Analysis
- max time kernel
96s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.8MB
- Sample260930-zkeeestscy
- SHA256 db3c60a37961eafe7097407c4f500f25f786dcb5e15bde436aac91cf63026451
- MD5 545d78d95f0a66f80bd598917231a34a
- SHA1 ae7b83d91132a6d7ea5801ee075f30eb4971fdb2
- SHA512 acce1962ad833d300bb814bcbe7c752464a0d4b562c7c36e79eaaf0d7c1f3e536d9a32c8a3b966f9dd9cae5c7ffa7263f98ce7557b7008db12d94a304705c1b8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYq:TID41qW1PszVZm6
- TLSH T10B068E52F7D48972E0B3123289B752965E7678111F34D28F2398667D6F337C0AA327A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5068 patcher.exe 3280 331.#.exe 1896 420.#.exe 2064 515.#.exe 1172 859.#.exe 2380 690.#.exe 4772 24.#.exe 4560 966.#.exe 5348 294.#.exe 4868 438.#.exe 4396 70.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 438.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 70.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 331.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 420.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 515.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 859.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 690.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 24.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 966.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 294.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\es-ES\ 859.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ 24.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\ 24.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 24.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 331.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 966.#.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\MSMAPI\1033\ 690.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\ 690.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\ 515.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ 331.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\ 331.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\ 24.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ 420.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ 515.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ 515.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 438.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\ 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 420.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 690.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ 690.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ 331.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 331.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ 420.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ 690.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\ 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ 24.#.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\ 859.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 438.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\ 420.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\ 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 859.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ 515.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\ 966.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\ 966.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 966.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\ 24.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\ 24.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 859.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\ 515.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\ 690.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 420.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 515.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 515.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\ 690.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 690.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ 515.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\ 690.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 24.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\ 438.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\ 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\ 690.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\ 24.#.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 690.#.exe File opened for modification C:\Windows\:\systemlog.bak 24.#.exe File opened for modification C:\Windows\:\systemlog.bak 966.#.exe File opened for modification C:\Windows\:\systemlog.bak 438.#.exe File opened for modification C:\Windows\:\systemlog.bak 70.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 420.#.exe File opened for modification C:\Windows\:\systemlog.bak 515.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 690.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 966.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 294.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 438.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 331.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 859.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70.#.exe - NTFS ADS 12 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 294.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 690.#.exe File opened for modification C:\Windows\:\systemlog.bak 438.#.exe File opened for modification C:\Windows\:\systemlog.bak 70.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 331.#.exe File opened for modification C:\Windows\:\systemlog.bak 420.#.exe File opened for modification C:\Windows\:\systemlog.bak 515.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 859.#.exe File opened for modification C:\Windows\:\systemlog.bak 24.#.exe File opened for modification C:\Windows\:\systemlog.bak 966.#.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2212 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe 5068 patcher.exe 3280 331.#.exe 1896 420.#.exe 2064 515.#.exe 1172 859.#.exe 2380 690.#.exe 4772 24.#.exe 4560 966.#.exe 5348 294.#.exe 4868 438.#.exe 4396 70.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3280 2212 2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe 92 PID 5068 wrote to memory of 1896 5068 patcher.exe 93 PID 1896 wrote to memory of 2064 1896 420.#.exe 94 PID 3280 wrote to memory of 1172 3280 331.#.exe 95 PID 2064 wrote to memory of 2380 2064 515.#.exe 96 PID 2380 wrote to memory of 4772 2380 690.#.exe 98 PID 4772 wrote to memory of 4560 4772 24.#.exe 99 PID 1172 wrote to memory of 5348 1172 859.#.exe 100 PID 4560 wrote to memory of 4868 4560 966.#.exe 101 PID 4868 wrote to memory of 4396 4868 438.#.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_545d78d95f0a66f80bd598917231a34a_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\331.#.exeC:\Users\Admin\AppData\Local\Temp\331.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\859.#.exeC:\Users\Admin\AppData\Local\Temp\859.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\294.#.exeC:\Users\Admin\AppData\Local\Temp\294.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5348
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\905c0769f9a06c95a24ddf945\420.#.exeC:\905c0769f9a06c95a24ddf945\420.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\905c0769f9a06c95a24ddf945\515.#.exeC:\905c0769f9a06c95a24ddf945\515.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\905c0769f9a06c95a24ddf945\690.#.exeC:\905c0769f9a06c95a24ddf945\690.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\905c0769f9a06c95a24ddf945\24.#.exeC:\905c0769f9a06c95a24ddf945\24.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\905c0769f9a06c95a24ddf945\966.#.exeC:\905c0769f9a06c95a24ddf945\966.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\905c0769f9a06c95a24ddf945\438.#.exeC:\905c0769f9a06c95a24ddf945\438.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\905c0769f9a06c95a24ddf945\70.#.exeC:\905c0769f9a06c95a24ddf945\70.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4396 -
C:\905c0769f9a06c95a24ddf945\121.#.exeC:\905c0769f9a06c95a24ddf945\121.#.exe9⤵PID:3348
-
C:\905c0769f9a06c95a24ddf945\376.#.exeC:\905c0769f9a06c95a24ddf945\376.#.exe10⤵PID:4348
-
C:\905c0769f9a06c95a24ddf945\672.#.exeC:\905c0769f9a06c95a24ddf945\672.#.exe11⤵PID:4440
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.8MB
- SHA256 db3c60a37961eafe7097407c4f500f25f786dcb5e15bde436aac91cf63026451
- MD5 545d78d95f0a66f80bd598917231a34a
- SHA1 ae7b83d91132a6d7ea5801ee075f30eb4971fdb2
- SHA512 acce1962ad833d300bb814bcbe7c752464a0d4b562c7c36e79eaaf0d7c1f3e536d9a32c8a3b966f9dd9cae5c7ffa7263f98ce7557b7008db12d94a304705c1b8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYq:TID41qW1PszVZm6
- TLSH T10B068E52F7D48972E0B3123289B752965E7678111F34D28F2398667D6F337C0AA327A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
- Size 3.8MB
- SHA256 7de98b8218b084518f2c99abadc8aeffe060bceca5efb646ff1d74f1aac551e9
- MD5 d56e4e4a4740441342494d478ccbd0ea
- SHA1 f411dee3a6df005d58a584ced41100b60f9c7bf4
- SHA512 b64104acba3dc06e3adbd386edc95451a78862aac564ef02a564fe58d105501bd60674fbb986eee17daa9f28974c343b8f01cc245ff0a700ca156bd4b5997c47
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYqs:TID41qW1PszVZm6p
- TLSH T15B068E52F7D48972E0B3123289B752965E7678111F34D28F2398667D6F337C0AB327A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
- Size 4.0MB
- SHA256 d7252a2b35d3acbf68543941158fb92349d569efc293cb238666a6575af0fda4
- MD5 b9953fecde2208208522f694cdfb806e
- SHA1 439b0ae4e511c9718c62ba7e28815d4b481d5f50
- SHA512 29defe001dacb5053db5bae9494dc83e85ba4fa1c23d7ac31e812b913cbb58cc8e5bcab102127984b340503d7cfad70abdecac485a32d813037e30ac20fbd15c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYqYTeX:TID41qW1PszVZm63TQ
- TLSH T1D4168E42B7E44972E0B3113189B756A25F76B8111F34D28F2398677D6F337C0AA367A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$
- Size 3.8MB
- SHA256 114d2b6531f315bd5174dd966a32252ede94e6888b4d483b8697a1afd2827dc6
- MD5 2e5afcf9db9e6e74e4b9d6a01f0cc846
- SHA1 47dca1febad0bc12c8ec06694f7fff89d6288666
- SHA512 1d2393ee12de71cb22774703d28e51601345a9477a67e8d9640568c168b55e269b0a0a7d0a9060c8c4ffe7389687525c078f56e6a9a9dda036fe3ebb668bf273
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYqX1:TID41qW1PszVZm60
- TLSH T1A2068E42F7E48972E0B3113289B756965E7678111F34D28F2398667D6F337C0AB327A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
- Size 4.2MB
- SHA256 3bf8fc2edade80b213b03764ed3361cb44ecc71ed9c416f3f4513c3b524ecd48
- MD5 c8b6695a6993f40acd87d027e1b69f51
- SHA1 9411a2f4604723c780256db43e2454d217f6e5ab
- SHA512 cefdd0fa72f001f5f8c5e07993ad7831d586de9d1c0d0be96e01a3d24e350b1f043a25431e52c002738a06b6fb4bd1d8ef9f50c1d00e24a82f7bcc17e36f5721
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYqlZkk:TID41qW1PszVZm6cF
- TLSH T177168E42F7D48972E1B31131897752A25F76B8111F34D38F2398A66E6F337C0AA36762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.8MB
- SHA256 8d2a1fb4db7ffd3e9a2b4db081763ad3ce8ba99b714696f5ae89bc38a9d262fa
- MD5 f455ca0bac8c19b9f80395b7a7fcd447
- SHA1 e14b2edf0011863b9312ab98d79ac63349408c79
- SHA512 bf04a70c90cb74d7e4781d3f091cf8012bb2edbdbcd55858878f854d346c11a03145c305cfb4435b884a03a6293669f006d6cdbd90ba94441e123961b3ea150f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYqk:TID41qW1PszVZm6t
- TLSH T1AB068E42F7E48972E0B3113289B756965E7678111F34D28F2398667D6F337C0AB327A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$
- Size 3.8MB
- SHA256 9837e85473a32d577ade6d37b817e4f2fee84432de270471f23d01f616b39970
- MD5 44aed69582f5e5f0efee265b97b20b26
- SHA1 a62282719cd4f46c5651f10c75b0905edb1bd5e0
- SHA512 721f066b8f19737fabcc498c444e6c8b9419b7aa7bb09aaa02bc49856ca4ba9a26b9f6172060fdf39fb1cd8f4d67c5f0c1ea7200e2ebf44c9f5e7d961403ce24
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglFXp9NpYqw+:TID41qW1PszVZm6u
- TLSH T12F068E42F7D48972E0B3123289B756965E7678111F34D28F2398667D6F337C0AB327A2
- MD5 SHA1 SHA512 SSDEEP TLSH