Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe
- Size 15.3MB
- Sample261024-kk16vsef27
- SHA256 4e26f5edb1eda76ad69efbec1885281c0c34150712e788ea51041c9f7929d8ca
- MD5 7424eb82ea248fbf65417128d440565b
- SHA1 dcac65b072a9fa7810d1fec0e334ffc99120f8fc
- SHA512 febba986c9c7eb7791419a01389070e5da3b37b48491e06ff3848fd9f867577e8dfb39089d8a32a51fc09d2cf95749ca40bf5337d2b8001d27d2b46b91a09a93
- SSDEEP 393216:17p5ARofsDYKp9SASdRrqNV/f/PP/GXbyR:RpmRofcpDf//GXW
- TLSH T159F6BF22FA41807AD98201F0A93DABBE903DDB742B7580C7B3DC5E6D1B705C25B36B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 1724 SodaPDFDesktop14_14.0.288.2572.exe 5960 SodaPDFDesktop14_0.0.0.0.exe 400 SodaPDFDesktop14.exe 236 SodaPDFDesktop14.exe 252 SodaPDFDesktop14.exe - Loads dropped DLL 1 IoCs
pid Process 1724 SodaPDFDesktop14_14.0.288.2572.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SodaPDFDesktop14_14.0.288.2572.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SodaPDFDesktop14_14.0.288.2572.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SodaPDFDesktop14_0.0.0.0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SodaPDFDesktop14_0.0.0.0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SodaPDFDesktop14.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SodaPDFDesktop14.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14_14.0.288.2572.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14_0.0.0.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe - Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\ = "Installer Class" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\0\win32 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\0\win32\ = "C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520} SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Programmable SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Version SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Version\ = "1.0" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ = "IInstaller" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\ = "{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}" SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\TypeLib\ = "{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982} SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982} SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688} SodaPDFDesktop14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Elevation\Enabled = "1" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\LocalServer32\ServerExecutable = "C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Elevation\IconReference = "@C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe,-501" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\FLAGS\ = "0" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\Version = "1.0" SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14_14.0.288.2572.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14_14.0.288.2572.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\ = "GlamInstallerComLib" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\FLAGS SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\HELPDIR\ = "C:\\ProgramData\\Soda PDF Desktop 14\\Installation" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\Version = "1.0" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982} SodaPDFDesktop14_14.0.288.2572.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\LocalServer32\ = "\"C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe\"" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Elevation SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C} SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\HELPDIR SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\ = "{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520} SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\LocalServer32 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\TypeLib SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\0 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ = "IInstaller" SodaPDFDesktop14.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SodaPDFDesktop14_14.0.288.2572.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SodaPDFDesktop14_14.0.288.2572.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C SodaPDFDesktop14_14.0.288.2572.exe Set value (data) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb6b000000010000002000000068b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 SodaPDFDesktop14_14.0.288.2572.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 SodaPDFDesktop14_14.0.288.2572.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1724 SodaPDFDesktop14_14.0.288.2572.exe 1724 SodaPDFDesktop14_14.0.288.2572.exe 1724 SodaPDFDesktop14_14.0.288.2572.exe 1724 SodaPDFDesktop14_14.0.288.2572.exe 1724 SodaPDFDesktop14_14.0.288.2572.exe 1724 SodaPDFDesktop14_14.0.288.2572.exe 5960 SodaPDFDesktop14_0.0.0.0.exe 5960 SodaPDFDesktop14_0.0.0.0.exe 5960 SodaPDFDesktop14_0.0.0.0.exe 5960 SodaPDFDesktop14_0.0.0.0.exe 236 SodaPDFDesktop14.exe 236 SodaPDFDesktop14.exe 236 SodaPDFDesktop14.exe 236 SodaPDFDesktop14.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1724 SodaPDFDesktop14_14.0.288.2572.exe 1724 SodaPDFDesktop14_14.0.288.2572.exe 236 SodaPDFDesktop14.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3088 wrote to memory of 1724 3088 2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe 89 PID 1724 wrote to memory of 5960 1724 SodaPDFDesktop14_14.0.288.2572.exe 91 PID 5960 wrote to memory of 400 5960 SodaPDFDesktop14_0.0.0.0.exe 92 PID 5960 wrote to memory of 236 5960 SodaPDFDesktop14_0.0.0.0.exe 93 PID 5960 wrote to memory of 252 5960 SodaPDFDesktop14_0.0.0.0.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7424eb82ea248fbf65417128d440565b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hell.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\33a9dd6c-6ad0-4b70-a854-b1dc74e7e6a0\SodaPDFDesktop14_14.0.288.2572.exeC:\Users\Admin\AppData\Local\Temp\33a9dd6c-6ad0-4b70-a854-b1dc74e7e6a0\SodaPDFDesktop14_14.0.288.2572.exe /update=start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\c45d73fa-6bca-45e6-a44a-20dfc3b29bfe\SodaPDFDesktop14_0.0.0.0.exe"C:\Users\Admin\AppData\Local\Temp\c45d73fa-6bca-45e6-a44a-20dfc3b29bfe\SodaPDFDesktop14_0.0.0.0.exe" /update=finish /second-instance3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe"C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe" /RegServer4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:400
-
-
C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe"C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe" /welcome /no-check-updates4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:236
-
-
C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe"C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe" /CleanupTempFolder /ParentProcessId=59604⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:252
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\PlayaSDK\PlayaSDK.dll
- Size 960KB
- SHA256 3f933bced2d9f65d48f7c48715bf286fd431341a74e1ce15d39b7c4c96603cf9
- MD5 11a813c0972b740937d3a7e2daf9ffcb
- SHA1 4245b5a3c97f725c56a29d745767edebb5e3f15d
- SHA512 9a590dcab0cf7051d04743736ea7a6b74fa0f87539580cc41a58ad33a76574201e7b6d54d5100cbcd262266bc55b053243edd4860a2d43deeb1c164395e4a941
- SSDEEP 24576:lLmp4GqU+az1Y3E6URUONbnLsiTGUE23CeTrBA8bpd7RRzS6gp/f:lLmMUFYeRUQ9CeTrBA8bpd7RRzS6gp/f
- TLSH T16B25C0633D8480B2DB9E02706478AB750E7EA1350B2086D7A7D47AADDE306D1D73B74B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\app-config.json
- Size 2KB
- SHA256 252741292d95672a083b1add86a75072a2876fc74b775777fefd264180f34d74
- MD5 d1521777296b3de77ddcd3e1ca648723
- SHA1 7aed2c5916a0b88e5245acf9a9f43752dd24aa20
- SHA512 87752ec825d07687f6c5e96f98c95907588a1f579510fc44783a41e6697ebf9047daf467e9875db475c5c2b8902c440128c130867c19ae813076a0010abff5a6
- TLSH T16951B7EB7A5C62FB16C8136E007EC9F5198FD6D9A0B0406B3A597618A491C6F023671F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\logs\2026.10.24_09.40.38_SodaPDFDesktop14_0.0.0.0_5960.txt
- Size 1KB
- SHA256 d7b6ccb3cc09e83063174bf0126d9d14017c135b711cfbfec40b711611614e91
- MD5 932fc0e5db77b3b0d623707e065380be
- SHA1 432aec87b8526c1b733942b59c2eb071c40d16a2
- SHA512 725c8635826be330dbc1574954ba08c38f2875c52aeaac0498daf3c5c4fd4c34132d0de5877147eb48e7fe23257b4f67a7bcaf208ceb6a2b8f99fb78f743b80e
- TLSH T1E821C20533C28599E754771DBC17FFD06627721845F4273212E6E23011AEE694FC936A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\updates-info.json
- Size 3KB
- SHA256 70be6e1b481f311c60c6a88087030c3a5c9d71e4eed08117a2761131e9395142
- MD5 801859b5c3bb497d2ac14a2b979fadd5
- SHA1 d4c299f5d5d692bcec4f26a7e8a83f5ff6577939
- SHA512 ba60eb9c3712939c2dc4a871c9fb0434d72b57d8d1136480ca0f4c67ed5c110fb77d6a45eecede7d88b5b5afadd3ea6a4b0e625cfbb2f02dd21485aa447b00da
- TLSH T112512B93E6765C5712B02B562A608301C0D9C32FA0562E03F9BD425DAF722AB92F4D1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 835e9be2b8d2d214a2702f3a8d5b7612724a634004e528d5d0b8287fc68913dd
- MD5 71d1eb07d558d995da8100417543a2b5
- SHA1 05d1d35fc2f173b4948c24e36f498736d47b8430
- SHA512 5970236e6b9f949a33032e144317efc884eb6073fc3642d6a235bae4939becb3490d4d19eafe13c2d813be7ddb7bf20428ae5b9c2f53f2ae3beee9b5cefd4dda
- TLSH T134F0D47FDCBC38B1590E547C3DFDC6507CA0A04C48A3443936BD38E45957A92AB5E81D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
- MD5 937eade2963d309f04ad7c807ba17156
- SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
- SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
- TLSH T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_22FC0A8DC6C5B7377CD197648CE602F6
- Size 727B
- SHA256 30b235368da4bc27dc91253dd035e78deec8d19c3df0f2102fa515b2cb5dfc7e
- MD5 0f06cd42feb1f1827aa8aabf8c9c1c33
- SHA1 5615f05f7cd23e9718d7a9a2d361f6d73e838c78
- SHA512 8adb601964b7ea64f7a29cf0df5e872c4f9c6c2615be77fabaa5fd1c7e7f994497baacd6258c7710a4446e30c16a3b15458761c5de1c7c916451defdd5e940af
- TLSH T1D001651B93A9129259848C899F282D11FCE9C199AE9E825F54FC0390A4447A35D81400
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 529B
- SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
- MD5 f0102d5ebee72932834506783a39ffbf
- SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
- SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
- TLSH T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 bd76d6729ade01c2f3f2c1b03ee9b9b877521e73a668a58cfac63e7684aad19f
- MD5 74700b6f42358773d7f90406e6420211
- SHA1 09b235f714b2b90ef876fc42eb4ec547c2e3851a
- SHA512 66510aeb34e50cb646f936d9dcff365f44715998eceaedf2c0b7e869aa2cc178723968482c37274244e544ccff57eb51f9469328f3a427047f8f5af1d9e56be2
- TLSH T1130199E3DC58D6F03D502F268BBCE5507177D45E31E582713ED4408F547E0351E89544
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E303F04DC2A86EA0046DA5FB0C4B6A6E
- Size 310B
- SHA256 d0e34f2224f5bb012d27537016b06b475145be43d6ea384082eadff2fee5b6ae
- MD5 cfa94d199ff6995e0b3b541b57832fe2
- SHA1 a3c4b5b8b7c354bb39ffc2c2e1a32fffeba66f7a
- SHA512 76fef4129d9de9bb0726fb24d526fa6505bd75cb81f41287ed222ca0d8d5e8c703cb7b647aafafdc847f5cb09a15a20e49c12749643c15b65e91cdfaafad6ae6
- TLSH T182E02DE22BBDA1C588F0C140D880CC8B2DF84486E34E604843488B222CCBBCED8802CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 50e2e0bb3816b8ca05131234d5da573ec710ccb9cb0a2ca5d9464941510ead86
- MD5 8c5de62dfe29dd9d2a461ab4db53cc7e
- SHA1 cdf7585059ddab2272a62f2cb3c9f07d6c55e66f
- SHA512 93cf7b6f197abd051155242ca935527c738a4a909c6e33cf70acc34b4fc612d8d561d04d6b8d65825d0b6fde6ddf62ed6efaf9b1b744a8715e4ff964b2adbada
- TLSH T16AE0202027FE512EF1A05B7443D591955F25F1173D4452BE1E81651DE90AA005C66C31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 b2bdfa05406bf3dab8df806db5452252ac0e9af33e7b673fe9884ac82e23277e
- MD5 5c07953adc72279ca1134a33350d90e8
- SHA1 ef256d651a4cfb401d32efe25c409f5620f1c51e
- SHA512 a35a540a3795dab4fea49ab2b6587ac335c7db176c5f2ff10b63f26c0373215a546f3c2b2df2e51bcbb470e7b2d35dc8ef341e67b32d5b2226d41cc61d9d8484
- TLSH T1D9C09B447B31021DF475153F155141105BF7D104DE974304DF70111A551CA4598F7E09
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_22FC0A8DC6C5B7377CD197648CE602F6
- Size 404B
- SHA256 3ede395a7a6ab71b3586258d872c58fe2cdb068622c6114c8540c1466c278966
- MD5 c44f36b940265f87ba2c271686a183e1
- SHA1 44cad96853b825f66e682d5b1fcf78da0cf0a49e
- SHA512 2e3a1b3b1c71f4e70ea912c80881aa3cc7dff7b3285793bd1c17cefdcf6141274abf2a6cfb45180b92580fa1e310414402b89d15d97d465c3b123a36c7d5dc16
- TLSH T18EE0C63431FB414CF0F5E0380BE2DD22DA8AF16BA408836E07400642AA2AF000CE2236
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 ecc20810af64c67cfb92e5247717f6f0538db97a2ac359eb2031f42676683ae3
- MD5 2dde3b485b0fa21e2fa813bf01299468
- SHA1 6e1cf2c2b2d0ec53d94f64392413872fe3d1d00e
- SHA512 8c84f39433f9e0314af01930fe6bd9e1f7e0deb688c90a5e1e828c930bdc54f9d9667c91c691118a33e903cfe60f1d6abed3d16e4c7bfee3dcf8eaa90a98fdc9
- TLSH T1C9C09B65B3529157F195013F09E5571597F68150F643830006749195865D7D11876D41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 4717e7ebe4441397d2a84ce36304fc61c1f4617549c3c97eb397ab5e227e3b08
- MD5 a68bb36977dd031099c4b2d9c9021a56
- SHA1 66e851bb591f5371aa5f5922b6100539c331f758
- SHA512 0864b7de7d7674a86af131ea004f84f977d6c76e0b101cc8f3b62aa6d7eae0f0875d2c69bf85d5a164eab9c50910757255567b808bb868588a2fb2c2c8cc3f33
- TLSH T193E06F3826EBF20EF0A0983182FAA0720E58E711284497B90A80075DBB0AF009D20AF1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E303F04DC2A86EA0046DA5FB0C4B6A6E
- Size 192B
- SHA256 debcd8197e0cc7111d74ecee311d6b5eb25b49fb231992a5e5466350ab9e8466
- MD5 41c0ffbfdcf9df506ce19ffc95ef9330
- SHA1 2f06ce930598a8dec5d88b3abb75b7530098049d
- SHA512 44bb25f52f8e424f2d4d531669e5ebc7238590be0d085952cbc6353fb55be3987eb2ef6fb03b13cf9d300202bd6ae9d8f47fcd207f8533d99cc094644b413820
- TLSH T1CAC08C2132210206F180033D58A32A450BFCA700821183443BF212A90A8DA931AB1D4C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\33a9dd6c-6ad0-4b70-a854-b1dc74e7e6a0\SodaPDFDesktop14_14.0.288.2572.exe
- Size 15.3MB
- SHA256 4e26f5edb1eda76ad69efbec1885281c0c34150712e788ea51041c9f7929d8ca
- MD5 7424eb82ea248fbf65417128d440565b
- SHA1 dcac65b072a9fa7810d1fec0e334ffc99120f8fc
- SHA512 febba986c9c7eb7791419a01389070e5da3b37b48491e06ff3848fd9f867577e8dfb39089d8a32a51fc09d2cf95749ca40bf5337d2b8001d27d2b46b91a09a93
- SSDEEP 393216:17p5ARofsDYKp9SASdRrqNV/f/PP/GXbyR:RpmRofcpDf//GXW
- TLSH T159F6BF22FA41807AD98201F0A93DABBE903DDB742B7580C7B3DC5E6D1B705C25B36B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c45d73fa-6bca-45e6-a44a-20dfc3b29bfe\SodaPDFDesktop14_0.0.0.0.exe
- Size 11.5MB
- SHA256 2cc0bbc2247405ece54b493068b9ecfb4c78aee77fdfbb8c6227d52bc113992d
- MD5 fb397e3f792e350c3cf35233d2d9d176
- SHA1 3c6d411056305c51590fa4bdbcbe1dcb8fe2a6f8
- SHA512 f105cbcade23f626aa806bda0f98d1c6714cc2378c7c76a23c108ed425dc56ffe26707419343036ad4f7581e558760831e1bbb5ba4c1327725e84c070f1e9600
- SSDEEP 196608:F5ihBvvSjWYviC/pnzG32gkpu0bMWIfCcVaMo6tnxD3RRly+JrlrqNom2WX:bpnzG370caMPThRlzlrqNVX
- TLSH T1C7C6BF22BA42C079C25203B0652DF3AA95BDEA305B3145C773DC2B6D5F708D1AA36F67
- MD5 SHA1 SHA512 SSDEEP TLSH