Analysis
- max time kernel
110s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 22:20
Behavioral task
behavioral1
Sample
2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
- Size 5.8MB
- Sample260710-1885dacw6k
- SHA256 a7bcf2722f008171be08d3952779e2b8ec11f960f1281394691a38009dff0fa8
- MD5 92c4cc2685e81c2e7c75d0b7033abd20
- SHA1 3fc6d6fcc8ffb5c404867013e325992b8c11638f
- SHA512 7adc8233c0364a0cfb9478428e9736217d591ab76bc438ee3399eea07acbf84ec86be35d6d67886186c879bee168a71cb157338ae9c8a0a7ce934d6075cad260
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4szm:wpGfQJdXN0B7+sit7HhfkZcIt7
- TLSH T152566D2AB2B88176D0B39579C5A69755E9317C211B3186CF2284BB3C3F336D1D93AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/5336-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c528-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-418.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0b5-1013.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c86-1275.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5336-1396-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1208-1474-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6ee-1713.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1208 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000c00000001c528-5.dat nsis_installer_2 behavioral2/files/0x000300000001b2b0-11.dat nsis_installer_2 behavioral2/files/0x00030000000198df-418.dat nsis_installer_2 behavioral2/files/0x000300000001a0b5-1013.dat nsis_installer_2 behavioral2/files/0x0004000000019c86-1275.dat nsis_installer_2 behavioral2/files/0x000500000001b6ee-1713.dat nsis_installer_2 - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5336 2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe 1208 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_92c4cc2685e81c2e7c75d0b7033abd20_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5336
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.8MB
- SHA256 a7bcf2722f008171be08d3952779e2b8ec11f960f1281394691a38009dff0fa8
- MD5 92c4cc2685e81c2e7c75d0b7033abd20
- SHA1 3fc6d6fcc8ffb5c404867013e325992b8c11638f
- SHA512 7adc8233c0364a0cfb9478428e9736217d591ab76bc438ee3399eea07acbf84ec86be35d6d67886186c879bee168a71cb157338ae9c8a0a7ce934d6075cad260
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4szm:wpGfQJdXN0B7+sit7HhfkZcIt7
- TLSH T152566D2AB2B88176D0B39579C5A69755E9317C211B3186CF2284BB3C3F336D1D93AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe
- Size 5.9MB
- SHA256 3b7dc7f3ee7413bcc405fd2b63ada1511e0a98158ded658ae22b00916bcbf955
- MD5 42e67fb7f52b9931ddea9c3c0b057c48
- SHA1 87ddfdc382c7c4af5d106ffd58957413be35adb0
- SHA512 fdc6962b1d573d7f863e0a07c975c3b3b5fa3372e171a0fbf65362bae379a19b3551d0b7f9bbc493da2de5a69421a6e814f6d529aae0f31695d2661bf5f827fe
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4szZ:wpGfQJdXN0B7+sit7HhfkZcIt7N
- TLSH T189567D2AB2B88176D0B39579C5A69755E9317C211B3186CF2284BB3C3F336D1D93AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.3MB
- SHA256 e150e497e10042e3111d22547c16ca38a966b3adfc2daf9233a4d405c80f931f
- MD5 6d50258314ad44e5794a4ca51f7f45a3
- SHA1 5aea98d48a8e165f1f3c42a9a13be13888a64708
- SHA512 469a508391206ebc390166cb12f548234a3f26e6023f008196b1737bfdd780f634a6de8bb20576151b88279de4ccef05a2a499e8d07dd085452037d00b369198
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4sz5:wpGfQJdXN0B7+sit7HhfkZcIt7Ijo
- TLSH T1A5666D2AB2B88276D073D179C5A69759E9317C211B3186CF2284AB7C3F336D1D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe$
- Size 5.8MB
- SHA256 540e557e16c28a33b979b6996820e6cdc9ebfacd2ec56490f3ef2dce321d0ba2
- MD5 4e676ae522372df677a18248933e0104
- SHA1 4d573f8f5129854f14737cf36ddc283f73a16d77
- SHA512 2d9bc1a7a61093a101bc6e42fd56a083c060dd81c1eaecc60d78faea8b0b212e6cfc7f3d9cd964e5ed342294fd3aac7b0b8b41d79635e4fcf361498333fc164c
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4szW:wpGfQJdXN0B7+sit7HhfkZcIt76
- TLSH T166566D2AB2B88176D0B39579C5A69755E9317C211B3186CF2284BB3C3F336D1D93AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 5.8MB
- SHA256 b8907650632637096c703835b1e18a75103d2824317b2c667af4c39a48a78405
- MD5 cac1ade7e0fcbb2c2bbee85ce8ccbf07
- SHA1 fe9b7556b8c17d93cc40fdd35e06519551bcbd27
- SHA512 e0f889d1e834b1c9bc98095d9c68cacd4bfc8d897b5cad00852568beef38a85b521f14077d2c1287a9c757569b3f291109c15da28b61a6694da3b298a0b0b8f5
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4szf:wpGfQJdXN0B7+sit7HhfkZcIt7j
- TLSH T1A9566D2AB2B88176D0B39579C5A69755E9317C211B3186CF2284BB3C3F337D1D93AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 5.8MB
- SHA256 c5008fb5295db4f2156e5d7eae4cc5a81ff98e390420e159aec7c498e7d5b237
- MD5 e214cc6770039097f23bac2dd5dd9ef6
- SHA1 1b8f590fbfc53a6f46e52753c526acb37e959964
- SHA512 a2be3ec52c73fc55a60d48df121eb32f40d98c55bb17e818d8f1356caa6aea3c14e022587417e3881a2deea233db9f93a6023944b0823e053c6eaf6b3387333d
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJrOIAOjReW4SkZP4sze:wpGfQJdXN0B7+sit7HhfkZcIt7S
- TLSH T172566D2AB2F88176D0B39579C5A69755E9317C211B3186CF2284BB3C3F336D1D93AB21
- MD5 SHA1 SHA512 SSDEEP TLSH