Analysis
- max time kernel
99s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.4MB
- Sample260930-c61s8a1dmd
- SHA256 1c85645f1ff46266cd12a657203a8c5d8d3c53c85c93bf9230cf93d22e5de120
- MD5 3d9c18736061d868d1f92f631b67dbe9
- SHA1 325094daa16c651d8cc5d0cd7064416796a6998d
- SHA512 1c05c3ac6afb836322da1bda6612cea0aa3d48177c0b6ba5472efffcfe59aaa4b9f4b54c1d669634a7314730692a6705d08eb52aa3e3c0ce0c965670a0966697
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkk:TID41qW1PszVZjF
- TLSH T12EF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 4108 patcher.exe 5912 720.#.exe 1036 787.#.exe 3292 948.#.exe 2692 69.#.exe 2772 440.#.exe 2580 942.#.exe 864 29.#.exe 4368 79.#.exe 1020 592.#.exe 3456 468.#.exe 4748 552.#.exe - Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 948.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 69.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 29.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 592.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 468.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 720.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 787.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 440.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 942.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 79.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 552.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 787.#.exe File opened for modification C:\Program Files\Internet Explorer\ 787.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 69.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\ 720.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 69.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\ 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 787.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 720.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\ 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\eu-ES\ 29.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 69.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ 720.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 948.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\ 942.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ 29.#.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ 720.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\ 440.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 69.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 720.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 787.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ka-GE\ 69.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\ 720.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 69.#.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 787.#.exe File opened for modification C:\Program Files\Common Files\System\ 720.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gd-GB\ 720.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 720.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 440.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 948.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 787.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 720.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\ 787.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\ 69.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\ 440.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 440.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ 720.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\ 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ka-GE\ 787.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 787.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\ 942.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ 440.#.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 440.#.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\ 440.#.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 720.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\ 440.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\ 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ 29.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 440.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pl-PL\ 592.#.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 787.#.exe File opened for modification C:\Windows\:\systemlog.bak 440.#.exe File opened for modification C:\Windows\:\systemlog.bak 592.#.exe File opened for modification C:\Windows\:\systemlog.bak 69.#.exe File opened for modification C:\Windows\:\systemlog.bak 942.#.exe File opened for modification C:\Windows\:\systemlog.bak 29.#.exe File opened for modification C:\Windows\:\systemlog.bak 468.#.exe File opened for modification C:\Windows\:\systemlog.bak 552.#.exe - System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 942.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 592.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 468.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 552.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 720.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948.#.exe - NTFS ADS 13 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 948.#.exe File opened for modification C:\Windows\:\systemlog.bak 69.#.exe File opened for modification C:\Windows\:\systemlog.bak 942.#.exe File opened for modification C:\Windows\:\systemlog.bak 29.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 79.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 720.#.exe File opened for modification C:\Windows\:\systemlog.bak 787.#.exe File opened for modification C:\Windows\:\systemlog.bak 440.#.exe File opened for modification C:\Windows\:\systemlog.bak 592.#.exe File opened for modification C:\Windows\:\systemlog.bak 468.#.exe File opened for modification C:\Windows\:\systemlog.bak 552.#.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 480 2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe 4108 patcher.exe 5912 720.#.exe 1036 787.#.exe 3292 948.#.exe 2692 69.#.exe 2772 440.#.exe 2580 942.#.exe 864 29.#.exe 4368 79.#.exe 1020 592.#.exe 3456 468.#.exe 4748 552.#.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 480 wrote to memory of 5912 480 2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe 91 PID 4108 wrote to memory of 1036 4108 patcher.exe 92 PID 5912 wrote to memory of 3292 5912 720.#.exe 93 PID 1036 wrote to memory of 2692 1036 787.#.exe 94 PID 2692 wrote to memory of 2772 2692 69.#.exe 95 PID 2772 wrote to memory of 2580 2772 440.#.exe 97 PID 2580 wrote to memory of 864 2580 942.#.exe 98 PID 3292 wrote to memory of 4368 3292 948.#.exe 99 PID 864 wrote to memory of 1020 864 29.#.exe 100 PID 1020 wrote to memory of 3456 1020 592.#.exe 101 PID 3456 wrote to memory of 4748 3456 468.#.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\720.#.exeC:\Users\Admin\AppData\Local\Temp\720.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\948.#.exeC:\Users\Admin\AppData\Local\Temp\948.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\79.#.exeC:\Users\Admin\AppData\Local\Temp\79.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\608.#.exeC:\Users\Admin\AppData\Local\Temp\608.#.exe5⤵PID:3044
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\905c0769f9a06c95a24ddf945\787.#.exeC:\905c0769f9a06c95a24ddf945\787.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\905c0769f9a06c95a24ddf945\69.#.exeC:\905c0769f9a06c95a24ddf945\69.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\905c0769f9a06c95a24ddf945\440.#.exeC:\905c0769f9a06c95a24ddf945\440.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\905c0769f9a06c95a24ddf945\942.#.exeC:\905c0769f9a06c95a24ddf945\942.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\905c0769f9a06c95a24ddf945\29.#.exeC:\905c0769f9a06c95a24ddf945\29.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\905c0769f9a06c95a24ddf945\592.#.exeC:\905c0769f9a06c95a24ddf945\592.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\905c0769f9a06c95a24ddf945\468.#.exeC:\905c0769f9a06c95a24ddf945\468.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\905c0769f9a06c95a24ddf945\552.#.exeC:\905c0769f9a06c95a24ddf945\552.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\905c0769f9a06c95a24ddf945\740.#.exeC:\905c0769f9a06c95a24ddf945\740.#.exe10⤵PID:3108
-
C:\905c0769f9a06c95a24ddf945\379.#.exeC:\905c0769f9a06c95a24ddf945\379.#.exe11⤵PID:1452
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.4MB
- SHA256 1c85645f1ff46266cd12a657203a8c5d8d3c53c85c93bf9230cf93d22e5de120
- MD5 3d9c18736061d868d1f92f631b67dbe9
- SHA1 325094daa16c651d8cc5d0cd7064416796a6998d
- SHA512 1c05c3ac6afb836322da1bda6612cea0aa3d48177c0b6ba5472efffcfe59aaa4b9f4b54c1d669634a7314730692a6705d08eb52aa3e3c0ce0c965670a0966697
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkk:TID41qW1PszVZjF
- TLSH T12EF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 3.4MB
- SHA256 5f9182c02d4b47fa0c00c5c33db40b0093e64fcc40f124353dd231b1a29c6f29
- MD5 afae41510d2cdeb7652579b08a9586d8
- SHA1 c68599a7e283b239d53babff557620819a2de999
- SHA512 3c9658004a2b0fbbe7a22ab9565865cbd3ef16a6523b7dde911afc09e84766d874dada1638cc5bba54023c4cb03cf0647ead2e287b3171cf6b953d8fb9317078
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkU:TID41qW1PszVZjH
- TLSH T1F0F58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
- Size 3.6MB
- SHA256 0bbee02e786423bf9ad2e1aac1f5a85397984c5b68ad80e77baf7d782ce7c0bd
- MD5 d20a443bfd00c64ca48683057b47e8d9
- SHA1 09986a5992f5943d057655b977af3ae57720d39e
- SHA512 242f3ff9e603b0809bdafe8de301c49ca103e0983c4fe60078c7e661a13cfa1bf4a2b500fa2603c21df22c2e4cfe64e651d75eb227f06351e8e546e6360300ca
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkDTeX:TID41qW1PszVZjiTQ
- TLSH T11C068D42B7D548B2E1B71231497752726F76B8210F34934F2398A66E6F337C0AE36762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.4MB
- SHA256 35df5595065dfe7cf57beb677fda72b4091677305fba2f969e328fafe06039e2
- MD5 b7b4130c30f8e425031de1c364490545
- SHA1 67ce66507df6576618cf0176b8ae4189556be124
- SHA512 3b94a6e3de3d0cdee0e45de08f2c28bcacff4865b91e0283d2d68a33b4534ad13402e03e2b5d5e1e527156b8769518a7c0968869acdaa0bc64df9ff3308e53c8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkJ:TID41qW1PszVZju
- TLSH T1EDF59D42B7D548B2E1B71231487752621F76B9150F34D38F2398A66E6F337C0AB367A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 3.5MB
- SHA256 534a76e0f279453aa0baf777142daec88d9d88e99d58fe18e99f8c769337eb1b
- MD5 06098b3c9000d4f704717395e082f5d9
- SHA1 8df3060dfdee6a3788af0463b7c99a3270cc29df
- SHA512 df1d8fab9c5f818d731fa263f817467a72e442cbec1e8d324b1bb30fffbae86ba3e5a858e10b96d270a77239ebea8a42f88f1aef698ee881469ff6d171c2d88d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkU:TID41qW1PszVZjj
- TLSH T128F58D42F7D548B2E1B71231487752621E76BD510F34928F2398B76E6F337C0AA367A2
- MD5 SHA1 SHA512 SSDEEP TLSH