Analysis
- max time kernel
95s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 14:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 3.1MB
- Sample260929-rkt6wasake
- SHA256 afe9405cede3585beb27b4419d047f176bff9f1ed7c18f5c438be12dd67ee269
- MD5 ecfc07fb2578995356b9e162f660914b
- SHA1 dcb4a769c52866331144e9c31ed2a7f88ff25ed1
- SHA512 63c5c19211e45e3f17b07aef146415bb7d4c066604410ff25a6e18a5392f9a04d1f5d98215688d3491afede93bd6bd7df375dabb6b9193ac9bc2e822de71a26d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sv:TID41qW1PszVZX5Q
- TLSH T1D6E59D42B7D54963E1771232487752A21E72B9210F34E28F2398766D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5648 patcher.exe 4104 991.#.exe 5380 236.#.exe 4312 915.#.exe 2360 565.#.exe 5528 451.#.exe 2848 401.#.exe 4092 151.#.exe 5696 535.#.exe 4644 368.#.exe 4776 772.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 236.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 565.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 451.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 401.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 535.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 368.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 772.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 991.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 915.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 151.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 236.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 565.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pa-IN\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 991.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 151.#.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\ 151.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pl-PL\ 991.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ 565.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 236.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\ patcher.exe File opened for modification C:\Program Files\7-Zip\Lang\ 151.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 565.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 236.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ 451.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\ 451.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLSTART\ 991.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ 991.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\ 565.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 451.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\ 401.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 236.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ 401.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 236.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ 991.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\ 565.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\ 236.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ 151.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 236.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 991.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 451.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 401.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\ 991.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\ 401.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lo-LA\ 991.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ka-GE\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ 401.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 236.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\ 236.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 565.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 151.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 565.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\ 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ 565.#.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 368.#.exe File opened for modification C:\Windows\:\systemlog.bak 772.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 236.#.exe File opened for modification C:\Windows\:\systemlog.bak 565.#.exe File opened for modification C:\Windows\:\systemlog.bak 451.#.exe File opened for modification C:\Windows\:\systemlog.bak 401.#.exe File opened for modification C:\Windows\:\systemlog.bak 151.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 991.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 368.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 236.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535.#.exe - NTFS ADS 12 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 368.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak 236.#.exe File opened for modification C:\Windows\:\systemlog.bak 565.#.exe File opened for modification C:\Windows\:\systemlog.bak 772.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 991.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 915.#.exe File opened for modification C:\Windows\:\systemlog.bak 451.#.exe File opened for modification C:\Windows\:\systemlog.bak 401.#.exe File opened for modification C:\Windows\:\systemlog.bak 151.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 535.#.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4156 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 5648 patcher.exe 4104 991.#.exe 5380 236.#.exe 4312 915.#.exe 2360 565.#.exe 5528 451.#.exe 2848 401.#.exe 4092 151.#.exe 5696 535.#.exe 4644 368.#.exe 4776 772.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4156 wrote to memory of 4104 4156 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 91 PID 5648 wrote to memory of 5380 5648 patcher.exe 92 PID 4104 wrote to memory of 4312 4104 991.#.exe 93 PID 5380 wrote to memory of 2360 5380 236.#.exe 94 PID 2360 wrote to memory of 5528 2360 565.#.exe 95 PID 5528 wrote to memory of 2848 5528 451.#.exe 97 PID 2848 wrote to memory of 4092 2848 401.#.exe 98 PID 4312 wrote to memory of 5696 4312 915.#.exe 99 PID 4092 wrote to memory of 4644 4092 151.#.exe 100 PID 4644 wrote to memory of 4776 4644 368.#.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\991.#.exeC:\Users\Admin\AppData\Local\Temp\991.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\915.#.exeC:\Users\Admin\AppData\Local\Temp\915.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\535.#.exeC:\Users\Admin\AppData\Local\Temp\535.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5696
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\905c0769f9a06c95a24ddf945\236.#.exeC:\905c0769f9a06c95a24ddf945\236.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\905c0769f9a06c95a24ddf945\565.#.exeC:\905c0769f9a06c95a24ddf945\565.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\905c0769f9a06c95a24ddf945\451.#.exeC:\905c0769f9a06c95a24ddf945\451.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\905c0769f9a06c95a24ddf945\401.#.exeC:\905c0769f9a06c95a24ddf945\401.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\905c0769f9a06c95a24ddf945\151.#.exeC:\905c0769f9a06c95a24ddf945\151.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\905c0769f9a06c95a24ddf945\368.#.exeC:\905c0769f9a06c95a24ddf945\368.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\905c0769f9a06c95a24ddf945\772.#.exeC:\905c0769f9a06c95a24ddf945\772.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4776 -
C:\905c0769f9a06c95a24ddf945\726.#.exeC:\905c0769f9a06c95a24ddf945\726.#.exe9⤵PID:2768
-
C:\905c0769f9a06c95a24ddf945\861.#.exeC:\905c0769f9a06c95a24ddf945\861.#.exe10⤵PID:5896
-
C:\905c0769f9a06c95a24ddf945\231.#.exeC:\905c0769f9a06c95a24ddf945\231.#.exe11⤵PID:5024
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 afe9405cede3585beb27b4419d047f176bff9f1ed7c18f5c438be12dd67ee269
- MD5 ecfc07fb2578995356b9e162f660914b
- SHA1 dcb4a769c52866331144e9c31ed2a7f88ff25ed1
- SHA512 63c5c19211e45e3f17b07aef146415bb7d4c066604410ff25a6e18a5392f9a04d1f5d98215688d3491afede93bd6bd7df375dabb6b9193ac9bc2e822de71a26d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sv:TID41qW1PszVZX5Q
- TLSH T1D6E59D42B7D54963E1771232487752A21E72B9210F34E28F2398766D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$
- Size 3.1MB
- SHA256 2042a37177af68d97072f4a0aec8965779164007ffec2a841493d4d714089da5
- MD5 98e9892966faf410daca289995037ead
- SHA1 3d4fa9794ad98100c2ca10dac705dd06981469ad
- SHA512 d0e74e6194177f2fbbfcccdfbc1e22fa455fd27974fa311b481054002e48f34484017ba3fc8c243562a3ecc1303705875b9e39665452a5f6125bb8617157e578
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5SX:TID41qW1PszVZX5a
- TLSH T167E59D52B7D54863E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 3.1MB
- SHA256 b4e2b14b913491e03d22600dedb16afbf49321d6b40af86a279a29c4e465b09c
- MD5 e88f8652537f5dd18114f06348f31572
- SHA1 9b480c1dfdf67aa4c12c1806f3a1f76a923d7888
- SHA512 4c2d71ebf641f1ce2d0e4f5adda5644cc3f8987f9e87e66e68696b976136f2a08edd4560973fea5c41b8b2123bfa9a9669dc17959082a71edc33a5bcea808615
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5S+:TID41qW1PszVZX5L
- TLSH T1F8E59D42B7D54963E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
- Size 3.1MB
- SHA256 71ee4303490c4febfcacf90c970685c2ee1fcc3eba9b78a1bb92b2658dcbd3de
- MD5 77dbca57a48528558ec5048974253856
- SHA1 6457a7b78399136b888f9f7be21f59ed4dd1e915
- SHA512 ed40af7964834d32650a87aab589b1e12898485b8eb186497e31d8431f7c47f9f0aed83f061113c1831bb0075ef28ee884ea9d9f992bff3447c6fec7e363a567
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5SI:TID41qW1PszVZX5N
- TLSH T134E59D42B7D54963E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 3.1MB
- SHA256 a68a4c359f9cfaa65a1ef88163851caf751e7060e3bf3d312c414aa459179849
- MD5 f01e931ac45a2879e701cade0b2a29dd
- SHA1 aca2d9a8392527cb680554e57dc7ce574df9895f
- SHA512 7939c9e746a61d5c1160698171f1c8bc9588af5cca7bd0c832597003ed949ec2ff7962feb50a5272beb69da1b40132327cc78ee8d6f2c10242a578952713887b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sy:TID41qW1PszVZX5b
- TLSH T191E59D52B7D54863E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$
- Size 3.1MB
- SHA256 47349a2766fb18c4264ec32954e20339bd48931c302270254469af7789c0f0e2
- MD5 58c0f195521d0d4e6711ab690e9fc7d9
- SHA1 302007fcb3f255486117bb7076be647ee37b2922
- SHA512 5971ae44ffb3a0be19398efa2778decf727ff2d7c12551a0f674bad6d0dbe348e60f7230df9fc221b9fe7cb4c8f3ddf84b7f24295eba8307a54390e83dde352c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Si:TID41qW1PszVZX5X
- TLSH T191E59D52B7D54863E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 3.5MB
- SHA256 437975680e082719f5f26e183003605fe6bbb196c1a073d5010757a97adea54d
- MD5 90b04ce7209bf6b59bf60df6fd2d3ed1
- SHA1 62fc3e35c66726426bfad1e414da7faa22f77379
- SHA512 490dd8ce871cb761ef50f49573515b6d985cbddebc415927c4dd76f2f30c5e7e3b75d7d89ac5ae0dee59994149e4a422f91cc8fa170ec00d60377c886fc68526
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5SbUOlk09:TID41qW1PszVZX5W9
- TLSH T151068E52BBD588A2D1771231497792921E727C210F34D38F2398A66E5F337C0AB37B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
- Size 3.3MB
- SHA256 5b64daaf90302d1e572c0b430c18e77d7125fec6f4c85f92df7c434a01e13561
- MD5 57092aff3ccb3bb5c802f0974ef8ed52
- SHA1 deed364f6d94691119b260b9b9b040f39c37edf0
- SHA512 21e7941db95559db4cd33d9b0a266e5040a920474cd8b63bd0cfaddc414a9471c311f9bbbb454bbc905285eb1a3999f06734ef130f3afc2e177f3271070133c2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5SgTeX:TID41qW1PszVZX5HTQ
- TLSH T19EF58E52B7D54863E1771231487792A22F72B9210F34D38F2398A66E5F337C0AB36796
- MD5 SHA1 SHA512 SSDEEP TLSH