Analysis
- max time kernel
150s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 16:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 4.4MB
- Sample260701-vbabwsaw3k
- SHA256 e1f7d82598cf3f355f73cef9f59620027ae79eda96172ca0095554124e614991
- MD5 a184b8e6c6d49af32edd170841aa6f41
- SHA1 484ca69531e7a65d13bd8ded985acb48361aacc5
- SHA512 1605a55599ea16ef5a65cd1cbff31dc410835be6916d969107c26bb5451960de633db9d011934a8dd8f8fe0378f61cb36888f799b723191c7ebf9eea67aba4d7
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYq:tHyM+M6RkMkIM7esRXvfkZc96
- TLSH T18E265B11F7B88262D0BB8175C6A2A766FA323C015B708ACF1284E67D1F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2120-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002451c-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5004-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002265d-1231.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2120-1363-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5004-1364-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000723-1372.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000000073d-1475.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001200000001ed94-1661.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c00000001ed8c-1662.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5004 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2120 2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 5004 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_a184b8e6c6d49af32edd170841aa6f41_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2120
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.4MB
- SHA256 e1f7d82598cf3f355f73cef9f59620027ae79eda96172ca0095554124e614991
- MD5 a184b8e6c6d49af32edd170841aa6f41
- SHA1 484ca69531e7a65d13bd8ded985acb48361aacc5
- SHA512 1605a55599ea16ef5a65cd1cbff31dc410835be6916d969107c26bb5451960de633db9d011934a8dd8f8fe0378f61cb36888f799b723191c7ebf9eea67aba4d7
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYq:tHyM+M6RkMkIM7esRXvfkZc96
- TLSH T18E265B11F7B88262D0BB8175C6A2A766FA323C015B708ACF1284E67D1F337D19976727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 4.7MB
- SHA256 fc4b68590a3519bfedf4a40769af9184163ad0de3495a2b76665548510068fa8
- MD5 0e17e0c5aa45cbf17d36916f7508bfed
- SHA1 af1b84cafb1fce9ecd7634d91bc2e79f316ebc2f
- SHA512 f3e1f63b5de0ecaccaca8022d2af9c7419b8f51349840d7b5565e21ce7f30ee502353a48d4dc8107b079dc3c3d892f05fad7bc964438138502d6e8d8bf855724
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYa:tHyM+M6RkMkIM7esRXvfkZc960E
- TLSH T1FC365B11F7B88262D0BB9179CAA29756FA327C410B708ACB1294E73D1F337D19936736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 4.5MB
- SHA256 476f8cb09f129e6bda94990f5687c58d77ae27b8089787d9f5e8eaa3b4e04caa
- MD5 109c7fe61687e684ccb8ace86e427821
- SHA1 284ef2bdddc58a21d41d1d0e89ec56514f58736e
- SHA512 77d529e4471112a9f2917932fc3ab78dce627cd818965af58c1b67af6d11025ae9367885d0fef23ed88822114198504ec11914ee7e2edcc7c3489cb123427e1e
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYb:tHyM+M6RkMkIM7esRXvfkZc96cW
- TLSH T1F3265B11F7B88262D0B78175C6A2A766FA327C015B708ACF1284E67D1F337D19936B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
- Size 4.5MB
- SHA256 17c1b1017fb1a60514997947d43b53dce3ffc37697647f512d86044a5ce1e8fc
- MD5 076fba4609bee63cc56090ccd20cf8ac
- SHA1 24c666110e47e10fe869ccd6baca13d5a5772591
- SHA512 f6822a734043ca292b4d0155ae3710dc7bceb05e058f27371884f47c4e0026fb40a763f1068ca2dca4d5b84da65725b7058f9751d87018bed4a02b00abc1a29a
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYr:tHyM+M6RkMkIM7esRXvfkZc96KI
- TLSH T13A265B11F7B88262D0B78175C6A2A766FA327C414B708ACF1284E67D1F337D19936B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$
- Size 4.9MB
- SHA256 94dd4eda357fbec60baa81e2bf7ce88e98d2f2fcfbd9f9d8bb548d2a57e881b9
- MD5 49c2c093946beb91d3da48eda0c50cfe
- SHA1 26664e5978d6a795bb503ee4f43ed821ea86d035
- SHA512 cd03724b3a4af50afaa3662dec845a192493abbdd003bf63cdd60eb3cb93183d567d1a0f996ea69c2f6df875b510188a80ad11212610df52125461e9f5cd5ef5
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYh:tHyM+M6RkMkIM7esRXvfkZc96gdGl
- TLSH T1B5366B11F7B88262D0BB8175CAA29756FA327C410B708ACF1294E67D1F337D19A36727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.9MB
- SHA256 367cd95f5f35dd0bb02cf302919f38a44aedaf001ce2b631b48563b59bac449a
- MD5 bc0ab6ab79307aaa0ec6c1db03c0e067
- SHA1 6f86f4ccfad459a798592c4af47af95f45b836a0
- SHA512 b3b07630a17027a86cba3e7997dd1f446043a795836d13e124a19b3b6b80e5be8f06d20e01b613060709f5f134efae6ae78ef58708cd9a43fce9612e8922ebbb
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYb:tHyM+M6RkMkIM7esRXvfkZc96Gjo
- TLSH T1A6365B11F6B88262D0B7C175C6A2A75AFA323C415B708ACB1285E77D2F377D18936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
- Size 4.5MB
- SHA256 1374f92ad8ea265ea472f65a456f267caa13389cc324f4bb53204fe002d8ad5a
- MD5 e898a809d4910a7c315f587ea9fe6280
- SHA1 0a3e5d0574945a77926f9d7583cb872d369fc66c
- SHA512 a07e517707650b92cb7475483ef133d444e45e226215491c399667cf0ee2494f0c5c019f6ede767230f977f49317db372984aaa1bc6dd94323d0ed2a006256be
- SSDEEP 49152:/lhbuRKwpBg0g7mM+M6RkMkIM7I0672ljalYvoGxUSJpXfeW4SkZP4sz9Mb8EpYY:tHyM+M6RkMkIM7esRXvfkZc96Y
- TLSH T16C264A11F6B88262D0B78175CAA6A766FA327C410B708ACF1284F77D1F337D19936726
- MD5 SHA1 SHA512 SSDEEP TLSH