Analysis
- max time kernel
91s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 03:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
- Size 2.1MB
- Sample260802-drfp6scd84
- SHA256 1324993b6cc798dab12a2c8742243d3b8b0b9eb0fb451b82a0b22a327f834da1
- MD5 4707b52dc83524160f59757ff7377f17
- SHA1 b98f4a834e6494dbb9655366a0e184f25317bc4f
- SHA512 323ce463928aa7310bf714d9327ba0446222171e586d2e0b958a31d61c98ae93645a4192a3f6ef32996b36d82a107e104fde3899d43abd4c739fec53971337b3
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPs:ggnThXqatgltKzq+91fOr2la
- TLSH T106A51842B7948AF1E06B413489628259D673BC55CF228FCF1254AEAE7FB36C05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/3196-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002442e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3852-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023523-147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216a1-1269.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f00000001da96-1372.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002200000001da96-1519.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3196-1546-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3852-1697-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d0000000202f1-1704.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000749-2061.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000000749-2154.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3852 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$$ 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3196 2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe 3852 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_4707b52dc83524160f59757ff7377f17_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3196
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 1324993b6cc798dab12a2c8742243d3b8b0b9eb0fb451b82a0b22a327f834da1
- MD5 4707b52dc83524160f59757ff7377f17
- SHA1 b98f4a834e6494dbb9655366a0e184f25317bc4f
- SHA512 323ce463928aa7310bf714d9327ba0446222171e586d2e0b958a31d61c98ae93645a4192a3f6ef32996b36d82a107e104fde3899d43abd4c739fec53971337b3
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPs:ggnThXqatgltKzq+91fOr2la
- TLSH T106A51842B7948AF1E06B413489628259D673BC55CF228FCF1254AEAE7FB36C05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.4MB
- SHA256 d0f6d82cbf7211c9048fa22ddcd37cc6a71a4b9d49e9b3c1cadb70a476ad8419
- MD5 353eea74713cdff58e4f339abee3b3cb
- SHA1 076b8b9ee2451e871799bbffb093724b3be220f3
- SHA512 d4035dadf3dad98b1d48bd69a3aa65a722abaa1c2b6a293b89caec0f139d9124e59db486b44bf24d8ab4cc49d7912f688818d2a600c7f8f5dd637cd0a0182f52
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPsE3UNUpE+:ggnThXqatgltKzq+91fOr2laLUN+Eir
- TLSH T19CC51946BB948AF1E06B413488628259E773BC518F228FCF12545EAE7FB36D05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.5MB
- SHA256 72bb5368a07463717856e12b1e6a229b1107d7bf751383817997f5d33c88e58c
- MD5 6b6594d1d3c401fdb90084bd1567b6a5
- SHA1 2968c7a6e64f0620d32f6d477f7c8ec1f7fdef35
- SHA512 33ce603085909dffe4ae33d82bcdb826bb2be837a32b81666b2a6910dd850f1461944a92029eeb2eee3e1820eed2c06c814f796cad9fff433af8be0ba45fd32a
- SSDEEP 49152:ggnThXqatgltKzq+91fOr2laNTd9CHKyao:rdDECqo
- TLSH T1F6C52A41B7944AF1E07B823489628159D673BC558F228FCF12946EAE7FB36C05E35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 2.6MB
- SHA256 6c270c95286125fa678af9dd97e09e45445884e90c1d52c52d285d0180614fa8
- MD5 e3c15e81c981cd51305352eb54311316
- SHA1 ae3105955f8317df8fbe975f180c86db7121955f
- SHA512 dddadca2de82447eda86ca6455cbe42745a4c7464fe858c422643951e55e54b8532aa833ca6654b982e534f048f1c40a5206c3c386a486667e250cdbcaff4f95
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPsV86n9kAQ:ggnThXqatgltKzq+91fOr2lawT9t2
- TLSH T1EAC54B42B7944AF1E06B813489628259E673BC55CF228FCF12905EAE7FB36D05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 700bc44ba608597fbab235910c658e886364fd76b36b08df140529060fb2e713
- MD5 96fe3ae5e8b4e540b3f7d9d90f9f9df6
- SHA1 da99796593ff1dc57b58a1752b84c7df9dd5de3d
- SHA512 2a620cb8696ffb26b83f725e29700a3ffec492337b1b306e7699486aa58dd862e690b3af0913f05bbbad84c89e523885fe0f47df316e32a48588775e9b10f925
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPsq0Le5jiS:ggnThXqatgltKzq+91fOr2lapPji0Aj
- TLSH T14ED53A02B7A48AB1D067817485A2829DE6727C518F328FCF12449EAD7FB37D19E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 121e6d9032eb551acfd139f7df1756ef37cbf957e5150a945783ecd029272e54
- MD5 adf6bb299a77a0f35422c42729c70ce2
- SHA1 6831e852bf5e2633adcac88cf8cdcbb6cd5de77c
- SHA512 dfd3683b587d5ed9919e1b1803a28261d3de0477a8ecc418208ae4dfecfd942a413766dd0ca52c94e36e569cc86dc27d61a205495f7c2b5b548042f53cc06046
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPszD:ggnThXqatgltKzq+91fOr2laC
- TLSH T1C6B5F602E6944AB1E06F4134C6624259A673BC558F628FCF1290EEBE7FB26C05E75733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 2.2MB
- SHA256 256a7fb225edd22391a56155f3cdfd749f77b8e72ce49b04bbf968a211655c0d
- MD5 4686900a34845df2539a0f9dafac166e
- SHA1 22f910bd87e6ee697ddbcb452ddaf91d345ffe43
- SHA512 3c92170352222fd101c67029026ec6e54eaceab538c94982ac30abe3d6d05e3c8331c349dd1fa76fcf3f2c52e8ba3387aa6d42cc8f45d4bc2bd8a3e5c36f3441
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPsYF:ggnThXqatgltKzq+91fOr2lab
- TLSH T1D4B51941B7944AF1E0AB413089668259A673BC55CF228FCF12547EAEBFB36C05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\CheckpointStart\ExitInstall.exe$
- Size 2.3MB
- SHA256 b610c4bc5e99eb7889a7db75f34f0eba9b6c95b1ac649e0e85002b457b762b10
- MD5 d7c1cf7f7bfacda175ff79683a076f3a
- SHA1 4f202fc3699f0fdfce7b5280154916670a4e9157
- SHA512 cc59769c8d86cf324d5077556f9310ff574cfa3414b4b57a5b88d62ef748664451280b13b897094c72c804477e3f584593862f142bdbccdaad0ffe46231e45a9
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPs4V+PAk24:ggnThXqatgltKzq+91fOr2la5i2WH3
- TLSH T122B52912B7944AF1E06B41308966826D9672BC55CF238FCF1254AEAE7FB36C05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$
- Size 2.1MB
- SHA256 d7071fc62a79ba81668df58537290857f90b1125cf35f0e54bc32104f99ad207
- MD5 7e4ed48aebf5d2dff174ad52c5837995
- SHA1 63a1e789055ea78ccd602a87ca3ad28e17266e6b
- SHA512 d7f8033a8b900fbbd7df51b6faa06760b362b1b3840dc317434d00402c81fe620f4ade514fcdf720591949b06789d81c10c65d9e699d70b419420aaf4966be87
- SSDEEP 24576:QHg1flT/pT9+wUExqatgl8bGszrYm4R+9MifeKdYSYwZCUyr2d/EEEPsa:ggnThXqatgltKzq+91fOr2la
- TLSH T124A51942B7948AF1E06B4134896282599673BC55CF238FCF1254AEAE7FB36C05E35732
- MD5 SHA1 SHA512 SSDEEP TLSH