Analysis
- max time kernel
106s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 04:46
Behavioral task
behavioral1
Sample
2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
- Size 5.1MB
- Sample260813-fd6esabl7x
- SHA256 64ebebc6df954d6c5cf2f42ff73077328fde816b64bca9f0a4d6ef1c96775770
- MD5 669354f6a1b9eb133f5c6b56f29835f3
- SHA1 751151ea4d48ddb6d51929feaee01e590963220a
- SHA512 c890a1dbd7d73ee93d796972e2cbe63385d9efb273cf6aea5321b4d1b280f41bb7e0ae629a7d06530dd28928ff8f51d9d8e607b0ffe1bbb616311d1762d6391f
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2s:VpGfQJdXN0B7+sitq2eQhbI6
- TLSH T114467D16B7E885B5E0B38574C9A28645EA727C211B31C6CF6394923D1F33BD19D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3344-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024433-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4580-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024437-145.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-336.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021725-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002163b-1256.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3344-1493-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4580-1512-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001500000002029e-1519.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4580 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NSIS installer 7 IoCs
resource yara_rule behavioral1/files/0x0008000000024433-6.dat nsis_installer_2 behavioral1/files/0x0003000000022b67-12.dat nsis_installer_2 behavioral1/files/0x0007000000024437-145.dat nsis_installer_2 behavioral1/files/0x00030000000202be-336.dat nsis_installer_2 behavioral1/files/0x0002000000021725-747.dat nsis_installer_2 behavioral1/files/0x000200000002163b-1256.dat nsis_installer_2 behavioral1/files/0x001500000002029e-1519.dat nsis_installer_2 - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3344 2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe 4580 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_669354f6a1b9eb133f5c6b56f29835f3_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3344
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.1MB
- SHA256 64ebebc6df954d6c5cf2f42ff73077328fde816b64bca9f0a4d6ef1c96775770
- MD5 669354f6a1b9eb133f5c6b56f29835f3
- SHA1 751151ea4d48ddb6d51929feaee01e590963220a
- SHA512 c890a1dbd7d73ee93d796972e2cbe63385d9efb273cf6aea5321b4d1b280f41bb7e0ae629a7d06530dd28928ff8f51d9d8e607b0ffe1bbb616311d1762d6391f
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2s:VpGfQJdXN0B7+sitq2eQhbI6
- TLSH T114467D16B7E885B5E0B38574C9A28645EA727C211B31C6CF6394923D1F33BD19D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 5.6MB
- SHA256 e381c16b461e6f024f17e22b9726117046be9164fa715b082d9bf6754df4a103
- MD5 8c871d3d4de93828694b9f252592686d
- SHA1 9342e66e9129dab96bb5bbe750d12bee69b10b9e
- SHA512 74712b8fecab86d04dd69b9659b53dc33ca26a5cb5216199695291a9cca307840c264725c2d3c1ce04b3773227956a83bc015419c022e254587918ef011adffe
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb27:VpGfQJdXN0B7+sitq2eQhbI6YCqo
- TLSH T168467C26B7E845B5E0B38578C9A28645EA727C211B31C6CF5394923D1F33BD19D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.6MB
- SHA256 826efc1a5558f59b54bfaadc75bc36eb95695a2f810194fb8a34212755ab639e
- MD5 bc81fabc3b817d3c7f8e580732fc52d5
- SHA1 2f1c0b020476ceaa24993ccc411466bf1a9b01cf
- SHA512 7813d1b647d58b709a0a3e0008880109b7ab89d3445d3e9757c82ba756e6732e9f14573e8c74ea4417d01222539f0fcd4e963bebee5413b439a5d00a5e857f34
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2N:VpGfQJdXN0B7+sitq2eQhbI6Gjo
- TLSH T13E567D16B6E886B5E073C178C9E29645EA7278611B30C6CF5294933D2F337D19D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 5.2MB
- SHA256 82c9ada4cf224bc7651179cf2f39cd20262800be14c28e37a5a292b06bd5e391
- MD5 967f7b1469788f1c4ef7466ef52f58a4
- SHA1 d1c168291d6df4d613011ccf344a67ad08ded7f5
- SHA512 5cabab72f9e192e4f522f0bba3d3e3713bb09c8f796bd2af8867076c38ceb020de7f1547d0a45915029dd8a77b2d000f0b7562629c129cac7278c6ad05be1bb2
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2X:VpGfQJdXN0B7+sitq2eQhbI6F
- TLSH T15A466B16F6A881B5E0B78174CAA28645EA7378211B71C6CF52D4D23D1F33BD19D3AB23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 5.1MB
- SHA256 65fcf4bd22f571fc4501589087f5d196d83a6321590283cf0da12a5f89a78075
- MD5 832d9cb89d9e00b8b7c61bf126b409a3
- SHA1 3c08d29d10eab832f5a82256b1441b01c9c1cb1d
- SHA512 135d22c2e5b1b813703afdb560f8a2a0c222537dad17b6b176a428d43ca3186b235dc77b34469e12f66286b3d771b2c1afa9d2d54662adef51ade6ea39047249
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb26:VpGfQJdXN0B7+sitq2eQhbI6A
- TLSH T164467D16B7E885B5E0B38574C9A28645EA727C211B31C6CF6394923D1F33BD19D3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 5.6MB
- SHA256 efa6d279f53ce87f306d3051cbca0dfbd9e562cad65a73ddd609ec10e1c6037d
- MD5 326b142f6b80535f4b73c3cf722d5896
- SHA1 b28da6b68fd77d0caf722fe97884a3679ef8d330
- SHA512 60c7a8db3072f81244fd73559d1cdfde68b1afa3098cb1d01f0143a720049abde92d7e268c1a99282a621575d025676310ffae9519eea74b0dc0fbfa289b3f50
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2I:VpGfQJdXN0B7+sitq2eQhbI6G9
- TLSH T1AE467D26B7A885B5E0738578CAA28645DA727C211B31C7CF6294923D1F337D19D3AF32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 5.6MB
- SHA256 ff845ae3b3e020f5d7e513d4ba15887a3ebb25b5adc858beed5831638a044edc
- MD5 e1cc54cf107c6705ad1a82e290762b00
- SHA1 1f61cd3fb4c0b43a940cfafc870e932b451ddfdb
- SHA512 579bd20e7eaefa12e0b72f1e7ac1d594329048267d82f63ce7fef53ff6039ac7c747d4703dd5d76b120cb812c31329fad640d021bb4786ea3f87d9765d8515a2
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2a:VpGfQJdXN0B7+sitq2eQhbI6Si6
- TLSH T160467C16B7A88DB1F0778534C9A28219D5727C210BF286CF528DA62D1F337D19DF9B22
- MD5 SHA1 SHA512 SSDEEP TLSH