Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 08:19
Static task
static1
Behavioral task
behavioral1
Sample
2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
- Size 13.3MB
- Sample261102-j79wvaav8l
- SHA256 3bfc6c0b2426e32c3dd8f0de4bcbb29814d085cb235a6a52c4e9142ba3a6275b
- MD5 ce92d1380a59b012da96e45594ee4076
- SHA1 15b7d07e64f582172119c6382b9d1f279cdd267f
- SHA512 76a1e0a5e001f6eca5e42ab1165fc11c0464b7b159d512927ae7ea11bf41fc8256b91760545e96f0214bb0cf4ed2ddc89d89b0dd33f478a69dfe0b6411027b52
- SSDEEP 196608:UsIZf69EaKTH8wgWfUQQcP1AojH6pePv6grqN0aUQGXe2RNhMaz:UsIZfGEaK3gWfjQcapeKgrqNt/GXd6az
- TLSH T138E6AD21BA41C03AD15202F0696DABBE413EDB784BB541DBB2DC1B7C2F715C26E32A57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 18 4852 SodaPDFDesktop14.exe - Executes dropped EXE 5 IoCs
pid Process 4852 SodaPDFDesktop14.exe 4664 SodaPDFDesktop14.exe 1616 SodaPDFDesktop14.exe 3372 SodaPDFDesktop14.exe 5764 SodaPDFDesktop14.exe - Loads dropped DLL 1 IoCs
pid Process 4852 SodaPDFDesktop14.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SodaPDFDesktop14.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SodaPDFDesktop14.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SodaPDFDesktop14.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SodaPDFDesktop14.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SodaPDFDesktop14.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SodaPDFDesktop14.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SodaPDFDesktop14.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\HELPDIR SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520} SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688} SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\LocalServer32\ = "\"C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe\"" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Elevation\IconReference = "@C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe,-501" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\ = "GlamInstallerComLib" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\HELPDIR\ = "C:\\ProgramData\\Soda PDF Desktop 14\\Installation" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Version\ = "1.0" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C} SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ = "IInstaller" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982} SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\TypeLib\ = "{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520} SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\ = "{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\ = "{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}" SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982} SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\LocalServer32\ServerExecutable = "C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Version SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\ = "Installer Class" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\0\win32 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\Version = "1.0" SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\FLAGS SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib\Version = "1.0" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982} SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Programmable SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\LocalServer32 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Elevation SodaPDFDesktop14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\Elevation\Enabled = "1" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\0 SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\ = "IInstaller" SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B377F344-CAC6-42E6-B284-0117A87B5520}\TypeLib SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 SodaPDFDesktop14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48B27F31-9BA2-49F8-B146-D406C44E8688}\TypeLib SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\FLAGS\ = "0" SodaPDFDesktop14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49DC3DAF-B07F-425D-A53C-ADD8E180E51C}\1.0\0\win32\ = "C:\\ProgramData\\Soda PDF Desktop 14\\Installation\\SodaPDFDesktop14.exe" SodaPDFDesktop14.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd SodaPDFDesktop14.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd SodaPDFDesktop14.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4852 SodaPDFDesktop14.exe 4852 SodaPDFDesktop14.exe 4852 SodaPDFDesktop14.exe 4852 SodaPDFDesktop14.exe 4852 SodaPDFDesktop14.exe 4852 SodaPDFDesktop14.exe 4664 SodaPDFDesktop14.exe 4664 SodaPDFDesktop14.exe 4664 SodaPDFDesktop14.exe 4664 SodaPDFDesktop14.exe 3372 SodaPDFDesktop14.exe 3372 SodaPDFDesktop14.exe 3372 SodaPDFDesktop14.exe 3372 SodaPDFDesktop14.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4852 SodaPDFDesktop14.exe 4852 SodaPDFDesktop14.exe 3372 SodaPDFDesktop14.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5036 wrote to memory of 4852 5036 2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe 90 PID 4852 wrote to memory of 4664 4852 SodaPDFDesktop14.exe 92 PID 4664 wrote to memory of 1616 4664 SodaPDFDesktop14.exe 93 PID 4664 wrote to memory of 3372 4664 SodaPDFDesktop14.exe 94 PID 4664 wrote to memory of 5764 4664 SodaPDFDesktop14.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.343.2888\9F712A28-B1D5-4840-B8C1-976BED975A29\SodaPDFDesktop14.exeC:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.343.2888\9F712A28-B1D5-4840-B8C1-976BED975A29\SodaPDFDesktop14.exe /update=start2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.506.3407\A7BA9DEF-D4D6-4B4C-B33F-03760E40C0A5\SodaPDFDesktop14.exe"C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.506.3407\A7BA9DEF-D4D6-4B4C-B33F-03760E40C0A5\SodaPDFDesktop14.exe" /update=finish /second-instance3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe"C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe" /RegServer4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1616
-
-
C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe"C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe" /welcome /no-check-updates4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe"C:\ProgramData\Soda PDF Desktop 14\Installation\SodaPDFDesktop14.exe" /CleanupTempFolder /ParentProcessId=46644⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5764
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\PlayaSDK\PlayaSDK.dll
- Size 960KB
- SHA256 3f933bced2d9f65d48f7c48715bf286fd431341a74e1ce15d39b7c4c96603cf9
- MD5 11a813c0972b740937d3a7e2daf9ffcb
- SHA1 4245b5a3c97f725c56a29d745767edebb5e3f15d
- SHA512 9a590dcab0cf7051d04743736ea7a6b74fa0f87539580cc41a58ad33a76574201e7b6d54d5100cbcd262266bc55b053243edd4860a2d43deeb1c164395e4a941
- SSDEEP 24576:lLmp4GqU+az1Y3E6URUONbnLsiTGUE23CeTrBA8bpd7RRzS6gp/f:lLmMUFYeRUQ9CeTrBA8bpd7RRzS6gp/f
- TLSH T16B25C0633D8480B2DB9E02706478AB750E7EA1350B2086D7A7D47AADDE306D1D73B74B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\app-config.json
- Size 2KB
- SHA256 12622c5af1320c88463b3d58249ecaf215f3cb477b15fd092abe8002f79f1a8e
- MD5 ac1ec81c866d0f122c622c146d4b6d6d
- SHA1 88228ff9d1761c35a814eda3b1a4d2a16cc238ae
- SHA512 5aa7ecb770c4002cf15408d9c1567148a5c90e71c1b7901d133b0ac516208515434f8f0223a9086e4098d414f6eddf5ae839d96a6fa71545d7c4e9aeb844377b
- TLSH T1CE51B6AB394C21FF06C623BF1036EAF0268EC5FA44A0456A76487554544557F5232B2E
- MD5 SHA1 SHA512 TLSH
2026.11.02_08.19.57_2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac_5036.txt
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\logs\2026.11.02_08.19.57_2026-11-01_ce92d1380a59b012da96e45594ee4076_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac_5036.txt
- Size 932B
- SHA256 b73038e73d3507c41e4625f3118dbdc0988b9ad49fe2315764a2e39d09f519b3
- MD5 4e4a8dbda195438c16bc424ebe73c13b
- SHA1 6e7e12afc19125ca1cc001e5aea0207b09f62d12
- SHA512 f4d065c5cfd16c46fce182f43b9ce5c400eb117eafd8e78bbf1e82ec284f3629e4e288462f72ff9304b6dad6816fe0a0c842a7041de3036fb4448294cc8e7a2e
- TLSH T17F110CA8301484A6BF8C770FBDF9BDC0D21575E146F813DE2368CE252292E625F8813B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\logs\2026.11.02_08.19.59_SodaPDFDesktop14_4852.txt
- Size 1KB
- SHA256 fa54f74e560fa99083b33b02fcbeeb5d9335c0eda21e4f729dc066f72909a17e
- MD5 58b73c44c52f78b74febc5b85b940dc0
- SHA1 c4bd7e136d1903be92ea35ee0cbb38ecd158054b
- SHA512 1addb11a976ebe25177ea43220bcc4c8831e5f5c5267fa406818caee5f3358bb2e466d067759f2c701266364b38e5730da62d1170cb30f2e219f0110f40670c1
- TLSH T13911C22C3088C4B4EF44B70E38AABD90A51974B104FC27EA6384CA3426C2E555FC0176
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\logs\2026.11.02_08.20.07_SodaPDFDesktop14_4664.txt
- Size 1KB
- SHA256 caf7f61f97678096facd3061e244223da7ddac9e44261021dc628a0ae90372d7
- MD5 e7575089bc6c9772e69010e09259c01a
- SHA1 3a6f03b72c787c6e7e4f39317683bfdcd231a593
- SHA512 d68a04defee08f0fae4f0f8d83b9473f3cb84c77d4cca4fdf827d1b3a8e9172c4b45b759519e88c0a41e483877eec1003bd10d4e886d28d618c3bf68c5f081dc
- TLSH T11D215421B389E567D7163B2EFC5EBEA4893832D9C3F4266313DCD2351915DB84B44132
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Soda PDF Desktop 14\Installation\updates-info.json
- Size 3KB
- SHA256 9099b4b4cb4b6756cf522483af943f9c433fb441b3704ae908b8549366da2208
- MD5 8c55d547be6d7886445b3da8b88625e9
- SHA1 c230d06d97d0b34f835f511f380d4c36091e282c
- SHA512 624c9b512f5db50fade8261ffd8ebdd546ff5237ca435faabb6184164835b1a32a6f4124545a99285496c5213a986f3bbaa3082a536d0b94378290d778ad5800
- TLSH T1C2511D91E5765D1B6170175B2A744301C1C9872FA0AA2E43B67D935C3B712B3C3F492B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 774203ea9ed53b626aa394ccbd3fe79aea2aa04b0682e81596a382656488252f
- MD5 6dfe11c89bcf30daca1952a352ba4508
- SHA1 dd58cd8ca0042b33e5b41ecaf3ef0186c36bb76c
- SHA512 acb6318cbf073137646410a57d57f193f482d9ad84cb78485b660a378258a013e4d15a975e6ad329123cae61acc472fad19614ea940d0a2f307fa513e1c35af8
- TLSH T1DDF0D433747DB4B65811481C1EBED95021A5B46C06C6C9B6647425C88A9E3E2536611D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
- MD5 937eade2963d309f04ad7c807ba17156
- SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
- SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
- TLSH T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_22FC0A8DC6C5B7377CD197648CE602F6
- Size 727B
- SHA256 3e49a513b7babe8599ea272e8a97f06c39bc605b4b9961ecdea45a9d2248f89e
- MD5 2d3625b070577ed6a8486e66f6f28106
- SHA1 07c7290ecf9eb0e3ae1c98c1f118718362b60c7e
- SHA512 4ee39fe72c4d19892dade8596328ebca2f2aa3beef21d3fe7a536e4f484a6e6684b6349d81bb3f6112a0e636e84e561c903ebe879875dc69b5ded4f67da4b96c
- TLSH T170019986D71C000E9530C5814B5CD7A477507370B754445FD73903EBF2447E76DA6450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 529B
- SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
- MD5 f0102d5ebee72932834506783a39ffbf
- SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
- SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
- TLSH T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 5ed6e3278d522b55a451b979c6976812b6d4c8fe921b5fed6f8ebb57d5981a71
- MD5 c880792578196140ee5130e5d05fe26e
- SHA1 a2e4161da82d24031d3e124ac4b4433b7e93174c
- SHA512 ed25c284aef43216b3332aacff1d5f3c7c6d575d41813e8fa263e5ef44c49f9a87263d05820ab1056428c75f6e53a2143256e45c8d8b0e92794b8b02ddab86ad
- TLSH T1E901154795E95D9238005813AA589B64FD6EA5CA10D412E6277E619F605D7BD4900144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E303F04DC2A86EA0046DA5FB0C4B6A6E
- Size 310B
- SHA256 72a2ad2a7ceb930f48e25d4ec029f42d0393ce9b5515fb2f24f8095952a4aee2
- MD5 55fdcd0644846e965aca55d0e71efea9
- SHA1 64291691d35ca4aab9dc1399698aba217cb78865
- SHA512 bef4fcd4c764a10a0d7db2c9e2a604f01701c6f0b56bde25721714ecf1655bfeb5123a19887568eddc8967bd9576703ecf6cd37763a9af4964db199e388ab245
- TLSH T167E07D80D6E577C25BF0E602EC88C887ACFD84931F4FF040260087201AC7B86D8502D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 7924fdcbee08664d4a16f0f963f92cdd4a3bea3c4252cedc6db437cb09ee34fa
- MD5 c0b9718a97aee717df524cab1f57038a
- SHA1 961100e07f3af79f42be9fc2b072c28043eba470
- SHA512 01da84228bf26c491c7a20a38c2820a63d488b78c06ea8af6fcf9e6d3452276067c7b917bdaf9d58940fcd659be4416fc7f353e83b65dc9759fe4646995b6056
- TLSH T1F8E0C63023FA212FF1E48F3803CAD09AAF2AF0022C0052BE8E81012CA90BE000CA3C34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 d08f434002d3fb9ea77d7d6fe7dedc1eeed966a4cfed4c8c019dc915704ab5aa
- MD5 aaecbb5e796ce6d13f1dc37f44c98e04
- SHA1 60728075add07551e70985d7be4f4677e732289b
- SHA512 c2048c72bcd8e4e84eb59a2084311781be55a1269fdbeea3f53cb93191ffd639cb4ff06ff250896a260069d61d27cf51c4c6bb22b55d260947a38ebaa4520bef
- TLSH T1A5C09B447731121DF465153F559581209BFFD104DE9687049F751126651CD45D8B7E0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_22FC0A8DC6C5B7377CD197648CE602F6
- Size 404B
- SHA256 cb571ecb78ad2cb4f1c5fa84aacfa780fe638761ea7d04bb780451da99f49d72
- MD5 88aa778a157ee854fe845f3854462467
- SHA1 21f2486c0d333c21bcb783dc6fdc4144830bef4b
- SHA512 4e58c9423f3b49dbce1c8779fda3df6d62048a5396a1a7815e0da38fa28e8295d169efeb922e57818fb3264ce76e748b20a06790ea0d72723a5fbdff793e0feb
- TLSH T198E0267831FE0ACEF5F1A47807FADD32596AF16F16458B7E26401A0AAA25F400CD1736
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 366eb5f1d9204d88f5c9e1a9a240da197d22544ad7d6f4a7876b2628d5f0118d
- MD5 99c45732d6fa830c75b5e398ed8eb071
- SHA1 dbc666e50d37a886eedb67c7204800c181e5ed18
- SHA512 2ed23ede3f86a50cabd251c8373f07b239aa2709191b79d0727ff96c6308bb1fefae7e22035f0b860e6b18dc67b8b21db827fc6e49d8a9e3f7b2413a77bea458
- TLSH T1C5C09B6477528157F195013F19F5571597F6C550F647930106784155461C7910875D46
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 571597ca894f933cd5592edca8c1ca307a90174aff0b8cbadd69fb92e24be4e3
- MD5 19773c278eb674d419550cdda0b97645
- SHA1 4d67cae88f92f2cf1fd15a6b07ba139988d42c45
- SHA512 cd950b37a9f573a62320eca159cd373d6745be637a2146cdd4ced7a3dd7094720cd4c86876da9abde6b3730e02cedbd94cec301c928d2d763e1f2905851877bc
- TLSH T156E0203856EFA52EF1509C3946F9F1752E59F316140497B91AD44308BB1EF405C21EF4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E303F04DC2A86EA0046DA5FB0C4B6A6E
- Size 192B
- SHA256 9547e58f6dd3a0f2acd11a3f57b642fcd8cb4997fa3ed5e201a96c1d004aa685
- MD5 397ac919708ff68cba889a984d257f8e
- SHA1 bc575d21c5da7e3340ab4fb471bf5b4fca6a050e
- SHA512 72ad329e86a69798ffad7e6d3889e9227860d8c8c1c5459ffff5414259229d8afef8991744a6a96d228531d701a0b5625de51dbe8b04c54d35132887a310302e
- TLSH T1F3C08C1032B30B10E180133D9990A201CAF9FA04D22593582FB1426C200D6A31870E2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.343.2888\9F712A28-B1D5-4840-B8C1-976BED975A29\SodaPDFDesktop14.exe
- Size 13.3MB
- SHA256 3bfc6c0b2426e32c3dd8f0de4bcbb29814d085cb235a6a52c4e9142ba3a6275b
- MD5 ce92d1380a59b012da96e45594ee4076
- SHA1 15b7d07e64f582172119c6382b9d1f279cdd267f
- SHA512 76a1e0a5e001f6eca5e42ab1165fc11c0464b7b159d512927ae7ea11bf41fc8256b91760545e96f0214bb0cf4ed2ddc89d89b0dd33f478a69dfe0b6411027b52
- SSDEEP 196608:UsIZf69EaKTH8wgWfUQQcP1AojH6pePv6grqN0aUQGXe2RNhMaz:UsIZfGEaK3gWfjQcapeKgrqNt/GXd6az
- TLSH T138E6AD21BA41C03AD15202F0696DABBE413EDB784BB541DBB2DC1B7C2F715C26E32A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.506.3407\A7BA9DEF-D4D6-4B4C-B33F-03760E40C0A5\SodaPDFDesktop14.exe
- Size 11.5MB
- SHA256 2cc0bbc2247405ece54b493068b9ecfb4c78aee77fdfbb8c6227d52bc113992d
- MD5 fb397e3f792e350c3cf35233d2d9d176
- SHA1 3c6d411056305c51590fa4bdbcbe1dcb8fe2a6f8
- SHA512 f105cbcade23f626aa806bda0f98d1c6714cc2378c7c76a23c108ed425dc56ffe26707419343036ad4f7581e558760831e1bbb5ba4c1327725e84c070f1e9600
- SSDEEP 196608:F5ihBvvSjWYviC/pnzG32gkpu0bMWIfCcVaMo6tnxD3RRly+JrlrqNom2WX:bpnzG370caMPThRlzlrqNVX
- TLSH T1C7C6BF22BA42C079C25203B0652DF3AA95BDEA305B3145C773DC2B6D5F708D1AA36F67
- MD5 SHA1 SHA512 SSDEEP TLSH