Analysis
- max time kernel
95s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 14:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 5.1MB
- Sample260720-rda5esct6q
- SHA256 78fa7706be5f16ea0e7ff4db230c159a63f63ee3a6d738dde78b6e9d3ab519cd
- MD5 e9dc8207081ae319eb0b78efd51a5083
- SHA1 0a85467943b37f480d2b792877babbfb193ca664
- SHA512 1c667d18cb4a2c0a1e4948781a90e2b93031d529f2892e09eb394a5a327f2c9083766acc717d814b927f87ece1f915adb1ceff8e6ea18ffc0bf7a18a465047fb
- SSDEEP 49152:/q2a2EzyEp6ku5HOTEZqhaK6zbfqdlzqJtb2I/56r+qJtb2IQ8tDZqrKtUOlk09:25pKHtxSvr+zo9
- TLSH T1D2364A19FFA48AA1D0778175C5A2976EEA727C010F3087CB5244F62DAE33FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/1392-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c501-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac27-969.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001ac33-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1392-1947-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5136-1960-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5136 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1392 2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 5136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9dc8207081ae319eb0b78efd51a5083_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1392
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.1MB
- SHA256 78fa7706be5f16ea0e7ff4db230c159a63f63ee3a6d738dde78b6e9d3ab519cd
- MD5 e9dc8207081ae319eb0b78efd51a5083
- SHA1 0a85467943b37f480d2b792877babbfb193ca664
- SHA512 1c667d18cb4a2c0a1e4948781a90e2b93031d529f2892e09eb394a5a327f2c9083766acc717d814b927f87ece1f915adb1ceff8e6ea18ffc0bf7a18a465047fb
- SSDEEP 49152:/q2a2EzyEp6ku5HOTEZqhaK6zbfqdlzqJtb2I/56r+qJtb2IQ8tDZqrKtUOlk09:25pKHtxSvr+zo9
- TLSH T1D2364A19FFA48AA1D0778175C5A2976EEA727C010F3087CB5244F62DAE33FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.6MB
- SHA256 7420b5575823de09a6c3f3f80cc7a4cf5ed6098fa5c4eb2dd7a73b53d20c93be
- MD5 f9e698ee1e7aed101fff9635545e2c72
- SHA1 67a113e61b6c5fe155cbf5e101c1dfbcc4387462
- SHA512 4654d196327463e31c2277433edc5b1c733951b62a80d6f2b6683db7dd054e7b7e41cc6dd4aa5c8f273dc82210e0fed0225bb9ec0f0126d31df779d4abe40006
- SSDEEP 49152:/q2a2EzyEp6ku5HOTEZqhaK6zbfqdlzqJtb2I/56r+qJtb2IQ8tDZqrKtUOlk0lO:25pKHtxSvr+zo1jo
- TLSH T1FA465B29FFA48AA1D0778175C5A2975EEA727C010F3087CB5244F62DAE33FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 5.1MB
- SHA256 32538d4ba1a3841d373580279cac89872635b44a8b67b1ad73d5faa7e39dacb9
- MD5 a1add5eca4f54fcf1b91c982b26a29e6
- SHA1 1ce3403cf4a682787eeba9f10de978038d7e5e23
- SHA512 5f8d34a379f7fecb9122ebebd9d2b6dd447bd09400974cdf3725e78523fae2cabfc01b6054ecb1622c0cc0844e7ed5ef155281774a96dcd49aa7910d37ba578a
- SSDEEP 49152:/q2a2EzyEp6ku5HOTEZqhaK6zbfqdlzqJtb2I/56r+qJtb2IQ8tDZqrKtUOlk0Q1:25pKHtxSvr+zoI
- TLSH T1E6364A19FFA48AA1D0778175C5A2976AEA727C010F3087CF5244F62DAE33FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe
- Size 5.1MB
- SHA256 0a1ed888859faec87f7c92274815b53175ad41db8f35f960435d1314c3756885
- MD5 41c755cb9a04f78d88c8edcc39325803
- SHA1 f3eb1df96b1898185debcb1551d76afa41328bda
- SHA512 74daef967cbf4e28dac705ecd9302a528f097ff56689469101e801456c5c175d313dacdbc51323d88bac294172de23a6d11678d42b46e75ba289f8193b5312ab
- SSDEEP 49152:/q2a2EzyEp6ku5HOTEZqhaK6zbfqdlzqJtb2I/56r+qJtb2IQ8tDZqrKtUOlk0f:25pKHtxSvr+zof
- TLSH T157464B19FFA48AA1D0778175C9A2975AEA727C010F3087CF5244F62DAE33FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH