Analysis
- max time kernel
110s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 12:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 4.2MB
- Sample260701-p3fp4aew2j
- SHA256 e85b1e2b84d8ef000b0af8ff6f0799db55f1e2fda4eab2dc081bcfa6e8f9f22c
- MD5 de133fa574fcbce457f1636733fdeba9
- SHA1 62436de315930d642cafb69650ff1d84f45d44b0
- SHA512 291fdecb8f148191a67988fa4b80832efed8aad012e0233ca111dc04eb4250f290904024ccf91a6105bd76f8db39e92cad46f6b4dfa2e74a0b73cdb8736efa24
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56b:tHyM+M6RkMkIM7esRXvfkZcorX
- TLSH T15F163911F2A88662D0BB8175C6A69766FA337C014F7087CB1284EA3D2F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2012-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c672-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019cb5-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c88-1265.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2012-1476-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/248-1489-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000006545-1875.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 248 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{61D7035B-BA7D-40D0-A332-CBE11E8DDAF4}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2012 2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 248 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_de133fa574fcbce457f1636733fdeba9_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2012
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.2MB
- SHA256 e85b1e2b84d8ef000b0af8ff6f0799db55f1e2fda4eab2dc081bcfa6e8f9f22c
- MD5 de133fa574fcbce457f1636733fdeba9
- SHA1 62436de315930d642cafb69650ff1d84f45d44b0
- SHA512 291fdecb8f148191a67988fa4b80832efed8aad012e0233ca111dc04eb4250f290904024ccf91a6105bd76f8db39e92cad46f6b4dfa2e74a0b73cdb8736efa24
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56b:tHyM+M6RkMkIM7esRXvfkZcorX
- TLSH T15F163911F2A88662D0BB8175C6A69766FA337C014F7087CB1284EA3D2F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$
- Size 4.7MB
- SHA256 5ffb5a9722a616cfcd626278bee98f003e9e442680075b56744ae98a1e1b9273
- MD5 371bca96f699f5bc363c606e94de4816
- SHA1 fa26b1aded8f66de91d120986ba305215226550f
- SHA512 b1dfabf0e892f81942b7e4d29c13794515f8de597a17d93383a2095ab3bd6e11cafe7edcb7784efd8cf19ca01e7795f9d97f64f14a98a1e05d618ea69969e22f
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56I:tHyM+M6RkMkIM7esRXvfkZcorimW
- TLSH T1F4364A11F2A88666D0BB8175C6A29756FA337C010F7087CB1294EA3D2F337D19A76727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.7MB
- SHA256 1a318b6da829b066fbdb59163763cd714b50d58618fbfc572caec6055b20080c
- MD5 86a0e5321919654eece2b48305c3e891
- SHA1 389e4eda7cd776666f800cc874dd5dd39a00f1c8
- SHA512 d45976840bd5f127bbd60d647849dd5be3b9ee573e3645af67277da11f131ba097347bad3e3ae9979d9ab55a575f474887659b1995acf5bd12896c10aa5c0195
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56u:tHyM+M6RkMkIM7esRXvfkZcorLjo
- TLSH T169363911F6B88662D0BB8175C6A2975AFA333C015F7086CB1284EA7D2F337D19936727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 4.2MB
- SHA256 750784a9aabe2ceb8c2898654369ed95d108405b70dc05ff25a61287ef4d812c
- MD5 e32cf7d3378085a89a0b4d9a7662963e
- SHA1 031af4e373e5ffe34b1f57f7b9d5a19c03a1fd65
- SHA512 c7745ec00d5cfbcf0e3b2e57de5e80df96946a4d4acfc52cd4db084f5169f0e5990dc94beb2dd1090852abb3066db85f3f5a7937983e746c1dfeae84a6b9bdbe
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56g:tHyM+M6RkMkIM7esRXvfkZcorE
- TLSH T17F163911F2A88662D0BB8175C6A69766FA337C014F7087CB1284EA3D2F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 4.2MB
- SHA256 b67a5e97ff5f9b2ed03388a0dd27d675dc90cf979f15c5c777b1f6a78a710fed
- MD5 219f16a770b092ed6f9c699526753a67
- SHA1 c50ef519967b866b094db19b73803b5698275b03
- SHA512 f46e221c807f13f0b3175ad7637c6218cae86d28e0a65b0f6c66bc02c0c6efc1198b3cc8d58a78cf400f6c734d0e0295b5085a352f0f99f54cd337ea73921bc3
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56E:tHyM+M6RkMkIM7esRXvfkZcorw
- TLSH T1E9163911F2A88662D0BB8175C6A69766FA337C014F7087CB1284EA3D2F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 4.2MB
- SHA256 1986f7db32aa12b0501ec59c5d899e4201633febf3c438315908a287af0f04cd
- MD5 28d5b26c6c02ea0eae996d6aca514289
- SHA1 14b3e574c72067b26d093e0855e01cd344169d8b
- SHA512 de258e6ae9cf186d6bbefcd5c98f9e7ef1d3ad32be8732b6231b7dd0281948b415db53d7f04c48500b5d71b860afa13fc9cc6f5aad4e95373df602076fc072ce
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56Z:tHyM+M6RkMkIM7esRXvfkZcor9
- TLSH T15E263911F2A88662D0BB8175CAA69766FA337C010F6087CB1294FA3D2F337D19975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.2MB
- SHA256 9a3ad4a228ee59d432becdbe15849e85abe8d21a8126e2ee450f9bd7f3276649
- MD5 b6c6847f1bf2873bc06a76a7dc68221b
- SHA1 3a57a89974daaa1acf8a3f61bfbd8c34e73e2592
- SHA512 6909e5daa4c8d8b8836c1fdd13114b2ab1599f347f6494b5a28380c3c1b99587a342ea2d6902a7bd07fddc36ce77e952f2d45f488481e0cb07799608eb60c4e7
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8c56A:tHyM+M6RkMkIM7esRXvfkZcor0
- TLSH T126163911F2A88662D0BB8175C6A29766FA337C014F7087CB1294EA3D2F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH