Analysis
- max time kernel
139s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 4.1MB
- Sample260809-m6fs6azthy
- SHA256 1b34329999aff5a7b692da0d8e60acc94e029437c3561bdd4757ba8290dace0c
- MD5 a6690e3497873df52433e2dae4816cc8
- SHA1 4fd3ae178fcd0e05403c553ea4517feb10949b9d
- SHA512 a1909783f027999c41c31bc9c95d9f5d19828b07218465a11895eeda267edba858f62bdfe149bc2931e26ff53ff7ad156751a599f831e43b950aaffe58cb61c5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGm:TID41qM5ram6m5FPXrt
- TLSH T1E6164B05B7E445B1E077827589A6819AAE727C114F229BCF1340AAAD7F737C0EE35732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 4116 patcher.exe 4604 310.#.exe 1924 219.#.exe 3388 12.#.exe 5044 370.#.exe 1852 382.#.exe 1360 782.#.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 219.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 12.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 370.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 382.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 782.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 310.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ 310.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\QUERIES\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\ 310.#.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ 12.#.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\58248C09-15BE-4337-AB1C-49385175A673\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 12.#.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\ 310.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ 370.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\ 370.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\ 310.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\ 219.#.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 12.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\ 370.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 12.#.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 12.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\ 310.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\ 12.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\ 310.#.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 12.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\ 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 370.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 370.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ 310.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\ patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 310.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 12.#.exe File opened for modification C:\Program Files\Google\ 310.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ 310.#.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 12.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 219.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\ 310.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ 370.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\ 12.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ 219.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\ 310.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\ patcher.exe File opened for modification C:\Program Files\dotnet\swidtag\ 370.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ 370.#.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\ 370.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 12.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ 370.#.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 219.#.exe File opened for modification C:\Windows\:\systemlog.bak 12.#.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 310.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 382.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 782.#.exe - NTFS ADS 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 310.#.exe File opened for modification C:\Windows\:\systemlog.bak 219.#.exe File opened for modification C:\Windows\:\systemlog.bak 12.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 370.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 382.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 782.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4536 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 4116 patcher.exe 4604 310.#.exe 1924 219.#.exe 3388 12.#.exe 5044 370.#.exe 1852 382.#.exe 1360 782.#.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4536 wrote to memory of 4604 4536 2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 91 PID 4116 wrote to memory of 1924 4116 patcher.exe 92 PID 1924 wrote to memory of 3388 1924 219.#.exe 93 PID 4604 wrote to memory of 5044 4604 310.#.exe 94 PID 5044 wrote to memory of 1852 5044 370.#.exe 96 PID 1852 wrote to memory of 1360 1852 382.#.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a6690e3497873df52433e2dae4816cc8_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\310.#.exeC:\Users\Admin\AppData\Local\Temp\310.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\370.#.exeC:\Users\Admin\AppData\Local\Temp\370.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\382.#.exeC:\Users\Admin\AppData\Local\Temp\382.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\782.#.exeC:\Users\Admin\AppData\Local\Temp\782.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\905c0769f9a06c95a24ddf945\219.#.exeC:\905c0769f9a06c95a24ddf945\219.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\905c0769f9a06c95a24ddf945\12.#.exeC:\905c0769f9a06c95a24ddf945\12.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3388
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.1MB
- SHA256 1b34329999aff5a7b692da0d8e60acc94e029437c3561bdd4757ba8290dace0c
- MD5 a6690e3497873df52433e2dae4816cc8
- SHA1 4fd3ae178fcd0e05403c553ea4517feb10949b9d
- SHA512 a1909783f027999c41c31bc9c95d9f5d19828b07218465a11895eeda267edba858f62bdfe149bc2931e26ff53ff7ad156751a599f831e43b950aaffe58cb61c5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGm:TID41qM5ram6m5FPXrt
- TLSH T1E6164B05B7E445B1E077827589A6819AAE727C114F229BCF1340AAAD7F737C0EE35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 4.1MB
- SHA256 e1f1c1b75d008e27a7a103d0442e8a85bd6df4f90becbcfd9300e905af008a5f
- MD5 3819d44f43c274986cb593484d5dfce3
- SHA1 f4c48599d7627011061f84a010549cab51306280
- SHA512 6165b0adf2a4c180662f88f38a9d7c01f265a8024c6dd19b3cddb4d05a7c7875217c4b2a20d35608dcee3f7b1145e415389a45a028ebe3305a795dec6d27aab3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGmo:TID41qM5ram6m5FPXrto
- TLSH T15C164B05B7E445B1E177827589A6819AAE727C114F228BCF1340AAAD7F737C0EE35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$
- Size 4.3MB
- SHA256 533cfab5b6751d39ddcda780c9f1e02ff1d00a1dbaff3b85858f3dff4bcbebcb
- MD5 8523d3f9fcfb4e928fee52bdc95f8a09
- SHA1 b20d74889b5c20c109f6a20f945bef0d6b84f31a
- SHA512 bdeb56dd2d0cfff371d52d8e54dbdd7958b1a02b78de06a0e6a950fab989b4728880a11030fed6f79c330817a7cbcf8541d7d4460cdcda5ce19c3b50fffb6ec2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGmZC17Ia:TID41qM5ram6m5FPXrti7IwZ
- TLSH T158264C45B7E445B1E177827589A2825AEE727C114F228BCF1340AAAD7F737C0AE35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 4.2MB
- SHA256 631b0630bccb8e93229ad794f2e33a299e50d1949e31d0302235b16f24d621b5
- MD5 ba76e29a57f0d9c47baa98f3bb28fc11
- SHA1 62d3525c641561484a333ad1f8f28bb17ad5d52d
- SHA512 16fb886d4dcbbffaf78154e54350f8ac6df14990482c4deb3b0a512742d4ffb4a065527e7f6716eb23ab48b8889e2a45ec43eddaefa4e615305a6954ece431c4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGmK:TID41qM5ram6m5FPXrtK
- TLSH T12F164B45B7E445B1E177827189A68296AE327C114F228BDF1340BAAD7F737C0AE35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 4.6MB
- SHA256 63d47598ab7703f70501bdd0a7fd70a500421d75f08669bda4da1dc06e9dc966
- MD5 ca494d328cd302128985c5274c6e64e0
- SHA1 0d391dd4f269895a275fec1070ce8edf6eb69d68
- SHA512 dfbb91e40c4761dd63375da8bcaa56ce6bb943d21743425b7e439e0445bd68455d4ae36517ca53e4fcbfadfc4b3387067a8319982d2ceb684778b3f0f76e5e5d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGmjUOlkQ:TID41qM5ram6m5FPXrtF9
- TLSH T1B8265B15B7E445B1D177827489A28296EE327C114F229BCF1350AAAD7F737C0AE35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.1MB
- SHA256 a21bfaf3c30ed6e2c600c7ade9725e1d82595c5173f2991a8d1a1844e3e1fbe0
- MD5 57c28fc56fa379c638395b041d00c1a3
- SHA1 8ad1058bb02b90884ce86ad59d4da7346e9d6b77
- SHA512 afcd3ae6360a0f320841dc916531a6e752137e00557fa5def7fdab664963ce04c3625e9d16ad75e46260b9b4c5dcda15c2009a1a6a23df5fc2bb1a2be774c4cd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGm0:TID41qM5ram6m5FPXrt0
- TLSH T17A164B45B7E445B1E077827589A6819AAE327C114F229BCF1340AAAD7F737C0EE35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$
- Size 4.5MB
- SHA256 84ff1249e8571b2d0808fc753beef8f2e10314d5a79a8679644ff2d8d2b52d97
- MD5 2c1af05fc4303ee82a6db59ced8879a3
- SHA1 a6153622d33ad7786c4d4b2c6f9689251949b7d1
- SHA512 ab5d227ba2c56f6f9fe8ea81914d2ec08c46a626de74b97d66d0b9a1ebee521e5d9e8cbd6362d1ab348c4ddacd6dc31749c7edacc1022fa4c64d3f564a099e14
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GkP3a56rGmx1lkWr:TID41qM5ram6m5FPXrtx1lkNa
- TLSH T18A263A45B7E445B5E173827089B6825AAE727C114F228BCF1350AAAD6F737C0EE35732
- MD5 SHA1 SHA512 SSDEEP TLSH