Analysis
- max time kernel
110s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 11:12
Behavioral task
behavioral1
Sample
2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.6MB
- Sample260708-nat7caew91
- SHA256 29c19f32d24de7b2d9bff0a2ae27950ce2879e1d4fb6d5ea787f0f26cbccb747
- MD5 a47437c15ef733a3888fe147de4957b0
- SHA1 c7f721548cd6b7adb85e61181899b094c07c55d1
- SHA512 2642a19a3fc897a2d6b217fc00d8c4a8b5d74cb3ac93f311cd7a9731901492e2f39171df0b19e84c4b0253954e8be2a3c1b45f1ee7c0c560de8e537c3fc18a0f
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DF:A3kMPljQqJtb2Ig
- TLSH T176756C22F6B48271D0778475CAD29756EA353C810B308ADB5398B76D2F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016cb6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5004-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2300-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018991-187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001898d-185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bbd-680.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a2eb-1039.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8b5-1038.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x0006000000016cb6-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-11.dat aspack_v212_v242 behavioral2/files/0x0004000000018991-187.dat aspack_v212_v242 behavioral2/files/0x000600000001898d-185.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-281.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-284.dat aspack_v212_v242 behavioral2/files/0x0003000000019bbd-680.dat aspack_v212_v242 behavioral2/files/0x000300000001a2eb-1039.dat aspack_v212_v242 behavioral2/files/0x000300000001a8b5-1038.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2300 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5004 2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 2300 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_a47437c15ef733a3888fe147de4957b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5004
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 29c19f32d24de7b2d9bff0a2ae27950ce2879e1d4fb6d5ea787f0f26cbccb747
- MD5 a47437c15ef733a3888fe147de4957b0
- SHA1 c7f721548cd6b7adb85e61181899b094c07c55d1
- SHA512 2642a19a3fc897a2d6b217fc00d8c4a8b5d74cb3ac93f311cd7a9731901492e2f39171df0b19e84c4b0253954e8be2a3c1b45f1ee7c0c560de8e537c3fc18a0f
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DF:A3kMPljQqJtb2Ig
- TLSH T176756C22F6B48271D0778475CAD29756EA353C810B308ADB5398B76D2F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 ea56acf1f05d921cfe65ffc4e435c06ebafe5f74fb00e390320d022783a2a498
- MD5 45f93d0da92d6d035b7afc00b73cf740
- SHA1 f9ce81b4802a0305854acd64bdf8fbf92fecda22
- SHA512 3eef9fe55429342f319afe20e5704e3ae09023203731720da0c18508a09f05f95a5d6e41ec886e92aee1db97ed9fc1aa33dac01705585e8c27e20ecd16f4931d
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DB0Le5ji0hmxNrM:A3kMPljQqJtb2I4Pji0Aj
- TLSH T1A4A53A26F6B48371D077C075C9D2965AEA313C824B308ACB5399E76C2E377D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.6MB
- SHA256 b1355afa77a1a42dbada1dfb37625498992077d912ffaa9b37e709c1bbabf417
- MD5 789653f9083650984f759def140ea55b
- SHA1 7034edabd1d12d261ff336877a102dc08c2acb29
- SHA512 8625ba443f511b4fffeb657534d3f51ab22dc3c78e441b0635086d55db93f2bf35185de24656a6dbd521a1f1d99e16d7bcbb6f62f7a5b75739452e055c4026e9
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5Dss:A3kMPljQqJtb2Iu
- TLSH T15F756C22F6B48271D0778475C9D29B56EA353C810B308ADB5398B76D2F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe$
- Size 1.6MB
- SHA256 68407977882ce75414bb10d47d387c87beffcab28817234e7e07a935b79276dd
- MD5 022952bd819ef97eed3fb2bb90811282
- SHA1 2eed99a4a4da423ac7eb5efa6108d127dd5a5f4b
- SHA512 2c32622cc962883bb4e6ce638b0464045934fc374d7f179c56383b070b54c7f34f418128258be61d9d7d5bb5b96270daa621d835e0123c8375a41e580f3d6f2b
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5Dex:A3kMPljQqJtb2IF
- TLSH T186757C22F6B48271D0778475C9D29756EA353C820B308ADB5398B76D2F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.6MB
- SHA256 181517eba3726fbd1ff2df3e26ba0e69c063a45bf7bc4b5e5881f41abf7e34ba
- MD5 6d64303810cf3a4dfdff0b18197ac4a4
- SHA1 21ebdefd429828ce2b14d71e1d6f1d3d45a7bd06
- SHA512 d1b51c9b365ce9a523b14e5d5bb832836dad8e3567267867e9548cd7bc394c3e29238bcf08a060b25171c2a22f807aefb616a079c2deb82fb5388afe4a28c32e
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DCc:A3kMPljQqJtb2IE
- TLSH T184756C22F6B48271D0778475C9D29B56EA353C810B308ADB5398B76D2F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$
- Size 2.0MB
- SHA256 16132a8272341d33a1c29718f926543549330fa8d2e4439012457363e1cedbca
- MD5 7a18428fccdceb61dd06307bc71ab80e
- SHA1 72bbdd9b289b6bc54c7e5cd9e5533dea3f23f9a0
- SHA512 0780ba8152ec3793f45c0e52245ab3e5f054e84c34aa33fa1a60768fe4e78abd81344adae50a2eeeb17e6a341943b151336f6709cad7fbf66bf837bcf8244578
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5D43Td9CHKy7GZI:A3kMPljQqJtb2IBTd9CHKya6
- TLSH T17CA57D21F6B48275E077C575C9A29616EA363C510B308ACF5398B72D2F337D19A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
- Size 1.6MB
- SHA256 eacac5d09d7e06b3243a4a8912640688a5c4272b9780cbb4be8d6a6e3e7779af
- MD5 8adadf468ebfcad26cdbbdc362da7178
- SHA1 244657291065be96b195e9600bf27ab3095fa29b
- SHA512 c0c7fb4af9dea3b8638dd016b8315d935e778501e9c662ebed123409543f694c0a3b6579904dc21b0b79ab548bea9416ed166bb3ccbc633852b981b205e0884a
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DE9O:A3kMPljQqJtb2IA
- TLSH T186757C22F6B48271D0778475C9D29B56EA353C810B308ADB5398B76D2F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.6MB
- SHA256 2aab176348caec21560ff84ae57d8ce7c6f15b773c346705f125c89caa4ebfc0
- MD5 f851c9f3b8b20be3d6762358610455d2
- SHA1 39087a5f5101188ac1cdb2da1aaa30b4e947f93d
- SHA512 90a694fd3222f8a5e390288a2a61925cc8b51c46d2fa6a04a12daa01d5a9bb22418587ad6459d416f2694a84ccc89886a0b47006bd9ac506b82fe4d73f000866
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DcwE:A3kMPljQqJtb2IN
- TLSH T142756C22F6B48271D0778475CAD29756EA353C810B308ADB5398F76D2F337D1AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 2.1MB
- SHA256 d3464b909df94c085b6635ab33cea7ffe8c331115a752d449ae45b80877e6dee
- MD5 31db18c39438a03220f17e4a83dd2087
- SHA1 7cd3d12f11077e73cc4a216a837a1bb1e952b474
- SHA512 04f3321df3f7f1f5f8ed25cbe18c85e10073b2ece2f1d7971a20064fd13ceef8642967ac6443f24c556f2343e536c1a976644608a619c3ca459b22894f1607ae
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWqGYTqMi8CtBd2QHCHmTBW5DL3N+tCn50ChWdAk:A3kMPljQqJtb2Io8tDZqrKV
- TLSH T1CEA56B12FAB482B1D0778075CAA69676FA717C410B308ACB5394F76D2F336D19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH