Analysis
- max time kernel
118s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
- Size 5.0MB
- Sample260728-ey7ynsaq21
- SHA256 4e22d6afc271c408ca561deb445fc9dc580e713ab18b515a2b9dd3159a6d7d66
- MD5 f18184325bbbe13084ec3a8b14be7125
- SHA1 5231d80d6646fb6a09864cad965d19cf74aff833
- SHA512 1beb7fc29040e1bb8e7927edcc44789dfd57b27a8f79ebea1bd5eaf94c01d736c4d39aafb6f899c64dc3c3a45442542615c3563310eb81142086c428fb5e0480
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQsy6i1zuajsauZjaAqJtb2ITJIU7eW4SkZR:TIDQ/nW1Psz4tJ+fkZc86
- TLSH T165366B16F6BB8272DCB3D079C5E6A655FA3234111B308ACF1345863D2F27AD19A39732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 9 IoCs
pid Process 4792 patcher.exe 5496 458.#.exe 5024 936.#.exe 3156 625.#.exe 3388 931.#.exe 4576 625.#.exe 5244 547.#.exe 4692 926.#.exe 2940 955.#.exe - Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 955.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 458.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 625.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 926.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 936.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 625.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 931.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 547.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\ 625.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\ 625.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\ 547.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ 458.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\ 625.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\ 625.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\ 625.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 936.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 547.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\ 625.#.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\ 936.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\ 547.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\ 458.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\ 936.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 547.#.exe File opened for modification C:\Program Files\dotnet\ 547.#.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 936.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 458.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 625.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ 936.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pl-PL\ 547.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\ 936.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\ 625.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\ 458.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kok-IN\ 547.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\ 936.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\ 547.#.exe File opened for modification C:\Program Files\Common Files\ 625.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\ 936.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ patcher.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ka-GE\ 625.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\ 625.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ 936.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\ 625.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\ 936.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 547.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 625.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 936.#.exe File opened for modification C:\Windows\:\systemlog.bak 625.#.exe File opened for modification C:\Windows\:\systemlog.bak 625.#.exe File opened for modification C:\Windows\:\systemlog.bak 547.#.exe File opened for modification C:\Windows\:\systemlog.bak 926.#.exe File opened for modification C:\Windows\:\systemlog.bak 955.#.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 547.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 955.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 458.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 936.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 931.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 926.#.exe - NTFS ADS 10 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 458.#.exe File opened for modification C:\Windows\:\systemlog.bak 936.#.exe File opened for modification C:\Windows\:\systemlog.bak 625.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 931.#.exe File opened for modification C:\Windows\:\systemlog.bak 547.#.exe File opened for modification C:\Windows\:\systemlog.bak 926.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 625.#.exe File opened for modification C:\Windows\:\systemlog.bak 955.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5212 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 4792 patcher.exe 5496 458.#.exe 5024 936.#.exe 3156 625.#.exe 3388 931.#.exe 4576 625.#.exe 5244 547.#.exe 4692 926.#.exe 2940 955.#.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5212 wrote to memory of 5496 5212 2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 91 PID 4792 wrote to memory of 5024 4792 patcher.exe 92 PID 5024 wrote to memory of 3156 5024 936.#.exe 93 PID 5496 wrote to memory of 3388 5496 458.#.exe 95 PID 3156 wrote to memory of 4576 3156 625.#.exe 96 PID 4576 wrote to memory of 5244 4576 625.#.exe 97 PID 5244 wrote to memory of 4692 5244 547.#.exe 98 PID 4692 wrote to memory of 2940 4692 926.#.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_f18184325bbbe13084ec3a8b14be7125_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\458.#.exeC:\Users\Admin\AppData\Local\Temp\458.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\931.#.exeC:\Users\Admin\AppData\Local\Temp\931.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3388
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\905c0769f9a06c95a24ddf945\936.#.exeC:\905c0769f9a06c95a24ddf945\936.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\905c0769f9a06c95a24ddf945\625.#.exeC:\905c0769f9a06c95a24ddf945\625.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\905c0769f9a06c95a24ddf945\625.#.exeC:\905c0769f9a06c95a24ddf945\625.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\905c0769f9a06c95a24ddf945\547.#.exeC:\905c0769f9a06c95a24ddf945\547.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\905c0769f9a06c95a24ddf945\926.#.exeC:\905c0769f9a06c95a24ddf945\926.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\905c0769f9a06c95a24ddf945\955.#.exeC:\905c0769f9a06c95a24ddf945\955.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\905c0769f9a06c95a24ddf945\649.#.exeC:\905c0769f9a06c95a24ddf945\649.#.exe8⤵PID:5140
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.0MB
- SHA256 4e22d6afc271c408ca561deb445fc9dc580e713ab18b515a2b9dd3159a6d7d66
- MD5 f18184325bbbe13084ec3a8b14be7125
- SHA1 5231d80d6646fb6a09864cad965d19cf74aff833
- SHA512 1beb7fc29040e1bb8e7927edcc44789dfd57b27a8f79ebea1bd5eaf94c01d736c4d39aafb6f899c64dc3c3a45442542615c3563310eb81142086c428fb5e0480
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQsy6i1zuajsauZjaAqJtb2ITJIU7eW4SkZR:TIDQ/nW1Psz4tJ+fkZc86
- TLSH T165366B16F6BB8272DCB3D079C5E6A655FA3234111B308ACF1345863D2F27AD19A39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$
- Size 5.0MB
- SHA256 c48f40fac087cfe6912a86cf93776df9ba3815b5328b47c6cce751595c355ceb
- MD5 f9e97b04ac82b907d2770f265fe8d8d1
- SHA1 07dbf1397654878a7f49c55bb7260a39efca723b
- SHA512 86b70ad0cade363699d3af2eb6d4cc26d91d5c546d8feeb2675880c2a4d2b5dc7202b7008806bc9e7319dcc56ec3b6e61f1e4902940ae5360c0e7a4dd8a89a77
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQsy6i1zuajsauZjaAqJtb2ITJIU7eW4SkZA:TIDQ/nW1Psz4tJ+fkZc86P
- TLSH T1B7366B16F6BB8272DCB3D079C5E6A655FA3234111B308ACF1345863D2F27AD19A39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$
- Size 5.0MB
- SHA256 23e69eae58c0abf5758e22e53278e60ed0303fb91ed9cd85f5130a54a972ecf0
- MD5 b28428e96cfefe0e3f8bf3f9b5473edc
- SHA1 8676664df95814fcdab15d78a0fa204a20f548f4
- SHA512 10a9c50813991a4ae8ea2981756255987e4d6467531233da5807691a90df18499a7dd524febe71758184eded3a307716f7e50dd9020c4f56090a00dd133adbdc
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQsy6i1zuajsauZjaAqJtb2ITJIU7eW4SkZC:TIDQ/nW1Psz4tJ+fkZc86l
- TLSH T1BB366B16F6BB8272DCB3D079C5E6A655FA3234111B308ACF1345863D2F27AD19A39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$
- Size 5.0MB
- SHA256 f5e5c822b4c54cfc7d4ee76b399a933696dca5e9dab747d52677024daf6f2455
- MD5 74621bd87c24bd3a80dc47a4a90247f7
- SHA1 44bb9255ff33084a560dcae63e839f6a8587559c
- SHA512 027ba0a3947eaf0fe38ff922b71709930d235de3518305ccebfdb7774345fd046007efcbd92c38fd83a3eb8981a38e237983d3e025672b62f27e9f8a32f64678
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQsy6i1zuajsauZjaAqJtb2ITJIU7eW4SkZc:TIDQ/nW1Psz4tJ+fkZc86r
- TLSH T14F366B16F6BB8272DCB39075C5A6A655FA3238510B308ACF1345A73D2F33AD19939732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe$
- Size 5.0MB
- SHA256 150b8ce45df6811e59f91e4531edcad86150b7bf217434edc30ebeb2219abec0
- MD5 206989f284f8355e365ff7c543958772
- SHA1 fbbb49bd30f3c487106d6e82c675aac653d23114
- SHA512 d5a277cd076aa09c629ff28b2b5260710f65b383d4ed24efb19a6f3229593e2f607e874ca72e3bc6f0f2b02b5be92f36a93ffbfad987585479a9a3bc4d0b76bb
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQsy6i1zuajsauZjaAqJtb2ITJIU7eW4SkZt:TIDQ/nW1Psz4tJ+fkZc86Yp
- TLSH T143366B16F6BB8272DCB3D075C5E6A655FA3234111B308ACF0385963D2F27AD19A39732
- MD5 SHA1 SHA512 SSDEEP TLSH