Analysis
- max time kernel
101s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 10:08
Behavioral task
behavioral1
Sample
2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 2.3MB
- Sample260718-l6afpsa18x
- SHA256 aa983c6afed73c0ba469dcdcead4850faa3b4889d779c008012a4692fd3cb03a
- MD5 ed5cd87857b1795ad7a0e1ccb0966b1c
- SHA1 9efa1305c7f0e36d509c8dd091e9c62b6d3db2c5
- SHA512 f5ce0b846075cebb9d7fb55f551418567cb793779023f7ef9d53c8d8b21b03ceea0a6b9b1c2a9755c4bafd73662723fe929d557a7f8caada776c03c42159cd4c
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5MLK/0Le5ji0hJ:TagnTkLfUTpnqJtb2IgPji0Aj
- TLSH T18FB52926E6A44361D0BAC075CAD2964AFA333C810BB086CB42D5F77D6F337D19976722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/2304-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c588-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4408-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2304-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0fd-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-1268.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c588-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000300000001a0fd-1018.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-1268.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4408 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2304 2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe 4408 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_ed5cd87857b1795ad7a0e1ccb0966b1c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2304
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 aa983c6afed73c0ba469dcdcead4850faa3b4889d779c008012a4692fd3cb03a
- MD5 ed5cd87857b1795ad7a0e1ccb0966b1c
- SHA1 9efa1305c7f0e36d509c8dd091e9c62b6d3db2c5
- SHA512 f5ce0b846075cebb9d7fb55f551418567cb793779023f7ef9d53c8d8b21b03ceea0a6b9b1c2a9755c4bafd73662723fe929d557a7f8caada776c03c42159cd4c
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5MLK/0Le5ji0hJ:TagnTkLfUTpnqJtb2IgPji0Aj
- TLSH T18FB52926E6A44361D0BAC075CAD2964AFA333C810BB086CB42D5F77D6F337D19976722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 dd07d70e82fe9044d22313485a8959861b73fd9a34c79c9c81febb35451f04b0
- MD5 c6a6a50e4091c4b60d2732dd65f11a5e
- SHA1 18f16acb198c9631c4b59b6d3610e3019a7e26e3
- SHA512 2f31c5f13f9b297dd70a981a8c8e441689ee16d3c7d13bc36fe131306bef77f8f27375a8e80f7b29ad6c450af60ef86194e1e6aa68fb85aff534cc25584853f1
- SSDEEP 49152:TagnTkLfUTpnqJtb2IgPji0AjKPji0Aj:9Nzjo0jo
- TLSH T12AD51826F6648361D076C0B9CAD2964AFA323C810B708ACB42C5F77C6F377D59976722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.4MB
- SHA256 087f121c52f98a613186ed694de297ef1246548b252e65b3e3ca7c19c2df998a
- MD5 63bf304fd221d2f20ef69d3fbcc35254
- SHA1 b8f094cdcaaa7add720af9dcd7f9e4eb4663f66e
- SHA512 a81ccbde54140085b8942d22c736fb3ef9d62999ebf33c5f3f923752d997e4404a97de070a19ed14e5824bfedd1d64891eae7d757722689d98a07db157a66ca9
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5MLK/0Le5ji0hX:TagnTkLfUTpnqJtb2IgPji0Ajq
- TLSH T15DC53926E6A44361D0BAC074CAD29646FA333C810BB08ADB42D5F73D6F337D59976722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.4MB
- SHA256 9c23d6488f66654a01d8c6200215aa71b688e9e568e6e9503c8ce132adebd01b
- MD5 6e732a2f093a252921fda51a00660a24
- SHA1 958bf031f53e60352ba120615703d034d8b882e5
- SHA512 ad3d719662bec7484254c1f4b98a2243bfe9008ec561871aaa8463c2531bac48a08cfc29eb61adf318a9cf4e96000af2dcb0c43103270cd6613cd2d4f6ac1fec
- SSDEEP 24576:bHNgHg1flT/Vk3HYwLfUJD1F5jcAkSAYTqMi8CtBd2QHCHmTBW5MLK/0Le5ji0hC:TagnTkLfUTpnqJtb2IgPji0Aj7
- TLSH T1A5B53926E6A44261D0BAC075CBD2964AFA333C810BB086CB42D5F77D6F337D19976722
- MD5 SHA1 SHA512 SSDEEP TLSH