Analysis
- max time kernel
105s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:32
Behavioral task
behavioral1
Sample
2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.4MB
- Sample260707-e585bahy5z
- SHA256 7e5e5df15b90a4d47af02cc1883176f14da30797f413dd3340c43c5a3c24b38e
- MD5 31dbbb54fce66abd5a5187ea6266e010
- SHA1 06e3daf2f68987e19de0d8a2bc7bbcf7e23f6a32
- SHA512 8ae539f91b7dbb8fa6075b35af0025238df10ef17dba2fc57aa9f12ca8c26d843c7e87c55cde6190585068b2a0f774c27bf4bc070a1cb6f1c247332f1b758cdd
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0ya:A3k03kHRJr7fkZc41lkNa
- TLSH T187B53A12F6B84B66E0B7C174C9E6A656FA323C525F3086CF03549B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1372-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6fc-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1372-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2504-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b94-713.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001acb1-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b93c-1425.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e0000000188c4-1422.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b6fc-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019b94-713.dat aspack_v212_v242 behavioral2/files/0x000300000001acb1-942.dat aspack_v212_v242 behavioral2/files/0x000200000001b93c-1425.dat aspack_v212_v242 behavioral2/files/0x000e0000000188c4-1422.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2504 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe - Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1372 2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 2504 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_31dbbb54fce66abd5a5187ea6266e010_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1372
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 7e5e5df15b90a4d47af02cc1883176f14da30797f413dd3340c43c5a3c24b38e
- MD5 31dbbb54fce66abd5a5187ea6266e010
- SHA1 06e3daf2f68987e19de0d8a2bc7bbcf7e23f6a32
- SHA512 8ae539f91b7dbb8fa6075b35af0025238df10ef17dba2fc57aa9f12ca8c26d843c7e87c55cde6190585068b2a0f774c27bf4bc070a1cb6f1c247332f1b758cdd
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0ya:A3k03kHRJr7fkZc41lkNa
- TLSH T187B53A12F6B84B66E0B7C174C9E6A656FA323C525F3086CF03549B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- Size 2.6MB
- SHA256 090c520520a7a047b18c742d4d43035df8028d7193d07d4db267c9f3321a403e
- MD5 11c10cd56eeef0b6d5d485f7e4031849
- SHA1 6854b8b4e2f4c30acc1defa57d60b189e647b47b
- SHA512 e2005564d7b9aa5da59e2560a70a6e1d3686221c2dfdfd1907675653bf0f9aa968aee9f9e89210fd2d6295ea5aa30bfa3935182c1e136d4cf1de146977cf4858
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0yJeS3:A3k03kHRJr7fkZc41lkNUI
- TLSH T188D54B12B6B84B66E0B7C175C9E6A65AFA323C511F3087CF13549B1C2E33AC19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- Size 2.8MB
- SHA256 655c778732598815ad4aeeb06f740ef438f23fd897376adf00078bc6ef4efdbe
- MD5 a2fe66ffbb949b8fdba0e8f45051b5ea
- SHA1 960c594b063e4fd4c552eda94972cbac8ab969fa
- SHA512 42dc68c8eef795d58de31d14bf90e7d912e28dc27a4d1d111de2c05d6960415b6c52f191a61ded1e79f579e2cb966f45264e2f4394c1406980c9725fb49941ae
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0yi0Ia:A3k03kHRJr7fkZc41lkNPI
- TLSH T12BD54A12F6B84762E0BBC174C9A69656FA323C524F3087CF13549B1D2E33BD19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 ef33993d1a53b5242aec82119baac3fc012a0f01ba8e9d7e2af5e595813148d1
- MD5 9f59ac4b0db1bb2bffafebb233b256fb
- SHA1 64d9e29932a2dc301ac7bc34a1c78798cdfacff4
- SHA512 1d76233b65ee19c3e6edf62c6a5309596d2335fc56f11ad6da2e3c70a7ab0843401c653929c7d2884363eefd31de5bf3e890812a9ecf7fd36c105be014fff8d7
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0yqPji0Aj:A3k03kHRJr7fkZc41lkNgjo
- TLSH T13BE53B16F6B84762E0B7C175C9E6A65AFA323C411F3086CF03459B2C2E27BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 2.4MB
- SHA256 7e47ac455098ddb9523c3567df0418d041e3bd436b3aba1e16d04b5fbc71f5ef
- MD5 c6040d83dd22f80ec75c580c9390b6cb
- SHA1 51ccf53f2e1fc2b307bbaab253b337c702b81c26
- SHA512 440ed456158d492206f8aee2d8c5a5dae10d00bca0e357f26867598dacd980746e5ba35973c7a0fbccba64512b0e49f65920198ce80ce976710a5c8901ee361f
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0ym:A3k03kHRJr7fkZc41lkNm
- TLSH T1CFC53A12F6B84B66E0B7C174C9E6A656FA323C525F3086CF03549B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE
- Size 3.0MB
- SHA256 ca1f483716456293d2b95ba024756db295df251ffd77ca63ffd8004420e35fe5
- MD5 ab0dbfc2300e1c21c20f306269ce85c4
- SHA1 14bd755d35b0f15afbc0a3bf3a48e05225ad7388
- SHA512 5053bf22143b3a8a5ded4ebf61499db5fd7cb1932171e3726a6d00f4b342513d05cd290e8d6db77bf4b2414fcb116363b8efc280ca5518461545613e26b1edfc
- SSDEEP 49152:A3k03kHRJ656rbeW4SkZP4sz9Mb41lkWu0ylIWmKmd7DAS0S:A3k03kHRJr7fkZc41lkNlxGX
- TLSH T1DBE54B12B2B84766E0BBC174C9A69656FA727C451F3087CF0354EA1D2F33AD19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH