Analysis
- max time kernel
84s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 11:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe
- Size 2.3MB
- Sample260525-m678eahv81
- SHA256 6d188ccddaf345f39a1dc3a9365f15f5fa5d98f754d841c5f3b31976e7de88f2
- MD5 e6e6f1c419bb326ff016c7f6b0da5462
- SHA1 2d712368602a72167c5b8299cffe91dcdc6ca8a4
- SHA512 f0f8851d60e3f8a8e847c72a3b68c60dcd71f85512310faee5c40c266377aa76adb0e7174ef94ae9f7fab16ac46c200b3db95f850f9d0403fa3fa6415e6fae26
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6:BCL2c8MNFLA0vb7w56rn9TI956rO
- TLSH T115B5260262944FB5D16F41348961466DA737BC21CF238FCB16906EEEBFF26809E25637
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4952-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002456c-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2028-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002457b-837.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000219ee-839.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002458c-1017.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021abd-1024.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021677-1253.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4952-1406-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2028-1461-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000900000001ebf3-1917.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2028 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4952 2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe 2028 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_e6e6f1c419bb326ff016c7f6b0da5462_amadey_cobalt-strike_elex_hijackloader_icedid_rhadamanth.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4952
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 6d188ccddaf345f39a1dc3a9365f15f5fa5d98f754d841c5f3b31976e7de88f2
- MD5 e6e6f1c419bb326ff016c7f6b0da5462
- SHA1 2d712368602a72167c5b8299cffe91dcdc6ca8a4
- SHA512 f0f8851d60e3f8a8e847c72a3b68c60dcd71f85512310faee5c40c266377aa76adb0e7174ef94ae9f7fab16ac46c200b3db95f850f9d0403fa3fa6415e6fae26
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6:BCL2c8MNFLA0vb7w56rn9TI956rO
- TLSH T115B5260262944FB5D16F41348961466DA737BC21CF238FCB16906EEEBFF26809E25637
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe
- Size 2.5MB
- SHA256 cf27f21f00f4b471098190f3adc83a08dc067912359136f7a2bb8134d624709f
- MD5 3cc6f203667da7a692e715c61c896c0e
- SHA1 56843126b57b6ee711a5c752b4b9f4c738c92176
- SHA512 3e2216aa502d334ddf08037ae83b664b63035ed0e1b58ab8a4dae0c5283297671848fc2a7f092cafa07ab886cc33a59675e836390b445fa92a5fa2e7d6c9b322
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6qGen:BCL2c8MNFLA0vb7w56rn9TI956rOUI
- TLSH T1ABC5160262944FB5D16F41348961465DA737BC21CF238FCB16946EEEBFF26809E29633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 8f568fcb433c3c043f7cfebd8cb7f30fd4837aee857683683b888d834d5dca33
- MD5 4bac89e56fc49d22e7a7e8632b2b5d88
- SHA1 08ab2527be10f69475156876034db238c802b519
- SHA512 77a7e705f73f7a8748e6c38c4911201fd810413da807b22236613ed3e154cefd254bcfef80be0f5995f2e2a7fa3eb2e95bda7dc4b1d64e9ad6ca3c2424302d6a
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rn9TI956rOiPji0Aj:YqcxAO1rnBrOojo
- TLSH T159D52702B2A44FB5D06B81748492565DE6337C518F228FCB1284AEEDBFF26D19936733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 2.9MB
- SHA256 7d9f79486ad32d863a21d3f88b35d80755e0db267f758de6952ae02d0477ecb4
- MD5 cb245b786e25ab209ff8a0f7e22063de
- SHA1 db8fe4d990bc42d949c8652bafe80570f2cdf3d4
- SHA512 74c0416b67d40714f9db67f42efa30e34253c9af2dd621ccba953544a91d29225db1d80300da995bb85feed1dfa1960c18b558c2aaf3dbaf53018242cd92bcb8
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rn9TI956rO+8tDZqrKV:YqcxAO1rnBrO+m
- TLSH T191E52746A6944FF5D16F413485628679E673BC118F238FCB0250EEEEBFB22905D29633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 2.4MB
- SHA256 c4f2225a7aca81dc221775e8ef30c71e63665e69015971a84dc1bc544c662b64
- MD5 083f70b9a61d043a0126262795bbe7b9
- SHA1 3598049ade03e545972fd51c80d4352d26455128
- SHA512 8d9da4722d93f5048bdaabbb74c0da2527b9cb06ce3f38402400948d2bffaf0cabc613270a441d51d4ccbd45c2cf397fbddf87377f51e5dbda34ca3d98a9bbad
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6SwE:BCL2c8MNFLA0vb7w56rn9TI956rOD
- TLSH T133B5260262944FB5D16F41348961466DA737BC21CF238FCB16906EEEBFF26809E25637
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 2.6MB
- SHA256 f9808132d0a22a786e9c6514562d91fceec8bfc28813f65ba58dd5202637d50e
- MD5 a9951d963582dd81af2e7d085b9dc295
- SHA1 ba6c8b4b43d150087085d2e654bacd1b14783809
- SHA512 43eb0f9d62d1a56ea8a9d4472050369ba4dda5b387e3550eeae57db265bef2e100f051c3cc235dd4c983627a1e3aaae1c1b3c38e65e50c308065a1d0b327a21f
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6F9bhvd:BCL2c8MNFLA0vb7w56rn9TI956rOubz
- TLSH T1E2D5270276944EB5D12F41348951866DA773BC21CF238FCB1690AEEEBFF26819D25633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 2.4MB
- SHA256 9f5032f8340067a17eda4ef8cb9920163c406af9f6e56d75a43e5a738de1737e
- MD5 4679f10ec6df94ba81432c3aba278549
- SHA1 a4705c78a5bcb38f7dc91dc0581818b20fc3855c
- SHA512 4e03e8b1fbdd90b2d9f5739d297a01fc7727a9acbd8b5c46dd62376ee96a66650abcfea1081d1bdbd32bd6d41f90ad90e2f71fa2a7c2cf303adbef048f1eed3f
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6knlR:BCL2c8MNFLA0vb7w56rn9TI956rOl
- TLSH T142C5370262944FB5D16F41308961465DA737BC25CF138FCB12A46EEEBFF26906E29633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.4MB
- SHA256 ae08a3fca14987b8497bafa2882ab3f0f89ca8e4c06d57472e29b1a7b59ba3ad
- MD5 e9e93e80082d96fc111286ffdbe29f5c
- SHA1 b40b2b5d2995c29b232936f6a23ef90ea3a2c83e
- SHA512 4c20f358bb5caf153628579fa60c6cd93596f4acb426eee4325511f596bbf356f3ce290795a72709df3cf36b6fa384bc8244f2df10b4c0659952f8d6119da098
- SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5Tvinrmi9ZZhq9D5TvinrmJAhYus6LF:BCL2c8MNFLA0vb7w56rn9TI956rOy
- TLSH T1B6C5260262944FB5D26F41308861465DA637BC61CF138FDB16947EEEBFF2680AE25633
- MD5 SHA1 SHA512 SSDEEP TLSH