Analysis
- max time kernel
100s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 17:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe
- Size 1.2MB
- Sample261102-vktrwsdy3m
- SHA256 9bf66dd4b43721fec6a43a4d2d3fab219cf29cd55f47e631a7b09dcd564c51c0
- MD5 ff89ebe53e1ad8b756b48404e76d1003
- SHA1 60b9440e38553947a36b3304ece3bb1bdb598c7d
- SHA512 0070fbac69410cf8b9da8e33b5a36ccc3c54c079357dab88990c4aeca2102993d9102bff3a07adaeb927bfebeb121f4be3a0b8a7c0d516241c73dab9dee376a9
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uu:qk7Igjdsk9WnOmEp6
- TLSH T1E5556B5EFF948CB2D492017289AAA36D6179BD211B2143C77285F70EDE70FC1BA36712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1440-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b7fd-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b8de-10.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b49-656.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4af-658.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00690000000198f4-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1440-1621-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3588-1784-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b672-1836.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3588 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1440 2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe 3588 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ff89ebe53e1ad8b756b48404e76d1003_amadey_darkgate_elex_rhadamanthys_stop.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1440
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 9bf66dd4b43721fec6a43a4d2d3fab219cf29cd55f47e631a7b09dcd564c51c0
- MD5 ff89ebe53e1ad8b756b48404e76d1003
- SHA1 60b9440e38553947a36b3304ece3bb1bdb598c7d
- SHA512 0070fbac69410cf8b9da8e33b5a36ccc3c54c079357dab88990c4aeca2102993d9102bff3a07adaeb927bfebeb121f4be3a0b8a7c0d516241c73dab9dee376a9
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uu:qk7Igjdsk9WnOmEp6
- TLSH T1E5556B5EFF948CB2D492017289AAA36D6179BD211B2143C77285F70EDE70FC1BA36712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$
- Size 1.4MB
- SHA256 e075f5b2a4051a809f6d0e283d208885e80c95f4bb017fa8a4c6cd72aa342c86
- MD5 dcd3123c72bd784de62a7f45a575a6c3
- SHA1 c6bd0773a5372a7122a772d4b2ceca134036c0c5
- SHA512 24456a89166f5fb0b51ba50ef72ce541016e2a3b6f28b77ffc9d0a23bb22a70cd07e456c0cf4a7d737d15368345fcde26f5eb3123d891b395c4002b30cc24ad9
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uuaGmFyHUj:qk7Igjdsk9WnOmEp6DEP
- TLSH T1CC656C1EFF944CB2D06241728AA9A72E6179BC321B2147CB6284F70EDE71FC16937716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 1f3f16a03b78e89177db098f514639299c21bb2d584b6e3ebe0de8afb1e3d8a2
- MD5 ef2bc0f6d0954f4b3de66fb2667bdcbe
- SHA1 3a6398885236ba6ed58aaa7f5cacdaaf7defc997
- SHA512 a32120f10be670c88eaea067a74384ad26817ad9441d66e23be3b4d9a40ecb910d3afa01bd543bb0d1767ca0035f01eb062c47c0e1a6c18da2b66ea699340a44
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uun0Le5ji0hmxNrM:qk7Igjdsk9WnOmEp6xPji0Aj
- TLSH T1C5857B1EFEA08D72D0628076C9E6A35EA5757C511B3043C72285F71DEE72FD1AA36322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 1.3MB
- SHA256 8166e7f088a589689bdcd79f6887086b9e8ca38236f38009f21ca3c1035eff23
- MD5 f2866b29151cd4e199a860dc0d890e37
- SHA1 8fe2f70d7fb44022a8e05e835c639ae961a663b2
- SHA512 31ec3397aa8173f1bfb232b27a6ede2131f52a12b49d86c026962387135d4a9399851cd66e81831fcbb82acf5227141fa18579480dcc80fdc1080d0a72009dc1
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uupV:qk7Igjdsk9WnOmEp6x
- TLSH T13E555B5EFF948CB2D452017289AAA36D6179BD211B2143C77288F70EDE70FC1BA36716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 1.3MB
- SHA256 74651e2b55c7d18636c436f23c1580d990e266e015af8f553695d73ab75e6278
- MD5 e56fedb27970176d5d26a814ce569f2f
- SHA1 400d1523ae82d9f1ab01cdcd96f068c1edf12543
- SHA512 66127e2a7e7e09414ba8a4d70316182019e03934c92f214d185c00270a4c625b185a4f118930d98fdc8eab5cc575ef1ec3a6e58b43b0d24514fe73a9f326f5b2
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uu4Q:qk7Igjdsk9WnOmEp6B
- TLSH T106556B5EFF948CB2D452017289AAA36D6179BD211B2143C77288F70EDE70FC1BA36716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.3MB
- SHA256 6888d3e5eadcec62420e58d2537ac49d4be0c7413c2097f7ad2044981c8f3e20
- MD5 5a47a7cd6fd9e355cf5a5d270f628a1b
- SHA1 178800a076003b81305466005edf1c8830a5150b
- SHA512 7280c2de871fce6e3c36670d72f9c3af3ecb78bc556ea8e83aa0becb2e32807b0e097bb8331c6d9d609feec7144c05b5455f7f1268a8fddd5d52bfab6d154cb6
- SSDEEP 24576:2TkuK9rJkQx4tUjS4bQ6t9Wnkd4/HEp6uuKwE:qk7Igjdsk9WnOmEp6+
- TLSH T134556C5EFF948CB2D452017289AAA36D6579BD211B2143CB7284F70EDE70FC1BA36712
- MD5 SHA1 SHA512 SSDEEP TLSH