Analysis
- max time kernel
90s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 18:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe
- Size 3.1MB
- Sample260422-wp64fshx41
- SHA256 93f42e4b133b637a3a3f68bd334abab93078f1c0c1ae0213cad442daf14cd25d
- MD5 f32d8db6090b8a34112ae9a556744d42
- SHA1 4da249132227290eeef375761eededfbefcff5dc
- SHA512 ded28cba2ca8487d93fde67448f1749735a7712aa3f982af13dff95e61479802b7d665329366e495822270e4642267c91c5265db8281566d92bb4e011d53d6ca
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYq:YqcxAOY6wRRucxP6
- TLSH T1AAE55905F26487FAD8738175C89296B6EA717C510B30E7CB128DA26D2E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4212-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243e2-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2780-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229d9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023426-148.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000021477-650.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021d74-970.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022452-1236.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4212-1371-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2780-1373-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020307-1374.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000006d1-1529.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e507-2072.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2780 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4212 2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe 2780 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_f32d8db6090b8a34112ae9a556744d42_amadey_cobalt-strike_elex_glassworm_icedid_rhadamanthys_.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4212
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 93f42e4b133b637a3a3f68bd334abab93078f1c0c1ae0213cad442daf14cd25d
- MD5 f32d8db6090b8a34112ae9a556744d42
- SHA1 4da249132227290eeef375761eededfbefcff5dc
- SHA512 ded28cba2ca8487d93fde67448f1749735a7712aa3f982af13dff95e61479802b7d665329366e495822270e4642267c91c5265db8281566d92bb4e011d53d6ca
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYq:YqcxAOY6wRRucxP6
- TLSH T1AAE55905F26487FAD8738175C89296B6EA717C510B30E7CB128DA26D2E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.4MB
- SHA256 20aa11c7fb78fcb6b782eba064ac4d7b8a5d38a21b373a7b0c6f2252139781f5
- MD5 ef48d14c58f6fa3ab43aa9947aff4a86
- SHA1 ab0f4c2aa3882da0d7e097f574f8e79656a035be
- SHA512 4a33c935d14017b7689f2aebfa62db2fb70fa29e934d1a0ab96fa1e46ff1698e1ddc2d4d05f35b8b0e99b0308f12b9fc9138d6b05a185cb079d1c59b27d84e51
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqdUN+Eir:YqcxAOY6wRRucxP60E
- TLSH T12BF55B06F7648AFAD8338179C8929766EA7178510B30E7CB1259A32D2F33BD19D37721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.6MB
- SHA256 0fea930d776cb9b681d39bb4250e024d77041b9f9b586350ee8bd7c6c53b731c
- MD5 90a5b941b4385b8026c9bc6b25c998a6
- SHA1 d120cf762521a7a82900e07454f5954d5bc855ae
- SHA512 113217e331e2c6d963a0cab353720ae88e667ae428d852c5c2aff762cfca4ae15a60e60d8a1261a76e587ccded6916097e015f1ede28a99fb8baca9914cf0d02
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqHTd9CHKyao:YqcxAOY6wRRucxP6YCqo
- TLSH T15B065B41F3A446F9E4738175C8A29666EA717C550B30EB8F1398A26D2F33BD18D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 760b6503aab92f3a06a145c151a2563f3c3df6afcecb0fb784cf8e9d4fb25ca5
- MD5 2ac37513f3ddc50b85782c8cefb2e913
- SHA1 a28f5dadf96cfe9b27bd54b0fe09b27cb764be1f
- SHA512 0c62ea686eb79922f7c540fbd97a73b3d12a011f91393d57435a7b8a14e8c6086607b7246e550465fbde3f91885e8ef0033b9a41e0e41dbd5b86b9a3f2577fce
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqjPji0Aj:YqcxAOY6wRRucxP6Gjo
- TLSH T134064916F66487F9D473C179C4D296A6EA7178450B30EBCB1289A36C2F33BD28937721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
- Size 3.3MB
- SHA256 a3d084cc92d59c5aabd8149772b15bc23d886d9dd3bc4e322f18cbf0b6d55f3a
- MD5 fcaa6df2c108cdd1aef9bd7002c22e0f
- SHA1 bb7fefe4462a9f93f54100f99f99457792a1cebf
- SHA512 7f87367ac1c28e3b5720981486d1026c8c06df023302c0fd9d0bfdac3df738caa46fddaa2a1f87e9efce0abea84e9535eb275ffec204fc8b10e4b404cca50231
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqk:YqcxAOY6wRRucxP6F
- TLSH T10AF55A05F26087E9D46A8175C6929666FA327C510BA0E7CB12C9E27C2F33BD18D77723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 3.2MB
- SHA256 695e67a1c08f5913705ef138de928e35e97b1fec1a295bf6e4a141d693e25d92
- MD5 f24cbc87829439ea7524e948b544f926
- SHA1 53d5816e151f5af20619043aff6746c0c34b5fa2
- SHA512 2bf0be92a708bfd4e80b379044c7b62ba2008c40d31819ed1fd2044741db19bdb76f86389aaa706a683cc024ef822c466e982c2770cdceb35493657cb1f49b1c
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqQ:YqcxAOY6wRRucxP6l
- TLSH T1C6E55905F26487FAD8638175C89296B6EA717C510B30E7CB128DA26D2F33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 3.2MB
- SHA256 bc1cae027d5ae7d1abc54b89a9d81e602e398f9a7e36337e414efc876c80a6a7
- MD5 749aa45610e9b71061b4fe6425550a3c
- SHA1 b8ae887c9f3182c05c90ccd20c0214eb9b59571d
- SHA512 24dbe5ef8a7c31222052a428a919fcae5d44d13e94e6ada4209230f1774c3aa43dd1804dbe58ae4933e2662ab66b0e5a0ff70148d647b12df5da45ffab1cdb4e
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqy1:YqcxAOY6wRRucxP6b
- TLSH T1FBE55A05F66487FAD8738175C89296B6EA317C510B30E7CB128DA26D2E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
- Size 3.2MB
- SHA256 6ab4804980f01c0d42413149a37cfd8207c955fc0b21ce467c42aea2d6f4122b
- MD5 ff62ac661fd3f51f5b801b3478cac800
- SHA1 071dd9f91aa72b251d28b5a9c043671a12691cd4
- SHA512 2cd1590caf5842d953dfb97f3c6aa1d58cd251f1570eaa538aa1a9c873064fe2b02a5750a9db29de22ac3daa8e03f0413f64b81122674ed661c2af5a318d9e65
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYqt:YqcxAOY6wRRucxP6Y
- TLSH T1EBF55A05F2A487FAD8638175C89296B6EA317C510B20EBCB124DB36D6E33BD19D37721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.4MB
- SHA256 473cb346e862fbeb45bddd49ee158d5df7b795e87ab1b5714659b3a5d1b729b7
- MD5 b1fb905b6e2156149263c8a71b41fe4a
- SHA1 284a8cb06ec2aa67511561355f2927eb198e1a1d
- SHA512 10032a2ccf54f9cb274b76085a9c6b8c969537f8efb56c3264dcad4410132b5bbc685458f7a86d13ddc289f9a51c4c75e8b508b7afdfc1a71f70d75b54a0c5e5
- SSDEEP 49152:BCL2c8MNFLA0vb7ApYqXqatglcZ/7yQPI7BCxPpYq/i2WH3:YqcxAOY6wRRucxP6CuX
- TLSH T1E7F55A11F6A487FAD8738175C89296B6EA717C510B30E7CB1349A26D2E33BD18D37722
- MD5 SHA1 SHA512 SSDEEP TLSH