b6608366f98cfb218a649a5496931750dbb6c8e4d621ea7cbd6518a31bb5d89f7a1c37825d1ac970c0eeed12961be06d6b731c56054e1ebea839ef1b0e
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEeGen:A3kM8ljLpYqZI
- TLSH T1B0658C22FB7481B5D0778575CAE29B56EB3138510B309ACB5398C7682F237D19E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 bd54f1c19c3385a7c8c5f222b20455fd17123fb8c9b273e2291d87f2462b8125
- MD5 b1ca7d4c14680bb084756f6a6978bb33
- SHA1 e0a6002827a82ba28d68e9f903bb5182c873a894
- SHA512 ed7fba649018779e0c7b3697c9e2c772d91d69c7a7e0157b10d0bc9ee88f7c527d464c8d888091c34175f142ef933636c50a3d49368d33f60853a46cc118b262
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyED0Le5ji0hmxNrM:A3kM8ljLpYqjPji0Aj
- TLSH T15F955C26F6748275D073C0B9CAE2A75AEA7134410B308ACB5395D77C2F277D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 1.4MB
- SHA256 782519266d9e20e24de1ab4f982e59a3c7c0d809381365e586df328aaf91c4ce
- MD5 f30d911907b26a0ee43fbdeaf972a108
- SHA1 5e865ce2dc3ed05f02b794d9a2ec409ad814c51f
- SHA512 363ae21aa982ced6fce36b9903f921ab59dd8b3917d13ec753f1f574f8bd48e93f1751dc71195c1734aa91d28fadcee67b5112a3fa1afbe795a19532410c3aac
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEuwE:A3kM8ljLpYqk
- TLSH T135658D22FB748175D077C475CAE29B56EA3538510B308ACB9398D76C2F237D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.4MB
- SHA256 3af5fdaf95db9b298e3bc3cc930c1b194bd54df584602df73eab9a5aff191db5
- MD5 ef43445c267d2f8ddb8b38131dee9e21
- SHA1 4fb6858ed72672500fa0c6200a36322cdffe0e8d
- SHA512 fb486beb4b5317d1be27ec682425077a40531c3221dca56208b45033530046074566c0994defa21340ab3464934c85e69f5c45cbc2cb3b96c680fc3e33f9af54
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEPF:A3kM8ljLpYqt
- TLSH T110657C12F6B48171D1738075CEE69B56EA353C910B308ADB5398F7682F337D1AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.8MB
- SHA256 ab6a6cf7c27215065912b87221b8ec4b46dbec287ba7724297c9ed6a5cf335e9
- MD5 78e48f8a344056b0af987931833dfdbf
- SHA1 cd97b3929d774670f9376ba1ac5638c69198b8a5
- SHA512 9f32b2170328e219ac30a5a0b1677d1a74269bfe35ab6c95e0e5d368b471ce0f823cc94ad8aa3bf56fc33e8c72f022f8e99a13b6c94eeeef251bbcf6c32c1bd5
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEu3npi63iC:A3kM8ljLpYqOXpiMh
- TLSH T1B0958C12F7F48131E1B38671CAB29756EA367C514F3086CF6394962C1E726D1DA3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 1.4MB
- SHA256 acd9571d6ab3599edbd35ce87b28146ee2a7365337e5b126ada18b74a2c1f52d
- MD5 74182bc267e3205431e0c03cf555e1d5
- SHA1 9d83e4982de3d82ab8106babddf455353d582f1b
- SHA512 23753c8c54b7c48aa326d3ee3d8e77bc5b0890a5fd494100ed6672f22a8fb06edb3a3a775ee4dbab0a5685a33c62b28d02ef64e6e2037203b2ba99504f33d3be
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEUBl:A3kM8ljLpYq
- TLSH T1EC658D22FB748175D077C4B5CAE29756EA3538510B308ACB9398D76C2F237D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH