Analysis
- max time kernel
106s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
- Size 2.9MB
- Sample260826-wepreshj7x
- SHA256 a8e0616d38c4b3a393c80217de0fbcb7340b362157770024f20362f0738556b9
- MD5 8e2316772a5dc886539c094e700fc3cc
- SHA1 874433f56bdd9feb82b091994d3841b4287190ad
- SHA512 78be6a7d78d39945618c9e430a511d09dfed452aa47ef649e063f2e4a715527f3b9ce62548883ae38a056d7c2324a5a9b30b6bb3f6ec072514a7577a6e135b19
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0Aj:T2qJdXN0B7+s7jo
- TLSH T18BE55A16B6648135DC3E8D708581A635F8317C6F7F3E758B6E80B62C1EB32D29936623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5628 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4700 2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe 5628 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_8e2316772a5dc886539c094e700fc3cc_amadey_coinminer_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4700
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 a8e0616d38c4b3a393c80217de0fbcb7340b362157770024f20362f0738556b9
- MD5 8e2316772a5dc886539c094e700fc3cc
- SHA1 874433f56bdd9feb82b091994d3841b4287190ad
- SHA512 78be6a7d78d39945618c9e430a511d09dfed452aa47ef649e063f2e4a715527f3b9ce62548883ae38a056d7c2324a5a9b30b6bb3f6ec072514a7577a6e135b19
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0Aj:T2qJdXN0B7+s7jo
- TLSH T18BE55A16B6648135DC3E8D708581A635F8317C6F7F3E758B6E80B62C1EB32D29936623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 b6c207d90d81952a67f5da112c77e359d2e4b83de589441595ca9456f6e5da68
- MD5 83e0a490bbc50b40d855ff7e0ca68c50
- SHA1 91be384d1237b1f01b1137dfa5e8dde21ea43de2
- SHA512 d4a3710e27acae9440d75e2788b03221c5b91a4e99a2ea82f2a854810af1af3ae446c35db264276f827e5a25eddc1d44a510090aed315fe6c9bcfebbfeae49b9
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0AjKPji0Aj:T2qJdXN0B7+s7jo0jo
- TLSH T18BF54915B6648231DC3E8D74C592A639F8313C5F7F3DB58B5E80B6282EB32D29536722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe$
- Size 2.9MB
- SHA256 857b4aed3fbb6119bb59ed0aef31e18471490dd9142d9ec304bec92ac09db444
- MD5 8716aa5e121186bf76f5ffdc7fdc5d30
- SHA1 fdd3f377f52b50072f0ad708eb7f8112373bba9c
- SHA512 410173fabac7ed6a1b314f0c2f3ba25642e23e9e520955eb4c19776d57272d581ebcec40847967b3742c2262a9a755e2d458cec34d401d5983d0aebb1baa77f5
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0Ajc:T2qJdXN0B7+s7joo
- TLSH T14CE55A16B6648135DC3E8D708581A635F8317C6F7F3E758B6E80B62C1EB32D29936623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$
- Size 2.9MB
- SHA256 b642fa2f9831fc48a447ef0d28dec9d16855269912e1f182ce0a9dec332d4696
- MD5 c0637b703d3b6f3674b9def363568a9e
- SHA1 37e176ed36ddbdb2ae7e649fb3360f68ab2fec6f
- SHA512 043b34f1f9787dcf2cc160aa197f9daf7fd6433e9244ea41846e0f7a8bb5009aac94b48e1741ddcfeb65a25e70bade1d7d670f8b52ceddea6e78f4df9338555e
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0Aj:T2qJdXN0B7+s7jo
- TLSH T1CCE55916B6648131DC3E8D708591A635F8317C6F7F3E758B6E80B62C1EB32D29936623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 2.9MB
- SHA256 3dcaaa2008bc953d670350620ad54106cae941421123b5da1a10e83d3234371b
- MD5 63cdb5260e32d835b58990b733957943
- SHA1 681a9115d45ffdd30b321b4d9450c3b8b1c097b5
- SHA512 dcb08a0c23cd7928d13889abf4fa22b9339d6dc577213250a7169602dee2ea076199d3d33e93e93a91c052e621db32dd9e1baec11f354f1f0585947b35de217b
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0AjH1:T2qJdXN0B7+s7joB
- TLSH T1D6E55916B6648131DC3E8D708591A635F8317C6F7F3E758B6E80B62C1EB32D29936623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 3.0MB
- SHA256 0dfb5f76712dec9cb2ac2466ff1d67d731f5b41ec6fa59a4e1558ff3b26c7fe6
- MD5 36c87b1819e7192845dd8b4d7329616d
- SHA1 5aed40e28175401f2dd1c916667460de6fd24f12
- SHA512 e469f3118905aa7336789c81a0e72c96d2bc1e4b329b6e25cb077b34cdd0474ac8e2bb4d7c7ef0a49605afd4e07eda2b67f60b604cdd0cb625b9852db28a7927
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0AjIdSZ:T2qJdXN0B7+s7jo
- TLSH T122E56A16B6648131DC3E8D708581A635F9317C6F7F3E728B6E80B62D1EB32D25936623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 3.0MB
- SHA256 3f57ef574b827b105cfd20f61501b3c97805db1c02f8a5c773b223dce79ea5c5
- MD5 53d23979fadd21e820bdf770a6677029
- SHA1 41c1677af921817ea69332a368b4857a1567e206
- SHA512 1fc517e6ab2ea6d53dee6f0fbd6af92a506a23ce06a1521b55cf37d6467d1bdd09a09d2b4d4d17ab764b5baa46ad6f522ae640965c1640f42180c62584833824
- SSDEEP 49152:TuvFvlj/ss1TzoJdXN0BMOwLloBrugZPji0Ajq:T2qJdXN0B7+s7jo2
- TLSH T1F6E55911B5648131DC7E4D708981A635F8317CAF7F3E758B6E80B72D1AB32D2A936623
- MD5 SHA1 SHA512 SSDEEP TLSH