Analysis
- max time kernel
104s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 10:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe
- Size 4.9MB
- Sample260825-mc3e3agr21
- SHA256 9f3ca3dd1114cae76e0474f98bd8ed8d3eafac35c834e55dab8e8d567a7c0b07
- MD5 744e44098e9a3dae7b694154c6811f47
- SHA1 fe556440470f057a191c744db039101aa624a3fe
- SHA512 c09e37f8f97c9da3d56e215cdcc72eeb1105317c40af552c68853ccbc173989a2e225700d627e4ee7aa66f0a270cf39ba461488f60063b93b42bfb5acd0baf2a
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFV:JH57txgD53uvU4
- TLSH T12A363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3324 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe - Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3360 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe 3324 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3360
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.9MB
- SHA256 9f3ca3dd1114cae76e0474f98bd8ed8d3eafac35c834e55dab8e8d567a7c0b07
- MD5 744e44098e9a3dae7b694154c6811f47
- SHA1 fe556440470f057a191c744db039101aa624a3fe
- SHA512 c09e37f8f97c9da3d56e215cdcc72eeb1105317c40af552c68853ccbc173989a2e225700d627e4ee7aa66f0a270cf39ba461488f60063b93b42bfb5acd0baf2a
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFV:JH57txgD53uvU4
- TLSH T12A363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 5.0MB
- SHA256 111a7dd036cd59099036663abfeeef08fa7836d4278cf683e518dc861382a898
- MD5 79089bb70f3dd30d9504ec65d185e120
- SHA1 5861f9e7fcc3c75cefb2c82c2d1873a6e3cae9f1
- SHA512 2d785964177b1ac5c0a3d22acd6bc3a0846ebdc0bfad8abce6361268f8a7e839049eff1fdc72b1e887403569a98603756eec79403c205953a6a0fc172ea9b834
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFJW:JH57txgD53uvUkW
- TLSH T1EC363A82B6DB9227DCB521708F7C865031617FE00AB5F15BF2907A6EDB3A194AD1E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.4MB
- SHA256 cfd65520a998dbbccf4510c0df0dfec2605f48f5b32f200d4299b5f3dde1da18
- MD5 fa385967266773861d32523a8bcdfd21
- SHA1 c2825983bc9371b9986cc96e2d6de35b82ce2d47
- SHA512 ffd525dee60542d9e26c567274b8b3a0b0b29b972b07a3e855d51c7fbab075f7d52834a17b252ae0949c937b67254e8d14e01b3fb6ec5207587a06a53b56b521
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFBjo:JH57txgD53uvU4o
- TLSH T1D8464A81F6EB9227D8B61170CF78865075613ED00BB5E14BF2907B6DDB3B194A92E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 4.9MB
- SHA256 1b1fbdbd3cb0b95d28513223c823ccac4a5ded3f43201c3df0256b172ec53728
- MD5 ab1912c087bb1d043a6e29719d31da4d
- SHA1 b11ef5080fc2ec34676c4377d6d8827cb8fb4eed
- SHA512 53d7aaebfaa84a7bee1507ed5b90ac1a0b7869281a18b52e706490c5fb1c74af1e91f5598d9044749f994a5cf52f50bd42d93055d2729f9f61cc1404551cb015
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFe:JH57txgD53uvUd
- TLSH T1B4363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 4.9MB
- SHA256 cf5151954cb2ad2fa7a7c218e3d9861bf11b64a8cd5c00fa3df2a02f648b6172
- MD5 1959eded0f07ae3e20e751a3d65e4d10
- SHA1 ddc62a93f9ffe0a5f9334313fa50449f94fa81a6
- SHA512 29365cd0c67c58a31ee23389e21e07c83c5f06383d055cd756b9812d514f2ecd7ecf2cb77c0a89536feb33f3475222039c439823cc99351174039624794b1063
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFl:JH57txgD53uvUq
- TLSH T127363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$
- Size 4.9MB
- SHA256 8df54ca91cbb82a02a4b3d014bcce61a5b00d3baec81810468e2927cc89b366c
- MD5 c75e1477da52bd3f12f36aac9d581ad7
- SHA1 5fc94e730098f6c3d8383a599eea19957235c12c
- SHA512 2c4d5f6cfee178c63fbd9e49ca3fcf6549b384a951c153950b0afbeb06662947d5140706838abfb49d1397105757424e7cc5f7b4ad973a88be5230bcc0e4d67d
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFa:JH57txgD53uvU9
- TLSH T1E6363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2907A6EDB3A194AD1E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.9MB
- SHA256 436cad5cb0f5f529360e63ebafd22d9cbd93d6e5fd0441017bb2ed66ca3c28f5
- MD5 2be0adf495abb284da0ae1a4739a5898
- SHA1 4f363cd3dde6a8433993b0853e922d66c65a9517
- SHA512 dfe0dde4e4cd2dcad3ad4818dc570bf3eb4f377c029bacc38d1ceae22cc1d1938a8ffaa7e934f58388206b48b9195b6522f6ee725494db3ca6bd0ef8d0ff458b
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFe:JH57txgD53uvUl
- TLSH T184363981B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH