Analysis
- max time kernel
97s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 3.2MB
- Sample261001-tsv49axgrd
- SHA256 07ef721e6307cb92682f03b402e0ee6bf9ed5a69f2ba3fd225f229bd28ce41e4
- MD5 35628ff7e1b12ff44fd483b9ab5e3467
- SHA1 e0f643354014df50d0e9be9832e7a824f8f8c813
- SHA512 54d5893abd6eff882f23021bd13ca78863784e7886551476454896f09085a802408e684863930e97828691dcb7422abaa1b725241da8daaa81210d997343855f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZjan:TID410vd5OtQ
- TLSH T10FF59E5577E449A2E1B70235897642526E72B8311F34E3CF2394937D6F337C0AA3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 2616 patcher.exe 2904 641.#.exe 3348 279.#.exe 2760 551.#.exe 1876 92.#.exe 4996 454.#.exe 1260 534.#.exe 432 838.#.exe 1988 957.#.exe 4572 120.#.exe 1668 832.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 279.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 551.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 92.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 838.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 120.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 641.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 454.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 534.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 957.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 832.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 279.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\ 92.#.exe File opened for modification C:\Program Files\Common Files\System\ 534.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\ 641.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 641.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 534.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ 92.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-PT\ 551.#.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pa-IN\ 454.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\ 454.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\ 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\ 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 279.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fa-IR\ 454.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\ 279.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 279.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\ 279.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 279.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\vi-VN\ 279.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\ 454.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\images\ 534.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 92.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\ 534.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ 279.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ 92.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\ 454.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\STARTUP\ 454.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\ 641.#.exe File opened for modification C:\Program Files\Java\jre-1.8\ 641.#.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 92.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\ 279.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\ 534.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\ 641.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\ 641.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ 454.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\ 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 92.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 279.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\ 92.#.exe File opened for modification C:\Program Files\dotnet\shared\ 534.#.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ 534.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 838.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hi-IN\ 838.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 551.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ta-IN\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mi-NZ\ 279.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\ 92.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ 454.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 92.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ 279.#.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 120.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 279.#.exe File opened for modification C:\Windows\:\systemlog.bak 92.#.exe File opened for modification C:\Windows\:\systemlog.bak 454.#.exe File opened for modification C:\Windows\:\systemlog.bak 534.#.exe File opened for modification C:\Windows\:\systemlog.bak 838.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 832.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 279.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 534.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 838.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 957.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 454.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 120.#.exe - NTFS ADS 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 641.#.exe File opened for modification C:\Windows\:\systemlog.bak 279.#.exe File opened for modification C:\Windows\:\systemlog.bak 92.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 957.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 551.#.exe File opened for modification C:\Windows\:\systemlog.bak 454.#.exe File opened for modification C:\Windows\:\systemlog.bak 534.#.exe File opened for modification C:\Windows\:\systemlog.bak 838.#.exe File opened for modification C:\Windows\:\systemlog.bak 120.#.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2896 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 2616 patcher.exe 2904 641.#.exe 3348 279.#.exe 2760 551.#.exe 1876 92.#.exe 4996 454.#.exe 1260 534.#.exe 432 838.#.exe 1988 957.#.exe 4572 120.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2904 2896 2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 91 PID 2616 wrote to memory of 3348 2616 patcher.exe 92 PID 2904 wrote to memory of 2760 2904 641.#.exe 93 PID 3348 wrote to memory of 1876 3348 279.#.exe 94 PID 1876 wrote to memory of 4996 1876 92.#.exe 96 PID 4996 wrote to memory of 1260 4996 454.#.exe 97 PID 1260 wrote to memory of 432 1260 534.#.exe 98 PID 2760 wrote to memory of 1988 2760 551.#.exe 99 PID 432 wrote to memory of 4572 432 838.#.exe 100 PID 4572 wrote to memory of 1668 4572 120.#.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_35628ff7e1b12ff44fd483b9ab5e3467_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\641.#.exeC:\Users\Admin\AppData\Local\Temp\641.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\551.#.exeC:\Users\Admin\AppData\Local\Temp\551.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\957.#.exeC:\Users\Admin\AppData\Local\Temp\957.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\905c0769f9a06c95a24ddf945\279.#.exeC:\905c0769f9a06c95a24ddf945\279.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\905c0769f9a06c95a24ddf945\92.#.exeC:\905c0769f9a06c95a24ddf945\92.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\905c0769f9a06c95a24ddf945\454.#.exeC:\905c0769f9a06c95a24ddf945\454.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\905c0769f9a06c95a24ddf945\534.#.exeC:\905c0769f9a06c95a24ddf945\534.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\905c0769f9a06c95a24ddf945\838.#.exeC:\905c0769f9a06c95a24ddf945\838.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\905c0769f9a06c95a24ddf945\120.#.exeC:\905c0769f9a06c95a24ddf945\120.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\905c0769f9a06c95a24ddf945\832.#.exeC:\905c0769f9a06c95a24ddf945\832.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1668 -
C:\905c0769f9a06c95a24ddf945\878.#.exeC:\905c0769f9a06c95a24ddf945\878.#.exe9⤵PID:828
-
C:\905c0769f9a06c95a24ddf945\65.#.exeC:\905c0769f9a06c95a24ddf945\65.#.exe10⤵PID:1584
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 07ef721e6307cb92682f03b402e0ee6bf9ed5a69f2ba3fd225f229bd28ce41e4
- MD5 35628ff7e1b12ff44fd483b9ab5e3467
- SHA1 e0f643354014df50d0e9be9832e7a824f8f8c813
- SHA512 54d5893abd6eff882f23021bd13ca78863784e7886551476454896f09085a802408e684863930e97828691dcb7422abaa1b725241da8daaa81210d997343855f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZjan:TID410vd5OtQ
- TLSH T10FF59E5577E449A2E1B70235897642526E72B8311F34E3CF2394937D6F337C0AA3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 3.3MB
- SHA256 bb032f35eade7a92d5dc2d7a92f9b1a207efb351801c9a8437c93d49b458f6b6
- MD5 e22200d8dc2e9e4d187c72e800d53b9a
- SHA1 9a3fff459dc58815833c4f174f54070bf4ff20e6
- SHA512 43b444153d5a7cda326cbdcf9843c945bd2e8ce1943fe1d234482cc313c670ebd29f1380c6b7a3bfde9c810e3d42eb469c3e7ed22e693b3623861770d691a5ec
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZjaw:TID410vd5OtB
- TLSH T166F59E5577E449A2E1B70235897642926E72B8311F34D3CF2394937D6F337C0AA3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 3.3MB
- SHA256 7809cd818ed9617337771557026f570c509bc6628ed010f807f691291f3d3e45
- MD5 1076a6d8cd9bfb0e3a98fdac54df0461
- SHA1 29ed06a4ae5347356b559ca9e81f7fc0ee9280d4
- SHA512 fbc652e5decb7c16e7dad0e5e53f452a9867d23a4fd28ba9e6c09db5351d9dec75b00d3fb8dfa12eef41dadec32a992f4a78ce781242bf00f4bcbb03e9174ef7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZjaE:TID410vd5OtN
- TLSH T12AF59E5577E449A2E1B70235897642926E72B8311F34D3CF2394937D6F337C0AA3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$
- Size 3.3MB
- SHA256 02b1ad34856e930acf12bb44f6643096d1ad5a4d268afdeb2b12d0daf5c8767e
- MD5 7b7157cb467e5025106340beaedcdcb7
- SHA1 b706da7b968fa4969f3e5be158b4a15e89cbfa85
- SHA512 c4aaa57ae7184426e05619ed4af8e02d07f3ef9fb1de29b267f7ad92056e71ac16717752190206fa7de728e7ced90bc68a574b7297caa6615e4e23b4147850c8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZja:TID410vd5Ot
- TLSH T1AAF59E5577E449A2E1B70235897682526E72B8311F34E3CF2394937D6F337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 3.3MB
- SHA256 9479a79770a7af28545a567cd6d90b35051f9ffd60860666b384ec1ce499271f
- MD5 22d57b90fb74e0d3d50d331a5670754a
- SHA1 b24b7ace688be1b2ea44bab8924d5341d84a888d
- SHA512 349546148bc68569501c0b6d54ace45dde872a8c021007ee1b6deefe8ad4bce8def7a460874b90a90e67dba9bb494737bba496d5744a7cb3c552bf0777d6daf2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZjaL:TID410vd5OtG
- TLSH T13BF59E5577E448A2E1B74235897682526E72B8311F34D3CF2394937D6F337C0AA3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$
- Size 3.3MB
- SHA256 81909c2f94bb1746b0d6f2d6670442567bceb5045b7ac81f47d57c4d8c32c646
- MD5 3e10659d782a55e7c53c3742e847fdf4
- SHA1 255d81515453371ca01c8f8b412cba65645ce4e3
- SHA512 7e2ba251272a2a09e8661247f4cdd93e35774a9f7b7faff7779c945294aa829698182a242a8420c906c4c9932c37dcd07968367236ec074c5b665e0b0d2de41f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwq6qatgluCC5Oy6i1zuajsauZjat:TID410vd5OtI
- TLSH T1D9F58D5577E449A2E1B70235897682526E72BC211F24D3CF2394B37D6F337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH