Analysis
- max time kernel
99s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 19:09
Behavioral task
behavioral1
Sample
2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 3.0MB
- Sample260728-xt19fafp6x
- SHA256 4735522465732cdc8b6359d3137437df9f8d8b1e33cc4b2641fc0031412905cb
- MD5 16403f62244e8c13c22cf668f3a5c2b7
- SHA1 4a1f5fd565a3f9b80d8e065031743109d1a916fd
- SHA512 a9e0547a615f35ba08af2147e584d887ed1036bf91b2b51560e070e1f1cbdd21518de8f535a89e92c9c624df478b77f9a6de29d44c4e49726443f39e19f2205c
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYq:Mr+cJrr6
- TLSH T1B0E51925F6A48B61D07BC075C9D2968AEA333C414F308BCB5285BB693E377D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3972-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c618-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b32f-36.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c72-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3972-79-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4100-110-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002e000000017649-430.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8a3-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000019e80-1100.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c618-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b32f-36.dat aspack_v212_v242 behavioral2/files/0x0003000000019c72-39.dat aspack_v212_v242 behavioral2/files/0x002e000000017649-430.dat aspack_v212_v242 behavioral2/files/0x000300000001a8a3-1098.dat aspack_v212_v242 behavioral2/files/0x0006000000019e80-1100.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4100 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3972 2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe 4100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_16403f62244e8c13c22cf668f3a5c2b7_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3972
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 4735522465732cdc8b6359d3137437df9f8d8b1e33cc4b2641fc0031412905cb
- MD5 16403f62244e8c13c22cf668f3a5c2b7
- SHA1 4a1f5fd565a3f9b80d8e065031743109d1a916fd
- SHA512 a9e0547a615f35ba08af2147e584d887ed1036bf91b2b51560e070e1f1cbdd21518de8f535a89e92c9c624df478b77f9a6de29d44c4e49726443f39e19f2205c
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYq:Mr+cJrr6
- TLSH T1B0E51925F6A48B61D07BC075C9D2968AEA333C414F308BCB5285BB693E377D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 f7c439b16257d7fe37be5c9d5caef487235777ad084d3a3312cb932d6eeb3af2
- MD5 e0dc059fad03eca8f69c7ee836ee6128
- SHA1 e564cfea314b9a076f02ab1f21ac0738e9e671d9
- SHA512 daaaa7ae036dc7706d1440ad7eb718d8f0827a27aacfb5ad61c7e9908fa9598ad5070568407ba15ffcd23422c734f7a003a38717ab1afe2d4fe95a9c0a1023d2
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYqjPji0Aj:Mr+cJrr6Gjo
- TLSH T1E1062A15F6648B61D07BC0B9C9D2968AEA333C414F308BCB4285BB6D3E377D59936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 3.0MB
- SHA256 e700364691d454dfdea40509d3f8ab290aabf109ed342e727f7cd7ea4220316f
- MD5 9b5e923cad5862b0079e1714ec2b7f8f
- SHA1 fbe947bea10e014a1b5a6565f5ed2b1f793f6192
- SHA512 3a20b6265362973fdd87d6d2bf5aa4b5df8be711847626fa22126cb917c981712b19d825d06314e0c1e4d8c0829a0a41969330f74a67b05ee94cd49e74b0b0a0
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYq:Mr+cJrr6
- TLSH T159E51925F6A48B61D07BC075C9D2968AEA333C414F308BCB5285BB693E377D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$
- Size 3.7MB
- SHA256 c0b26507e10a8641dcc466e8f03e1dfeaf85a9c155af7c415f2eaab9b0cd8b86
- MD5 a2ef5ea46ac025e2f5aa5c8cbeb6196f
- SHA1 d97cff87d104c3385bc5d70dbc5267efad116bec
- SHA512 22083e8ab67b466f75bb8a4ad5cc01e2a54e5a1fa583c85107d1a91e64217c7061694fc1ff132693d1a7c0ee9ae0de8bf1a25f45a365ee5acc685f001ae77ae0
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYq7VO88hXl+:Mr+cJrr6r/h1+
- TLSH T14C062925F6648B61D07BC079C9D2968AEA333C414F308BCB1285BB6D3E377D59936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
- Size 3.0MB
- SHA256 3421275d338c72cdd989f486158f0c4229eddb73e16eba66be7c09a72edb09fd
- MD5 8c9909bf121814ecfdf5f1808c758873
- SHA1 51e46810435fac929b6d302ff15f74df47a5c8ff
- SHA512 834331b2c96551207948bbc55eacea3b5c6fcfb36d63fa67bdc640322110172306d8c83b89141389a4b5c951c24a953d88f189d8907d5114936bc42af8552ea3
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYq5:Mr+cJrr6w
- TLSH T188E51925F6A48B61D07BC075C9D2968AEA333C414F308BCB5285BB693E377D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe
- Size 3.0MB
- SHA256 bff2d4d8559450017dd51363157c4d72563189c032f5b1d3effc0bd0ca3f61a3
- MD5 50292d34ca1e2b86d59206c10d8db182
- SHA1 a62828ac1f2d2bb3c40e79f5b78ca2c56c157337
- SHA512 71f6168fb4bf201270181f9d163662fa3d1c3e59598ef070ed8fa95ea676c3dfa19f8db8de55f4b10eeac4fb86e91a2d29896addcf61b0ca64cb8c4c87ead603
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYqf2:Mr+cJrr6P
- TLSH T1B5E51925F6A48B61D07BC075C9D2968AEA333C414F308BCB5285BB693E377D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$
- Size 3.0MB
- SHA256 c88eeff6e2e51af13d12c06093ec7904f925989090045d27e8890baa7cea4d22
- MD5 9cef46dba9e08addcf6165cac887db5a
- SHA1 3663a2ec2dfb5f056b09f0e5bdd1959133321e7b
- SHA512 7cd49ee0ae1efeee05459d6e8d102b41dd2abf3eddee694a5997593f6cb7b9b631ce8f6335254eb8dd6bd5c995dde38e9ef084aabb97869df5be3a5daa49bb22
- SSDEEP 49152:T2agnTkLfUc56r+qJtb2IdqJtb2Ij56rrpYqYY:Mr+cJrr6U
- TLSH T171E51925F6A48B61D07BC075C9D2968AEA333C414F308BCB5285BB693E377D19936723
- MD5 SHA1 SHA512 SSDEEP TLSH