Analysis
- max time kernel
89s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 18:11
Behavioral task
behavioral1
Sample
2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.8MB
- Sample260809-wst83ashrg
- SHA256 76b82daf569b381bfa40ce8614f99cecfbd40a2a5d2ef0ec72655ae77e2d836b
- MD5 d1379cfb8628ae8e067bddb6e43f9f9e
- SHA1 b00d7fad1afd3b9ae5ead416429e49c0028cd9e3
- SHA512 57c73cb2cdc535c733b14c3ae7efce1b9395a96bd4242a7a52e0af1e0151a451442672b1701e1335140d9031c362600a196460ee95d3cf2ad26b0676239a5354
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvm:A3kMPljUeW4SkZP4sz9Mb
- TLSH T1D9854A26F6788333D0B3C0B5C5D6AB5AFA3134455B308ACB5359872C2E277D19A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 14 IoCs
resource yara_rule behavioral1/memory/2756-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024483-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1616-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-10.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2756-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1616-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000001fce8-130.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124c-272.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124a-274.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000225af-1245.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233ce-1343.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002021f-1390.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00090000000202a6-1499.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f000000000725-2223.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024483-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-10.dat aspack_v212_v242 behavioral1/files/0x000600000001fce8-130.dat aspack_v212_v242 behavioral1/files/0x000200000002124c-272.dat aspack_v212_v242 behavioral1/files/0x000200000002124a-274.dat aspack_v212_v242 behavioral1/files/0x00020000000225af-1245.dat aspack_v212_v242 behavioral1/files/0x00020000000233ce-1343.dat aspack_v212_v242 behavioral1/files/0x000a00000002021f-1390.dat aspack_v212_v242 behavioral1/files/0x00090000000202a6-1499.dat aspack_v212_v242 behavioral1/files/0x000f000000000725-2223.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1616 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2756 2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 1616 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d1379cfb8628ae8e067bddb6e43f9f9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2756
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1616
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 76b82daf569b381bfa40ce8614f99cecfbd40a2a5d2ef0ec72655ae77e2d836b
- MD5 d1379cfb8628ae8e067bddb6e43f9f9e
- SHA1 b00d7fad1afd3b9ae5ead416429e49c0028cd9e3
- SHA512 57c73cb2cdc535c733b14c3ae7efce1b9395a96bd4242a7a52e0af1e0151a451442672b1701e1335140d9031c362600a196460ee95d3cf2ad26b0676239a5354
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvm:A3kMPljUeW4SkZP4sz9Mb
- TLSH T1D9854A26F6788333D0B3C0B5C5D6AB5AFA3134455B308ACB5359872C2E277D19A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.1MB
- SHA256 20f6fc3152f35486bc231eeefd5e4348a58d80cf10fb6ca2917d4dd87c3e19d3
- MD5 7fd658dfd0b984b3fecd80fb23b8744f
- SHA1 2e776d3c38721504f667df90276f57092bfd0dce
- SHA512 d4e972b71f87cb0b10b39fc7e09d6c953e1aa4771fc788313e88613f9dba061afaa3bf64c4c166abdab67b22e01a59dbe27f524343018b5e7692d36b35e0ae0b
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmM3UNUpE+:A3kMPljUeW4SkZP4sz9MbjUN+Eir
- TLSH T17DA54B26FA788663D077C0B9C9D6A759FA3234410B308ACB5358832D2F277D19E3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
- Size 1.9MB
- SHA256 b6df1f68b65a1616187ba71d883b3d30035a1fdccce23872b9d6e70885553ced
- MD5 52cd4ff1dd34487a0bfe7d93f1ae68fb
- SHA1 b723dce787a5c94cfced7053d6242802d3526349
- SHA512 3759aa5e01566aba02e82db448ea66335bebb7ebf014096bec39554169d29fcf08adaab862e7f7beeb1454938027a8ebfe6824cdc416baac50b7192444c53f82
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvm2hk:A3kMPljUeW4SkZP4sz9Mb5W
- TLSH T1E1955B26F6788373D0B3C0B5C5D6AB5AFA3134455B308ACB5349872C2E277D19A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 360becb88803cef543169e9b9fe955bf70c4cf570c152cae2531cd84a3166a77
- MD5 15d99b0f9e75ea331d0d5d64c3510f84
- SHA1 3d1c293f2a082489b1e1c52df231b8dde840c98b
- SHA512 153371c36c76ae755dc89eca7c4446b32d8f3c07af5dcc0a2e1e89b7f2d6e8975b0ea6f6887ad3a324e9b401637af517a431bdb0c15b38836ab0bcb50d62d2ab
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmy0Le5jiS:A3kMPljUeW4SkZP4sz9MbBPji0Aj
- TLSH T162B53A26F6788332D073C0B9C5D6AB5AFA3134465B308ACB5349C76C2E277D2963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 1.9MB
- SHA256 e3b5ef13fb940cab03d74a993339074e858e1b8ef02e91fd3e6bc3b30c2feeee
- MD5 489812248cc525be98d7d8657e185074
- SHA1 ac0838e3006d8121e35f91a20f2440ab5a53c892
- SHA512 b0b94e535886deb96dbf06ce12b62a5266202e6cbea90b9a2132ffd2c592350af6cba355e2010d8f956140acd21f6bb90900c7d9b0944c79e950916a75f136f2
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmbD:A3kMPljUeW4SkZP4sz9Mbq
- TLSH T1C9953A16F6788322D07A80B5C7D6AA56FA33344147B08ACB53C8D73C1F276D19AB6727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.8MB
- SHA256 9260e763d5bdd296c0d8f047b87373391ae0cb606c7131f007cc0057220ddeca
- MD5 6998c2c3df983a32b3bb780ee1e37f28
- SHA1 20c5853b9a9070e69d1e2841f96fc94a2ce5665a
- SHA512 f40f091548e939d6ed22675bf28bed683ebe979818cfd4dc2898f0ea42f898ad436aa6c75158c94adadfefdab5c3c6fd09f5e74ca01d1dbbaac6cd3bcc34c821
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmt9:A3kMPljUeW4SkZP4sz9MbS
- TLSH T1B4954A26F6788323D0B3C0B5C5D6AB5AFA3134455B308ACB5359C72C2E277D19A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$
- Size 2.2MB
- SHA256 2916b9a0683f4a2fdd1812c60d7c43d322b08247d7073b78d86240b4155130ac
- MD5 0e3efed8ac80bb913b7b3840b86470b6
- SHA1 b6a1db45165b7dac7f593f8e5a083d61c170d4d3
- SHA512 e64a8f0e044d5d7e2691efdc0386de2d0cf27e0a592c21ea70471680f5663f43294bafad8336012d93d3b3d475d2aacf3bfd94b7eb71024e4157b3ae273fe4d4
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmf3Td9CH9:A3kMPljUeW4SkZP4sz9MbCTd9CHKya6
- TLSH T19BB56C16F6B88372E0B3C175C5E6AB56FA3238451B308ACB5358972C1F237D19A39B35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$
- Size 1.9MB
- SHA256 f5ca32832aaf23f9a039524fc3234555c53c9cade6d1119286c7eaec08849cde
- MD5 726589076da0fe82476e6db548aabf55
- SHA1 d239bc7e908a3eb796418b118e8f1f6703843f13
- SHA512 491db306b5b519d63ba366fed5eb2164afe0500b81c2d89617c6a9dcb080648964b3e7a0825b34f2f75dbd789d636453f0b6715feb15b8959dc07fba6d7afa4f
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmwF:A3kMPljUeW4SkZP4sz9Mbj
- TLSH T184953B16F6B88323D0B380B5C9D6AB5AFA313C414B304ADB5359A72C2E377D19636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 1.9MB
- SHA256 643ecd074d4afa88ce82c416eca44622bb2013194d8e8cd13a30f40b16cbb453
- MD5 7519c1bf9859b178c8be668c39dd043e
- SHA1 e28854149e8daebb539c9819d587507b535bc067
- SHA512 d7ef044fa16567ce1b8688f8d2483c07201c72edbeca697749455fcba97eba39db692e3555c9bf24fb8788b3e5754067595d81ad8674ad2a90a69745d798b106
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmd1:A3kMPljUeW4SkZP4sz9MbG
- TLSH T169954A16F6788333D0B3C0B5C5D6AB5AFA3134465B308ACB5349872C2E277D19A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$
- Size 1.8MB
- SHA256 4c39d843e857d4fae713dbc51a14ee852139d9defc6903a3bfd0b0fe5085e170
- MD5 706db7ba3d43a368bedade417afa14c4
- SHA1 f56958a2240dfe45797484757bf26bece93f88a0
- SHA512 c782bdff0729079527214509b51299dce8f00c8d0b339e0ebd63928cfc3702dc078569748fa73ae9f9e3c17057869524c65c4a7a91cf70994e05173bedf93cba
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69fHZe0p4Ek4niOkl/A04szE87JKTvmt:A3kMPljUeW4SkZP4sz9Mb4
- TLSH T1AE954B26F6788333D0B3C0B5C5D6AB5AFA3134415B308ACB5359876C2E277D19A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH