Analysis
- max time kernel
121s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 22:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 5.1MB
- Sample260720-2tw2yaat4x
- SHA256 175ba79c1ceb9fa159d25e215f568f7deb27cec3492b110aca5efc4763d54826
- MD5 57b68ca848c4525c25551b0eea32fba7
- SHA1 2de2460829cd70410216c36796eeb52218b81782
- SHA512 0217951492bd5e9ccbcefee659073f1e4b0f3e8214584f671a413e1f049a6e99ebee92e55643dfaf891b72c9b6bba9b4ca8a63af0863636f8dd911ee43a616bd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuaja:TID41qM5ram6m51KYcL2tBW1Pszx7
- TLSH T1CC367D16B7E445A1D5778135C56682A2EE727C211F30D7CF1390AA3D6F337D0AA3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4684 patcher.exe 5452 786.#.exe 1560 556.#.exe 3836 890.#.exe 5124 506.#.exe 1384 260.#.exe 4136 98.#.exe 5712 48.#.exe 4548 562.#.exe 4768 808.#.exe 2268 323.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 786.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 890.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 506.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 98.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 48.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 562.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 808.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 323.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 556.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 260.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ 98.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sq-AL\ 48.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lo-LA\ patcher.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\ 556.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ 786.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 260.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-PT\ 48.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ 890.#.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 260.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 556.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 556.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\ 260.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\ 98.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\ 98.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\ 786.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 260.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 260.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\ 506.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 890.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ 556.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\ 506.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\ 506.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mt-MT\ 260.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\ 506.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\ 98.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 786.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\ 556.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 98.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\ 260.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ 260.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\ 98.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ 556.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\ 260.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\ 890.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\ 260.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\ 260.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\ 556.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\ 786.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\ 786.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\ 260.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ 786.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\ 786.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 48.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 48.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\ 506.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\ 556.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 98.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\be-BY\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 556.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\ 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\ 506.#.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\ 260.#.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 323.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 556.#.exe File opened for modification C:\Windows\:\systemlog.bak 506.#.exe File opened for modification C:\Windows\:\systemlog.bak 260.#.exe File opened for modification C:\Windows\:\systemlog.bak 98.#.exe File opened for modification C:\Windows\:\systemlog.bak 48.#.exe File opened for modification C:\Windows\:\systemlog.bak 808.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 506.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 562.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 556.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 808.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 323.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - NTFS ADS 12 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\:\systemlog.bak 556.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 890.#.exe File opened for modification C:\Windows\:\systemlog.bak 506.#.exe File opened for modification C:\Windows\:\systemlog.bak 48.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 562.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 786.#.exe File opened for modification C:\Windows\:\systemlog.bak 260.#.exe File opened for modification C:\Windows\:\systemlog.bak 98.#.exe File opened for modification C:\Windows\:\systemlog.bak 808.#.exe File opened for modification C:\Windows\:\systemlog.bak 323.#.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 5240 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 4684 patcher.exe 5452 786.#.exe 1560 556.#.exe 3836 890.#.exe 5124 506.#.exe 1384 260.#.exe 4136 98.#.exe 5712 48.#.exe 4548 562.#.exe 4768 808.#.exe 2268 323.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5240 wrote to memory of 5452 5240 2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 91 PID 4684 wrote to memory of 1560 4684 patcher.exe 92 PID 5452 wrote to memory of 3836 5452 786.#.exe 93 PID 1560 wrote to memory of 5124 1560 556.#.exe 94 PID 5124 wrote to memory of 1384 5124 506.#.exe 96 PID 1384 wrote to memory of 4136 1384 260.#.exe 97 PID 4136 wrote to memory of 5712 4136 98.#.exe 98 PID 3836 wrote to memory of 4548 3836 890.#.exe 99 PID 5712 wrote to memory of 4768 5712 48.#.exe 100 PID 4768 wrote to memory of 2268 4768 808.#.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_57b68ca848c4525c25551b0eea32fba7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\786.#.exeC:\Users\Admin\AppData\Local\Temp\786.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\890.#.exeC:\Users\Admin\AppData\Local\Temp\890.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\562.#.exeC:\Users\Admin\AppData\Local\Temp\562.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4548
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\905c0769f9a06c95a24ddf945\556.#.exeC:\905c0769f9a06c95a24ddf945\556.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\905c0769f9a06c95a24ddf945\506.#.exeC:\905c0769f9a06c95a24ddf945\506.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\905c0769f9a06c95a24ddf945\260.#.exeC:\905c0769f9a06c95a24ddf945\260.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\905c0769f9a06c95a24ddf945\98.#.exeC:\905c0769f9a06c95a24ddf945\98.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\905c0769f9a06c95a24ddf945\48.#.exeC:\905c0769f9a06c95a24ddf945\48.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\905c0769f9a06c95a24ddf945\808.#.exeC:\905c0769f9a06c95a24ddf945\808.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\905c0769f9a06c95a24ddf945\323.#.exeC:\905c0769f9a06c95a24ddf945\323.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\905c0769f9a06c95a24ddf945\838.#.exeC:\905c0769f9a06c95a24ddf945\838.#.exe9⤵PID:5264
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.1MB
- SHA256 175ba79c1ceb9fa159d25e215f568f7deb27cec3492b110aca5efc4763d54826
- MD5 57b68ca848c4525c25551b0eea32fba7
- SHA1 2de2460829cd70410216c36796eeb52218b81782
- SHA512 0217951492bd5e9ccbcefee659073f1e4b0f3e8214584f671a413e1f049a6e99ebee92e55643dfaf891b72c9b6bba9b4ca8a63af0863636f8dd911ee43a616bd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuaja:TID41qM5ram6m51KYcL2tBW1Pszx7
- TLSH T1CC367D16B7E445A1D5778135C56682A2EE727C211F30D7CF1390AA3D6F337D0AA3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 5.1MB
- SHA256 6c1b1d75247d537b9f398de348b5d65aa4283bf7660a9d442319abb5bf675fe6
- MD5 e455fe83ef6c2905eb63d1a7ef99790b
- SHA1 f7ba477ac21fc5cf807dc6f6f9c68d745dec7562
- SHA512 fc05e3c9379ac7209b22fcd120488e67a1d6774f90f15c9f8782dbbc77b0ee0784294754a26b2ab6976fa84941d471648f97e17a9f9b004f1403403740ca5321
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuaj9:TID41qM5ram6m51KYcL2tBW1PszxO
- TLSH T17E467C16B3D445A1D5778135C96682A2EE727C211F3097DF1390BA3D6F337D0AA3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 5.5MB
- SHA256 5ece56412c3d7a50722e2f812e8da3f84089c9416775f43063fb075121802663
- MD5 c4eeb4a32a93c746e10a579266a79f9a
- SHA1 d7f838eb42b8a3b4ae4f25c33dc48bd8e761ae21
- SHA512 91f37779b61beb91450462241202581dbc39b5097595070e41ac01fc7207a9edeab55511006b31aa6cbc56c40e05d46b6123e01b7f2b3d556fa7579c7e4061f6
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuajo:TID41qM5ram6m51KYcL2tBW1Pszx59
- TLSH T100467C1AB7A445A1D177813585668292EE727C211F30D7CF2394E67D2F337D0AE3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 5.6MB
- SHA256 3b0124ace85269085cce50610da0e4ad501bd025640fc294a4b520999da286e5
- MD5 5b2e81fdf84b331ef8653e27b0dadd72
- SHA1 202277bc2552e79560f16d9ce407d5fc9955a880
- SHA512 797eed47e165f15bf770e77e7d622799b5d021ec6d77078c70889bf2e3e690d7a424415191ea0cf902056886ef29a54d38b9b854eb7eae086515b3ddd316aebe
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuajz:TID41qM5ram6m51KYcL2tBW1PszxFm
- TLSH T1FD567C5AB7E446A1D1779135C56682A2EE7278111F3097CF1390E63D2F337D0AE3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$
- Size 5.1MB
- SHA256 effb21718c6e9bb64f9965b1aad1af98f2987269d80d55c63ce88e76ecca0886
- MD5 3444dc1aefc5dabb63632f4ada92c7ff
- SHA1 c9e7ba0a2481c90998d57461f8fffcfe850016a4
- SHA512 6de0e56b99dea69eefc27cfc717a9e03f188ef5df00f4274ffee1abe19b2311dd8c2cbfd2885476755e51a57ddf65fb8fb670ddf19b03262487526e75986bd6f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuaji:TID41qM5ram6m51KYcL2tBW1PszxB
- TLSH T165367D16B7E445A1D5778135C56682A2EE727C211F30D7CF1390AA3D6F337D0AA3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 5.1MB
- SHA256 755c32f0cd1f12e93e01e8d7043416eb815e9897776d8deaa06d5414c9600abb
- MD5 d31c98def91f0a53fa61f2fc0f3bf878
- SHA1 f78516ae215de42630e27b96299cdc908cdc36c5
- SHA512 51285d08541f32aa9ed843f9e5606533a878568be9f045cd96b07d34ac3a1b1c5d20869b69ba99f68cab03c69f027a5a3d3e9d55f79c1c1c308ac1e437b312df
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuajK:TID41qM5ram6m51KYcL2tBW1Pszx5
- TLSH T1CC467C16B3D445A1D5778135C96682A2EE727C211F3097DF1390BA3D6F337D0AA3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH