Analysis
- max time kernel
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe
- Size 3.9MB
- Sample261002-t4hcjaydnd
- SHA256 6280632ca7ed49e43913cbcb65831555bae87c5bbc99ddef0b44b5dd02036e16
- MD5 3929fc0ffb35f0dc0ecb2222b4796cfa
- SHA1 b7e3a5dc2d25ef331e7f3831bfda3dd8bdbd1e6e
- SHA512 44906fea860327fe0d11dc8d030f73c35b5628c133da4a12f6a7e146c805601a73866f33a723d049303d70f33b30066b63b19f24553c74a3166bea8e5e46a18b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4SkZP4sz9Mbsdqatg8:TID41F5EwfkZcsxn
- TLSH T1D6166D51B7E48633E0B3417184A7569A6E3278118F329ACF13446BADBF737C09A32776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 9 IoCs
pid Process 708 patcher.exe 5100 666.#.exe 3684 441.#.exe 3464 746.#.exe 4748 801.#.exe 464 84.#.exe 2124 98.#.exe 2704 792.#.exe 1252 285.#.exe - Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 666.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 441.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 792.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 285.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 746.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 801.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 84.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 98.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 84.#.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\ 746.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\ 98.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-PT\ 84.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 84.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ 666.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ 84.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ 98.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ga-IE\ 666.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ 666.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 746.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ 746.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\ 84.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\ 84.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 98.#.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\ 746.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\ 746.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 441.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\ 746.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\ 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\ 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\ 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\ 441.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 84.#.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 441.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\ 441.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 441.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\ 746.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\ 84.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\ 746.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\ 84.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\ 441.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 666.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\ 746.#.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\ 666.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\ 441.#.exe File opened for modification C:\Program Files\Common Files\System\en-US\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 441.#.exe File opened for modification C:\Windows\:\systemlog.bak 746.#.exe File opened for modification C:\Windows\:\systemlog.bak 84.#.exe File opened for modification C:\Windows\:\systemlog.bak 98.#.exe File opened for modification C:\Windows\:\systemlog.bak 792.#.exe File opened for modification C:\Windows\:\systemlog.bak 285.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 441.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 801.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 285.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 666.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 792.#.exe - NTFS ADS 10 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 666.#.exe File opened for modification C:\Windows\:\systemlog.bak 84.#.exe File opened for modification C:\Windows\:\systemlog.bak 98.#.exe File opened for modification C:\Windows\:\systemlog.bak 285.#.exe File opened for modification C:\Windows\:\systemlog.bak 441.#.exe File opened for modification C:\Windows\:\systemlog.bak 746.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 801.#.exe File opened for modification C:\Windows\:\systemlog.bak 792.#.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3384 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe 708 patcher.exe 5100 666.#.exe 3684 441.#.exe 3464 746.#.exe 4748 801.#.exe 464 84.#.exe 2124 98.#.exe 2704 792.#.exe 1252 285.#.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3384 wrote to memory of 5100 3384 2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe 91 PID 708 wrote to memory of 3684 708 patcher.exe 92 PID 3684 wrote to memory of 3464 3684 441.#.exe 93 PID 5100 wrote to memory of 4748 5100 666.#.exe 94 PID 3464 wrote to memory of 464 3464 746.#.exe 95 PID 464 wrote to memory of 2124 464 84.#.exe 96 PID 2124 wrote to memory of 2704 2124 98.#.exe 97 PID 2704 wrote to memory of 1252 2704 792.#.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3929fc0ffb35f0dc0ecb2222b4796cfa_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\666.#.exeC:\Users\Admin\AppData\Local\Temp\666.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\801.#.exeC:\Users\Admin\AppData\Local\Temp\801.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\507.#.exeC:\Users\Admin\AppData\Local\Temp\507.#.exe4⤵PID:2736
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\905c0769f9a06c95a24ddf945\441.#.exeC:\905c0769f9a06c95a24ddf945\441.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\905c0769f9a06c95a24ddf945\746.#.exeC:\905c0769f9a06c95a24ddf945\746.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\905c0769f9a06c95a24ddf945\84.#.exeC:\905c0769f9a06c95a24ddf945\84.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\905c0769f9a06c95a24ddf945\98.#.exeC:\905c0769f9a06c95a24ddf945\98.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\905c0769f9a06c95a24ddf945\792.#.exeC:\905c0769f9a06c95a24ddf945\792.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\905c0769f9a06c95a24ddf945\285.#.exeC:\905c0769f9a06c95a24ddf945\285.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1252 -
C:\905c0769f9a06c95a24ddf945\97.#.exeC:\905c0769f9a06c95a24ddf945\97.#.exe8⤵PID:4468
-
C:\905c0769f9a06c95a24ddf945\71.#.exeC:\905c0769f9a06c95a24ddf945\71.#.exe9⤵PID:6028
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\71.#.exe
- Size 2.9MB
- SHA256 5e07cfedf6c13e224417ae76090127dc9c40514e751a93772afa3c311c311e1e
- MD5 011477876a82f8ada055d1958363b83f
- SHA1 ddd67837069e2ff02f48899818d8da3d8f276b22
- SHA512 51dfc3e8efc128ae2a4c8a83b1ad70f736e1b015c970f8cd69b07b485ca6a7859cdbae84ec19a0fc2fa6efa03700252872991c463c263633c4f7bafe772f9200
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4A:TID41F5Ewx
- TLSH T104D56C51B7E54932E1B3027689B793926E727C211F3492CF2394636D6E337C0A6367B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 6280632ca7ed49e43913cbcb65831555bae87c5bbc99ddef0b44b5dd02036e16
- MD5 3929fc0ffb35f0dc0ecb2222b4796cfa
- SHA1 b7e3a5dc2d25ef331e7f3831bfda3dd8bdbd1e6e
- SHA512 44906fea860327fe0d11dc8d030f73c35b5628c133da4a12f6a7e146c805601a73866f33a723d049303d70f33b30066b63b19f24553c74a3166bea8e5e46a18b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4SkZP4sz9Mbsdqatg8:TID41F5EwfkZcsxn
- TLSH T1D6166D51B7E48633E0B3417184A7569A6E3278118F329ACF13446BADBF737C09A32776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$
- Size 4.1MB
- SHA256 476c793090af693cc90d5574c873b1984ad52699ac7129fc4f89d3bc85c548b6
- MD5 567c68db8749a486504b61242e7515c8
- SHA1 e8776814dc878c3e057686427a873bf1597c3edc
- SHA512 3ce965d4f07e3958d9281081d0feed1c2864a937c1aeb29fc3c0d10e0d3a3ab7ff3e8063b368b36c8edcc697fa4433d84cb4c68ea86c99cc1604907318025963
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4SkZP4sz9MbsdqatgZ:TID41F5EwfkZcsx
- TLSH T1BB165C51B7E48633E0B3417184A7569A6F3278114F229B8F1344ABADBF737C09A32776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 4.0MB
- SHA256 2b0567b336c862510bfb576d77f642d735c1e05036ca36a4d103ebf5693f6731
- MD5 0c702f3e0c842a6d83f7d9968fed177b
- SHA1 4d5c26985d3d35a0c9f259b5033ba21a9bd101d4
- SHA512 d12fb6394afbbd4d9349cd7f0ca5a322ce03c01a7b8eeee09e6556d9fd71e8864bfaaf7c9be70f6a69b0d0f78f9bc20e51919d7ff6a8cf54c453efc79bb45f32
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4SkZP4sz9Mbsdqatgh:TID41F5EwfkZcsxk
- TLSH T1B2166D51B7E48633E0B3417184A7569A6E3278118F329ACF13446BADBF737C09A32776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 4.5MB
- SHA256 2c28165c40053415c0b669bdbad3882f804eca0328e892cb1a265fad293a1994
- MD5 49121e8a7dfce8807f7018f9364fc238
- SHA1 b7e1c206ef0cb4e8cb0b0f2d8565496d609491b8
- SHA512 e515eed80d9f8eff4e844a0f46f0ad3e14afd0acb6bf70f399ab981717ab4409cf3435320c4b84f28658c385269e973e549d1e563bbe64af15b6265b659186ec
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4SkZP4sz9Mbsdqatg1:TID41F5EwfkZcsxxm
- TLSH T1C1266C41B7E48672E0B3413184A796AABE7278114F329B8F1344A7AD7F737C09A36771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
- Size 1.1MB
- SHA256 d70930969bbf56093ea5879ded3ed6a82d9bb6ea479536355a3fd69802d00ef5
- MD5 5e781235badb61bede775cdcda30493a
- SHA1 d58e894100de8115b111c677523bfc73d8c46456
- SHA512 f22f87b938d82df13ee893aee69d4f1a72393edd48efe9efecdf269370b812b5ff123a1f5131f5136f1fb55236eeedff09a470da0dbcb49ba7aa269a045b8ba6
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgl8b3:W/4MnYYJ2ZhqSGLHyqatglYqatglW
- TLSH T184356C42FB82D5B3D0570232446B52A32B75B8211F56A38B2394677DAF333D0B73676A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$
- Size 4.1MB
- SHA256 9baf46fd6a1c6a8045affb3ee15fb5b56b52eb778120b29cc0193374b23853fe
- MD5 6c6b728723d5760a432e749e33d8d52c
- SHA1 b9c7f6ea7efaaffb823bcf84ee4932419af5802b
- SHA512 2a08155bdd6797d11bd10d995286fead3dc7cca38118cb412ee9e55447a28ca012bbd94fcb4af831c5cf395fbf5c120d8855c1578393633439b198e1a60cc955
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5mqatgl3eW4SkZP4sz9MbsdqatgT:TID41F5EwfkZcsx
- TLSH T153166D51B7E48633E0B3417188A7569A6E3278114F329ACF13446BADBF737C09A32776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$
- Size 4.7MB
- SHA256 91ae6f37bb560fdcf20cf57019e1e673b996f51a13c764c3682f18efd57c50dc
- MD5 04c39d9558ab2da592155f8ea481ada0
- SHA1 2aac70f559d64b0691c5b751fa787698604fac52
- SHA512 d13897202fff265260158a6fe527130fa3dcccf804b6d2bae39dcc879ba027c391670ae94bf9724b3700567436dff945eb1a8acc471ff3f57e13bf6b67f6e4ff
- SSDEEP 98304:TID41F5EwfkZcsx/MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMM:TuU5RPs0
- TLSH T1D1365C51B7E48632E0B341718867569A6E327C118F228ACF23447BAD7F737C19A32776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$
- Size 1.1MB
- SHA256 e1565b782247bd62e8d59f3815ccf394cd6a79441599929cf9026d2b071a1b23
- MD5 f177dc37a17f883b79dab91882fc4c3f
- SHA1 29f1e134bc0e38f79643cd2301250e492d189fb4
- SHA512 fc6a2a6161dc6b17e81cba01aa7871a924b734863e216a07030c63f0a1b86734b048c78ae610bfeaadcbf1bb4b68eced62ec8a057ef34007bd5fdd251bc0a62c
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgl8bbt1l:W/4MnYYJ2ZhqSGLHyqatglYqatgluD
- TLSH T1F0457D42FB41D5B3D11B0232445B52A72BB5B8211F56A38B279467BD6F333C0B7327AA
- MD5 SHA1 SHA512 SSDEEP TLSH