Analysis
- max time kernel
84s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 1.7MB
- Sample260420-e1zp3scy3x
- SHA256 e864d6764a66fa1ba3278a93e367db71f368ee43034295f91d8ad880e461bc9d
- MD5 94bb7a19fc98cb98124b3f82cbf7499b
- SHA1 397648852ab6704414b1571735fa8d0d2673e63c
- SHA512 e4a95d73ae651dd2fe2eb57608d1fdecebbf8b209ed5e63d8e67018f4430a20e62f11dfedb12594cbef223b496d7f186fd8d39bf1cf007a1ffc556d71e4f0e1c
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrM:GaqDNOxdkePji0Aj
- TLSH T1DC858C16F6B496A1D1B3C078CE928755EA317C910B308ADB5295F73C6E333D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3840 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3364 2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe 3840 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_94bb7a19fc98cb98124b3f82cbf7499b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3364
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 e864d6764a66fa1ba3278a93e367db71f368ee43034295f91d8ad880e461bc9d
- MD5 94bb7a19fc98cb98124b3f82cbf7499b
- SHA1 397648852ab6704414b1571735fa8d0d2673e63c
- SHA512 e4a95d73ae651dd2fe2eb57608d1fdecebbf8b209ed5e63d8e67018f4430a20e62f11dfedb12594cbef223b496d7f186fd8d39bf1cf007a1ffc556d71e4f0e1c
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrM:GaqDNOxdkePji0Aj
- TLSH T1DC858C16F6B496A1D1B3C078CE928755EA317C910B308ADB5295F73C6E333D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 38ea52f7e471f72555785fe6d9464b0ec790ce62ee1e406c7aa2d888069f4cef
- MD5 dc19a889a2e7f19fa010c92822c3cf7d
- SHA1 749eca79c53162cbe823b02caaebaa8a0bb6c5f0
- SHA512 625d0e2172460b5daccd4282cc115b04eecb9d638c6d2d47fd919d54a42dcc3951d4e1bd57a45dbb297f672c1a58f77d6d62f0abae26f4ce1d77d00c0d4320e6
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMX3Td9CHKy7GZO:GaqDNOxdkePji0AjoTd9CHKyao
- TLSH T143B58C12F6E456A1E1B3C578CDA28615EA317C910B308ADF4294B72D6F337D19E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
- Size 1.8MB
- SHA256 9138bcc0dce1648442597032c1a3d20f25ad5639de9d5c83eb14347c68361d6c
- MD5 299cc093606d7a3f16318a959449b01a
- SHA1 09f300db369ff348bc3b0a33eb69c48709668037
- SHA512 9361a5003c6ff9dc041c2ff2b4c068748f641206ed01bed37d93d0e72a0ab33e7fcdc1d015951263b6e39eac65e9817a874361fa4f0502c268333f5b1021818f
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMdTjE:GaqDNOxdkePji0Ajow
- TLSH T1F0957C16F6A496A1D1B3C478CD928755EB317C910B308AEF5294F32D6E333D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe
- Size 1.8MB
- SHA256 bfe46cf292061a158d78b5b031d9b69e0c2cdb97ad3476dd65ec9f0dc8c812ba
- MD5 307273bcefc6383cb437cbe6bb80f90c
- SHA1 c94d7097af3afc1f085b9aa365b789a6ba9909fb
- SHA512 1be529266b3d12b14838298b6ff9b92f46f02ba0fd2956635a738fc35c18856d8baab2ee6c82205e8ceab0353b5668b000f678e7ea5d624ba1bc505444e5bf17
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMeGen:GaqDNOxdkePji0AjMI
- TLSH T1E0958C16F6A496A1D1B3C078CD928755EB317C910B308AEF5295F72C6E333D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 8e68dc1fcba7901acf9050538bc99a1fb82dc6b077e155811cd61126172c4378
- MD5 d5ab1ddcadb9028f64e376601fb7e71d
- SHA1 6702f1435d2ce615e0c37605348e86867fd3753e
- SHA512 86e11f427bb39042f24577a898670d1fd5649e758a4372d59d14daf21f1bd84637f4b74d3ac5413b9e406d9c7c0ea18a812dc79959479ae790a0afbf4e9aad15
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMD0Le5ji0hmxNrM:GaqDNOxdkePji0AjKPji0Aj
- TLSH T15EB55A16F6B487A1D073C079C9D29659EA313C910B308ADB4295F77C6E337E19A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 1.7MB
- SHA256 ca93c04e9edf09a75d6f5ad5ae1edf646a4080978e2bd504371e8402e560eb57
- MD5 1d9b6e15e349ad101d100a1fe7365179
- SHA1 6429756ef9a0edf86039659058df95c741803fc6
- SHA512 69b767209ceff61a0019ccd425432071e5c453bdaf7312977e3651a2ea4a9682c39bb0e211cf76921deb8d506e29ba0a0530438cee180dc0dff2efeb48c1789f
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMYn:GaqDNOxdkePji0Ajb
- TLSH T15C858C16F6A496A1D1B3C078CED28755EA317D910B308ADB5255F33C6E333D1AE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 1.7MB
- SHA256 909348d03f39a2572d7b17e39601cdd289c4fb329babfe293056e17eda0b735d
- MD5 37a2ffd252a1f0977a3c79b449536e61
- SHA1 26a9f8ce56488dd126e8b437af82ad69080a12d4
- SHA512 309b6e6bc62ba8ea1791a2a9b5916cbbb7e1008b4d0cb74699d3a89272decf8db428e767695841d057fbed76e2586cf562e2b26cb2b2ebc7af2258c8dc409b15
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMxt:GaqDNOxdkePji0Aj8
- TLSH T1C2858C16F6A496A1D1B3C078CED28755EA317D910B308ADB5255F33C6E333D1AE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
- Size 1.9MB
- SHA256 8ebc5195133d586f9eae33231159c13c61cd258354f8cc96c5d484a1212818da
- MD5 f73c1ac304f8fc599a038a8b43a3353a
- SHA1 b8923e3159b58c142faac613dfcd7a4c1959c07e
- SHA512 4cb0f6caae72f99750c08ca33236663309431c000b9bae5558fd42b8dfecdef0c6ff73d378e0b8acfc74af342c17be6f2ae41b00e1b0078dc946d4640db9927c
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrM7HdfnJ:GaqDNOxdkePji0Ajk
- TLSH T121958C16F6B446A1D1B3C478CD928755EA317D910B308ADF5294F32D6E333E1AE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 1.8MB
- SHA256 5c1c0a259e989a5a73d94b5722b1102e9da8850e38a940639ae4fb89b79d891a
- MD5 a7b4b35cd6ae5329f4508bb2907b3558
- SHA1 091eda03deeef227c9668657a62a2b911924ecc7
- SHA512 8cf5bb5f931486f2c5df42de08e567375d49ebc028ac6da64d5528ea7598709adb3a585f416697584a1ae1248ca1d654dc956c17b0cfcada2f501811020cf4b3
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMPF:GaqDNOxdkePji0Ajq
- TLSH T1BE958D12F6A487A1D5B38074CD968755EA317D910B308AEF5254F73CAE333D1AE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.2MB
- SHA256 c4767e44895de49a866cf458b190c32482a0f0bef7e0d23620a9f97cc7b6d463
- MD5 8add2a6c00d00482fd24ca5b50c7e026
- SHA1 02558e3088cad995be473b2d11bc1ce7d0ebff77
- SHA512 3978d508e4fe8457431e037b46d11cf865b0f069a61568bcf765e2b7e888daf194548c2998adfc39450f615d934d717ce5c2a1a180dd06f910f271cba8687291
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrMzUOlZ7q/c9:GaqDNOxdkePji0AjqUOlk09
- TLSH T1B5B57C26FAA496E1D1778478CE928745EA317C510B308BDB9258F33D6E332D15E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
- Size 2.1MB
- SHA256 fc60e514fa963a3c6cdb54894c72091c509c8d980e0c0914692293f8b27fa65e
- MD5 9967145f9d8ad42e51d8a43c6b1ff1fc
- SHA1 af44b7c77e16f61554e88e23f28a1b2530b51fb6
- SHA512 aba8ab3b819a21e58bf2c82464e7a8e60070965500ae491ec0408cc59d41b5641a6fb2849f9f7ead425c089e5c2f1351276fe0e552c9d2fc6667a0267b1c46e4
- SSDEEP 24576:EjSiH8b8MjSiH8b8sxDNH8baaTxnpwJ+Rke0Le5ji0hmxNrM+1owkWu0ya:GaqDNOxdkePji0AjR1lkWu0ya
- TLSH T1D4A56B12F7F446A1E1B38574CEB29615EA31BCA10B30C6DF5254B36D5E33AD09E36B22
- MD5 SHA1 SHA512 SSDEEP TLSH