Analysis
- max time kernel
88s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 20:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
- Size 1.7MB
- Sample260824-yxxabsshpc
- SHA256 310e43e0fb818001bef11ff733b2d50a5370354e4186eab0f19d75b937bc8168
- MD5 f2ea1b97fa4827c0a6c8d54af0c65734
- SHA1 251184215804f5918c79a5b82a483c7015c6ac8b
- SHA512 ae45bcb76e8d1db2ad6bc61f115bc245e3a74be97c36b3e49fd149ea3147135222879cae5777da3b3cc5ca0ce0a6a772f38764824c026c8075cfc8b6e4d7d7f3
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdTK:TuvFjuvFvljaV7uNRXNxL
- TLSH T18E85D022FBE4C83AD3A30A701B6AE715657CFE604B51858B63BC1E0D2DB12D26B35753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/files/0x0007000000024252-6.dat UPX behavioral1/files/0x0003000000022bb0-14.dat UPX behavioral1/files/0x0002000000023454-169.dat UPX behavioral1/files/0x000d00000001e91e-1259.dat UPX behavioral1/files/0x000700000002428b-1764.dat UPX behavioral1/files/0x000e00000001691d-1862.dat UPX - Executes dropped EXE 1 IoCs
pid Process 4132 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3564 2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe 4132 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_f2ea1b97fa4827c0a6c8d54af0c65734_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3564
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 310e43e0fb818001bef11ff733b2d50a5370354e4186eab0f19d75b937bc8168
- MD5 f2ea1b97fa4827c0a6c8d54af0c65734
- SHA1 251184215804f5918c79a5b82a483c7015c6ac8b
- SHA512 ae45bcb76e8d1db2ad6bc61f115bc245e3a74be97c36b3e49fd149ea3147135222879cae5777da3b3cc5ca0ce0a6a772f38764824c026c8075cfc8b6e4d7d7f3
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdTK:TuvFjuvFvljaV7uNRXNxL
- TLSH T18E85D022FBE4C83AD3A30A701B6AE715657CFE604B51858B63BC1E0D2DB12D26B35753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.8MB
- SHA256 e87cc1129a243a93f738ddcc6a9e7a5506685e5441aa5c4c51395e8f54836994
- MD5 8055eaa7550178d917eed20275c7a3f7
- SHA1 5d6b3486b2e1476076e335914e9b9cee4ee7df11
- SHA512 1a72e68e1d6cb8d45ec6b538109a2ce37e236329c10629f1d52343485e3efab2506b01feff254f5e1af81dd7717b06c9565a4dcf87f11288628d7d92de542984
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdTWTjE:TuvFjuvFvljaV7uNRXNxZw
- TLSH T19585E012FBE4C43AD3A30A705B66E715A67DFE604B51868B63B80A0D2DB13C25F35B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{87EB8AE8-DCC9-4923-8C88-7CEABF61AB19}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.8MB
- SHA256 69486cf272c9198c3125e150146c5d980aee2c2ec40ab2a60586efdfaadebc3d
- MD5 45ca473981380c84a6a73c52590cb39a
- SHA1 cd9a1c16b5f7b4282a62d58dd87fb03ef3400d4a
- SHA512 0996ac0cd3a48185b43efd589099343ecfe9cb5702668ca70864f22c26b91fca3161c0f43c58fa77c98eeb92bcd707bf99cf7629b2caee8d019d39b8f46c3245
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdTEbBPzBAU:TuvFjuvFvljaV7uNRXNxhBPVAU
- TLSH T1FB85D022FBE4C836D2A30A301BAAEB15657DFE604F50859B63AC1E0D1DB13D25B35B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 f0924c869b5de4d1cc85698f90c7e2de53bf977f7e0ddcac2522fdba7b86e74f
- MD5 e4f1da34422dafea4efd3d0f5a9fc6c7
- SHA1 3cb4dfcf11c2f8a7095956cf9726dbdeb63c838e
- SHA512 22b86d077a75a9046a1997fba58421b29aecd006e16d54c7d63e1a159bd69aa39a2d540cb9fc5d6a3e503ac7811319bf69d01dea40ee24db62ad60940a089fa0
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdTa0Le5ji0hmxNrM:TuvFjuvFvljaV7uNRXNx3Pji0Aj
- TLSH T1A6B5D012FAB4C636D1738571CAE2E74AE97579514B3085CB53A88B2C2E733D28736723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.8MB
- SHA256 31d8e8b8313ec80c467f7768ccb48e2f5c709dd8991cc27cd3a1bb28a7efa7a9
- MD5 f4fc29f9099214e4947fe1cf09b3ca49
- SHA1 13aca1f51918a445153be01843a1c00dcc63e532
- SHA512 9ff145e413895cfbc0c385384335183be4f850728a0be92e299f998c3615754c966146e134820996eedad607291e1d9a086b645834e622b1974fd2a3b399c26e
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdTjD:TuvFjuvFvljaV7uNRXNxw
- TLSH T10195BE12FAA4C436D26F0670DB66E615B17BBD204BD0828B63E8E93D1FB12C15AF5743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.7MB
- SHA256 bbcad102873dd7168c6ca501a1250a2c420dffdfca6c9d1e01ad4c842b23f3bb
- MD5 d88303ce5c09d724bedc101a904970ed
- SHA1 b709743fc514c3efe5c6fb74c28dd71f0ef3d624
- SHA512 09669d938d2aea26c4d385a02ff13242c960690d2d3a39a8613559e21ee246c4f93dfd7043194c3748b49d576409830152d5fb3b271e391a999cba5ede52d92c
- SSDEEP 24576:wEuvFAEuvFxyaewsAjaV7uNRjr4CFTlDJYdKJYdToF:TuvFjuvFvljaV7uNRXNxp
- TLSH T16C85CF12FAE4C436D7A309309F6AEB15647CFEA04B5145AB63A83F1D2CB12C16B35B53
- MD5 SHA1 SHA512 SSDEEP TLSH