Analysis
- max time kernel
82s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 18:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.2MB
- Sample260423-w73hzset2k
- SHA256 75a2eccc5bf8563e7760d9223e5ca83c93c6b50da98f4dfbf31ede78eebb51c9
- MD5 bc58e026bfbc2f4c1608f17f129e5380
- SHA1 ace0bb1b14f6201d93f1214313b92e2ff9adadcc
- SHA512 246d384ecf6710ea7ab8a6876710d86f08d8f8e257f0d8ea2ae00c8c5f0aee50df9580f0206adbf1c72aaef9364be0cb5961ee8a35915d7e25a780a999343550
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKO:hK5N55sgjOk9WOY6e
- TLSH T13EB57C12F76486FAC8724175C9A5A375A6757C210B20E7CB629CF32C4E32BD19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/1540-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024475-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2856-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000168dc-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00140000000168dc-127.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00190000000202aa-345.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002900000002163b-1247.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1540-1385-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2856-1393-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000006d1-1509.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001dad2-1891.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2856 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1540 2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 2856 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_bc58e026bfbc2f4c1608f17f129e5380_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1540
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 75a2eccc5bf8563e7760d9223e5ca83c93c6b50da98f4dfbf31ede78eebb51c9
- MD5 bc58e026bfbc2f4c1608f17f129e5380
- SHA1 ace0bb1b14f6201d93f1214313b92e2ff9adadcc
- SHA512 246d384ecf6710ea7ab8a6876710d86f08d8f8e257f0d8ea2ae00c8c5f0aee50df9580f0206adbf1c72aaef9364be0cb5961ee8a35915d7e25a780a999343550
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKO:hK5N55sgjOk9WOY6e
- TLSH T13EB57C12F76486FAC8724175C9A5A375A6757C210B20E7CB629CF32C4E32BD19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.7MB
- SHA256 cfad94e6d8a731506629974a5ce1b84c9512f2d78a9b0dbceae08d29ef3155d2
- MD5 5d6852be475e651c2ad2b51bb5c50e69
- SHA1 3faae81d537f87a3e1ab85c3b736d4a4907bda1e
- SHA512 417a553b451d1cd82d2986268943b9ca9d8757394f470bd70eeb4668c01dbe7e3334a302171dcaaa5ce97e1aade909d1a7ef865dfee62431fb5c91eef325729b
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKMTd9CHKyao:hK5N55sgjOk9WOY6KCqo
- TLSH T1B0D56B12F7A486F9D8734135C9A69325EA757C210B20E7CB529CF22D4E32BD19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe
- Size 2.4MB
- SHA256 807374fb5957e631ac402c2b1d85ccf75fdbb18c2b39a9512e80c892648701a8
- MD5 d3b9819e4d2c17bdd6c5450bc1ddb5be
- SHA1 dd79e51d7fa751b1da9946551815190f830a93c5
- SHA512 a98407c76459c570e809e5ba1f2fb42918cadf5c0933f97375ed922a9caf142dedd1cd7bd5c7dc46bbfce2511ccd0c22552d17c0851cbf1f6276bf6037fb05cd
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKQI:hK5N55sgjOk9WOY6gI
- TLSH T119B57C12F76486FAD8724175C9A5A375AA757C210B20E7CB529CF32C4E32BC19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 76372a203318b69e41cb96ce818b286f4f7af4c8db8b7057d1acc180c713b67e
- MD5 9d4ac4d3f75dbee9109e29c50c3f818e
- SHA1 a65cb0fd243e637d337cc51ed1f87a811b40120b
- SHA512 9879d374ac8f49710a2e51c232ffed76240cb68dda570d679c14dbd84d7a5600e0b3547e973940e109a666dfb2972ecc0fdd3428f047c7935a255f961ac82c48
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqK+Pji0Aj:hK5N55sgjOk9WOY60jo
- TLSH T1A0D55B12F66487FAD8728075C9D2A769EA7138510B30E7CB5289E32C5E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 2.4MB
- SHA256 254c437832fa0700ee74af61889458bd7c8edd2a5c6d5a285a97f2858683f4ea
- MD5 fc569032754eed749e1e2931289408a6
- SHA1 0e07a695410e6a8d6eb0860ca3d6af81cc271ecc
- SHA512 ccc4daefc2ee8464bf226e37a5b68d041ad205df458de29e0720589f32aeee1aa01c7ef136b7e020dd418b264989dce672e9e996b477d240f8a6c28decafb2ea
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKD:hK5N55sgjOk9WOY6T
- TLSH T134C54912F66486F9C86A4175CB959365B6377C210BA0E3CB52C8E23D4F32AC19D77B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 2.3MB
- SHA256 fe0946ca07c6d87ec01f8197b1883aa89dbb6b59a95f28941d5b8e4142a0f6c3
- MD5 cde87271013ead2ce7d7588ef09a07cf
- SHA1 91a78edd090a41419a898c1a2e5b01747df4c800
- SHA512 54f1a766606576f176d6551c46d98abfd7f5e098138cf533dd2e1610a9094499cfc88d39a329fd05dbcd4f78881596a3503431fb39951124cf19a5ccf24c106f
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKD:hK5N55sgjOk9WOY6z
- TLSH T193B57D12F76486FAD8724175C9A5A375A6757C210B20E7CB629CF32C4E32BC19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.3MB
- SHA256 5e09c020cc83e73e4e8e5b2b53e501b9440f4cc93feb0253242c49b42b729b6c
- MD5 b7c518aef9384d5a58708d0e147696a3
- SHA1 2daf2225ac503eac7cf42e38d6324eae89f1cf16
- SHA512 43431f5cc983fc3fcf7534a2ce120bff5b2daefba2964a13eb910ad6132103b6b44e0c48ec4e4a8a8b199e32580a065a2fda296b824e7365f6fe67009875a48d
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOYpYqKG:hK5N55sgjOk9WOY62
- TLSH T176B56B12F76486FAC8724075C9969375A6357C610B20E7CB629CF32D8E32BD19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH