Analysis
- max time kernel
100s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
- Size 4.2MB
- Sample260702-2ejhasfx8y
- SHA256 778821b74bab7f56815ade948e58d7af87786d089c7979440795b1d63800fcbf
- MD5 cef2388fa9a511ae2db24c5029d5bbb4
- SHA1 965a676ebb4d9ff4390d52fcb6e370b9db36ecda
- SHA512 9d73cde1a7211a7cd87e76df7eb286ca2a9ad65ec95802b7fa968ad34dc4a4c06d5fd0f1dc76aa517393459c62e8519632ce87cbf06495707295ddb57009bd17
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgleW1PszNsQ0ReW4SkZP4sn:7ID41qW1PszV9W1PszSfkZc86
- TLSH T16E167D02F7A58272E0B39175C5A766A6BE7234011F3086CF1388A77D5F33BC19A3576A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 3060 patcher.exe 3832 513.#.exe 4716 175.#.exe 2708 687.#.exe 2084 948.#.exe 4824 282.#.exe 3044 966.#.exe 4680 298.#.exe 5364 4.#.exe 5224 96.#.exe - Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 513.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 687.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 4.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 96.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 175.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 948.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 282.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 966.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 298.#.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 175.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 948.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 282.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 966.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 298.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 175.#.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\ 282.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\ 966.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\ 966.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\ 948.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\ 513.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\ 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 282.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\ 513.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\ 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\ 948.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ 513.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\ 513.#.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 175.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\ 175.#.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\ 948.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 513.#.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\ 513.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 175.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 948.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 687.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\ 966.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 175.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 513.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 948.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\ 175.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ 282.#.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\ 513.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 513.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ 513.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\ 948.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ 282.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ 948.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\ 948.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\ 282.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hy-AM\ 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 175.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\ 282.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\ 513.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 175.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\ 513.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 175.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 966.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 687.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 298.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\ 282.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\ 948.#.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 175.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 513.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 175.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 687.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 298.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 966.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 953.#.exe - NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 513.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 687.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 96.#.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4636 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 3060 patcher.exe 3832 513.#.exe 4716 175.#.exe 2708 687.#.exe 2084 948.#.exe 4824 282.#.exe 3044 966.#.exe 4680 298.#.exe 5224 96.#.exe 5708 953.#.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4636 wrote to memory of 3832 4636 2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 90 PID 3060 wrote to memory of 4716 3060 patcher.exe 91 PID 3832 wrote to memory of 2708 3832 513.#.exe 92 PID 4716 wrote to memory of 2084 4716 175.#.exe 93 PID 2084 wrote to memory of 4824 2084 948.#.exe 95 PID 4824 wrote to memory of 3044 4824 282.#.exe 96 PID 3044 wrote to memory of 4680 3044 966.#.exe 97 PID 4680 wrote to memory of 5364 4680 298.#.exe 98 PID 2708 wrote to memory of 5224 2708 687.#.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_cef2388fa9a511ae2db24c5029d5bbb4_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\513.#.exeC:\Users\Admin\AppData\Local\Temp\513.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\687.#.exeC:\Users\Admin\AppData\Local\Temp\687.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\96.#.exeC:\Users\Admin\AppData\Local\Temp\96.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5224
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\905c0769f9a06c95a24ddf945\175.#.exeC:\905c0769f9a06c95a24ddf945\175.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\905c0769f9a06c95a24ddf945\948.#.exeC:\905c0769f9a06c95a24ddf945\948.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\905c0769f9a06c95a24ddf945\282.#.exeC:\905c0769f9a06c95a24ddf945\282.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\905c0769f9a06c95a24ddf945\966.#.exeC:\905c0769f9a06c95a24ddf945\966.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\905c0769f9a06c95a24ddf945\298.#.exeC:\905c0769f9a06c95a24ddf945\298.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\905c0769f9a06c95a24ddf945\4.#.exeC:\905c0769f9a06c95a24ddf945\4.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5364 -
C:\905c0769f9a06c95a24ddf945\953.#.exeC:\905c0769f9a06c95a24ddf945\953.#.exe8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5708 -
C:\905c0769f9a06c95a24ddf945\849.#.exeC:\905c0769f9a06c95a24ddf945\849.#.exe9⤵PID:4748
-
C:\905c0769f9a06c95a24ddf945\599.#.exeC:\905c0769f9a06c95a24ddf945\599.#.exe10⤵PID:4984
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.2MB
- SHA256 778821b74bab7f56815ade948e58d7af87786d089c7979440795b1d63800fcbf
- MD5 cef2388fa9a511ae2db24c5029d5bbb4
- SHA1 965a676ebb4d9ff4390d52fcb6e370b9db36ecda
- SHA512 9d73cde1a7211a7cd87e76df7eb286ca2a9ad65ec95802b7fa968ad34dc4a4c06d5fd0f1dc76aa517393459c62e8519632ce87cbf06495707295ddb57009bd17
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgleW1PszNsQ0ReW4SkZP4sn:7ID41qW1PszV9W1PszSfkZc86
- TLSH T16E167D02F7A58272E0B39175C5A766A6BE7234011F3086CF1388A77D5F33BC19A3576A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
- Size 4.4MB
- SHA256 976b10c866256afbd6e3019b0af9a2cdef19c83af14bcb70e5ff43a673b879bb
- MD5 69624b47c42386a3bd2a331060ddadde
- SHA1 81ebacbddfabfc2c7e92c581b8afbb433c6b341c
- SHA512 a13a5c6e8ea36e2156ed3599eda1a7c820966412b6a21977a1588557f0737a3e570d16e77efe2a62b0cd60a039e66478c07d9c6ef1c016ceb82d2be1a2454aa4
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgleW1PszNsQ0ReW4SkZP4sd:7ID41qW1PszV9W1PszSfkZc863TQ
- TLSH T131267D02F7A58272E0B39175C5A766A6BE7278011F3086CF1388A77D5F337C19A3572A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 4.2MB
- SHA256 2051df2b78d7b0e732e2efef25a7cc07f882b243f2a36097f8c2586875cc8398
- MD5 689df383a3a4536b436d96da09620ed8
- SHA1 c64c6df3fd191801fb017aec643d01c2a59e9008
- SHA512 8a7fca05473164b80844afe26cfc95d7146e85ecd27b3db5eaef750f68c36b3f00e9a36b7c299c6ef47f1bb2b4a285cd9b1918dabc9ad769587c0cb9dc59fbf2
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgleW1PszNsQ0ReW4SkZP4sF:7ID41qW1PszV9W1PszSfkZc860
- TLSH T1F6167D02F7A58272E0B39175C5A766A6BE7234011F3086CF1388A77D5F33BC19A3576A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$
- Size 4.2MB
- SHA256 d5ef1e5f479809aadc38536fa045b132dbe10302c5738bb1ee9aa88cbb310956
- MD5 43e43659af0a4b7c673c42da5d93171d
- SHA1 a1cfd8da0ed111380e3effc16cc010ee1182cc3d
- SHA512 b3e1a14156dd446fa48fbeace24cd58896153d5f31d148a0b5ffcb1f7548c9f4d8a0a3ff948a5614117645f42f3372bc1fc166d62a36078b9ff0cbf9d9dd4499
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgleW1PszNsQ0ReW4SkZP4s+:7ID41qW1PszV9W1PszSfkZc86b
- TLSH T1AF167D02F7A58272E0B39175C5A766A6BE7234011F3086CF1388A77D5F33BC19A3576A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$
- Size 4.8MB
- SHA256 0225086aedecf9c41a1827653752371f9bf720df0a6f049b388d3599a1d36e7e
- MD5 20959e96116f2c7ed45a41f8d168a743
- SHA1 dcc459f03a27750e05b3c4156b483b781e609ebe
- SHA512 9a300d0aa845f7f6841cee8576d0e69b07fe9816200b4ee7243f13fad5da34e449f4aa4f15b07404bfdc4d5b8f1dc73cde6c49e6337c6de21f29f4a3475a5412
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgleW1PszNsQ0ReW4SkZP4sH:7ID41qW1PszV9W1PszSfkZc86vxGX
- TLSH T1C1367D02F7A58272E0B39175C5A766A6FE7278011B3086CF1388E67D1F337D19A3572A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$
- Size 5.0MB
- SHA256 d044fc9dda965819c4df0bf164c1a0f52dac2d77d6a7a4010b2bf7a6c04a20b6
- MD5 608b1e78d41d96fc1feb41d2a8b9e0ea
- SHA1 82645d8c4ba7c067361cb2eed3413243debe3c02
- SHA512 8cd5710008d4f77c64d2f6f4dcd7d6bab8b8098ce8f21e71c7957b33d62a9b223504630a9f5112667c5e927419f862e4c3e722c27d463cd9dce5b8049448742b
- SSDEEP 98304:7ID41qW1PszV9W1PszSfkZc86AMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMU:7uqxsCxsYP86j
- TLSH T116366C42F7A58272E0B35171C5A766A6AE727C011F3086CF1388B76D5F337C19A3672A
- MD5 SHA1 SHA512 SSDEEP TLSH