Analysis
- max time kernel
100s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.6MB
- Sample260930-b6bnnaswet
- SHA256 5f253e41b9ba3fde38211e74bdcbed5cc0436b5535bc5f4799cb3853b6da4824
- MD5 4b041cdaab552c7c456edecd195e0863
- SHA1 7df9d2e59942a86a5ac09f87fbb0751a01679d68
- SHA512 a3df4ecc5610e4e0565cfd0df65660808104c8f7130b050266ede090c3f6e8426895bef5ba77cb3f2a97d2e7e0eaa2d916dc0398564e255dad066f360e937745
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYq:TID41qW1PszVZLq6
- TLSH T1A6067C42B7E58972E0770232897752925F7278150F35E28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3940 patcher.exe 4356 634.#.exe 4308 315.#.exe 3264 163.#.exe 5160 824.#.exe 2408 645.#.exe 4264 8.#.exe 2316 311.#.exe 5788 978.#.exe 2396 453.#.exe 2828 854.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 978.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 453.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 854.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 163.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 824.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 645.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 311.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 634.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 315.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 8.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ 315.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 315.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mt-MT\ 8.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 8.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 315.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ patcher.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 315.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 315.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\ 315.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\vi-VN\ 634.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ 163.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\ 315.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 311.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\ 315.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ 315.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\ 315.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ 824.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ 315.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ 634.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\ 315.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\ 645.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\ 8.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\ 311.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\ 311.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 645.#.exe File opened for modification C:\Program Files\Common Files\System\it-IT\ 315.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ 315.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-PT\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lo-LA\ patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ 315.#.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 824.#.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 645.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ 8.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 645.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\ 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 8.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 645.#.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 854.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 315.#.exe File opened for modification C:\Windows\:\systemlog.bak 824.#.exe File opened for modification C:\Windows\:\systemlog.bak 645.#.exe File opened for modification C:\Windows\:\systemlog.bak 8.#.exe File opened for modification C:\Windows\:\systemlog.bak 311.#.exe File opened for modification C:\Windows\:\systemlog.bak 978.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 163.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 645.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 453.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 634.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 311.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 978.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315.#.exe - NTFS ADS 12 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 854.#.exe File opened for modification C:\Windows\:\systemlog.bak 315.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 163.#.exe File opened for modification C:\Windows\:\systemlog.bak 824.#.exe File opened for modification C:\Windows\:\systemlog.bak 8.#.exe File opened for modification C:\Windows\:\systemlog.bak 311.#.exe File opened for modification C:\Windows\:\systemlog.bak 978.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 634.#.exe File opened for modification C:\Windows\:\systemlog.bak 645.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 453.#.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2540 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe 3940 patcher.exe 4356 634.#.exe 4308 315.#.exe 3264 163.#.exe 5160 824.#.exe 2408 645.#.exe 4264 8.#.exe 2316 311.#.exe 5788 978.#.exe 2396 453.#.exe 2828 854.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2540 wrote to memory of 4356 2540 2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe 92 PID 3940 wrote to memory of 4308 3940 patcher.exe 93 PID 4356 wrote to memory of 3264 4356 634.#.exe 94 PID 4308 wrote to memory of 5160 4308 315.#.exe 95 PID 5160 wrote to memory of 2408 5160 824.#.exe 96 PID 2408 wrote to memory of 4264 2408 645.#.exe 97 PID 4264 wrote to memory of 2316 4264 8.#.exe 98 PID 2316 wrote to memory of 5788 2316 311.#.exe 99 PID 3264 wrote to memory of 2396 3264 163.#.exe 100 PID 5788 wrote to memory of 2828 5788 978.#.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_4b041cdaab552c7c456edecd195e0863_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\634.#.exeC:\Users\Admin\AppData\Local\Temp\634.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\163.#.exeC:\Users\Admin\AppData\Local\Temp\163.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\453.#.exeC:\Users\Admin\AppData\Local\Temp\453.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\905c0769f9a06c95a24ddf945\315.#.exeC:\905c0769f9a06c95a24ddf945\315.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\905c0769f9a06c95a24ddf945\824.#.exeC:\905c0769f9a06c95a24ddf945\824.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\905c0769f9a06c95a24ddf945\645.#.exeC:\905c0769f9a06c95a24ddf945\645.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\905c0769f9a06c95a24ddf945\8.#.exeC:\905c0769f9a06c95a24ddf945\8.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\905c0769f9a06c95a24ddf945\311.#.exeC:\905c0769f9a06c95a24ddf945\311.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\905c0769f9a06c95a24ddf945\978.#.exeC:\905c0769f9a06c95a24ddf945\978.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\905c0769f9a06c95a24ddf945\854.#.exeC:\905c0769f9a06c95a24ddf945\854.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\905c0769f9a06c95a24ddf945\895.#.exeC:\905c0769f9a06c95a24ddf945\895.#.exe9⤵PID:4176
-
C:\905c0769f9a06c95a24ddf945\897.#.exeC:\905c0769f9a06c95a24ddf945\897.#.exe10⤵PID:5112
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.6MB
- SHA256 5f253e41b9ba3fde38211e74bdcbed5cc0436b5535bc5f4799cb3853b6da4824
- MD5 4b041cdaab552c7c456edecd195e0863
- SHA1 7df9d2e59942a86a5ac09f87fbb0751a01679d68
- SHA512 a3df4ecc5610e4e0565cfd0df65660808104c8f7130b050266ede090c3f6e8426895bef5ba77cb3f2a97d2e7e0eaa2d916dc0398564e255dad066f360e937745
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYq:TID41qW1PszVZLq6
- TLSH T1A6067C42B7E58972E0770232897752925F7278150F35E28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 3.7MB
- SHA256 d83b5ea1e62de2f34f8de88fe429a9902c96c291530abbfa245d27b0225df7a0
- MD5 7ce632f38947e8f606d895845c01532c
- SHA1 9a7acc530bf507a4017834398a5a04a1f7bb707a
- SHA512 762a87562f81618e8dae9d45b27f2893cfac1a1eb978818a802bd80d195766229f2097f175b4add852af323656100b6f66672864dd156b9f4e862e00ce3c006f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqk:TID41qW1PszVZLq6F
- TLSH T1D5065C42F7D58962E07B0132CA6752926E7378110F75928F23D8A67D5F337C0AA727A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe$
- Size 3.6MB
- SHA256 4da3dc6b1418d2d96f6af35bd3f023467c2c3cb2e6d8308d90d68c3f7bd0a0a6
- MD5 1eb89284f91c9634cd78bacf8174be7d
- SHA1 c4d55142abab0273be88e64516fa95b55180c992
- SHA512 b838576943edda891f555f1d2f7b07c83ea83dbb0fb6e2b09d9c03ad82f15a24b7a1df805c8b238b5f8ed036ccac91b9cf1f8825976e451719572ac06939823d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqz:TID41qW1PszVZLq62
- TLSH T16F067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 3.6MB
- SHA256 e4e6c708ad19b7f0a0f18b382b527b0b35368fcafa445e31bc8223a107bdcab2
- MD5 cd09d4342b0ba09365d9eb3666e07141
- SHA1 798caab187022affae8bb68907e99730fbd55a91
- SHA512 665c3e2b7d49a5c07be9eaffbe47044e8ff9b8f600c2ba78df43695dc65057fe99edc7a162c7f66bb35bed1196ff5cfc2c258db66663f3fd1752540dd3e83c4b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqm:TID41qW1PszVZLq6n
- TLSH T17F067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 3.6MB
- SHA256 179e1fd8b6af2fe08773683d546a88afc0b205fd28a6a0c3ed05b80ed862bf61
- MD5 a27465e82af7c54e536a1e62f1db7af7
- SHA1 3a82e9ea630a04ef8470a677961db8cd4a5866d6
- SHA512 0ece6ca98f30ed90bb9387c0dadf32584ac6cb87538de58bf044dfb25018383886b76cebb6f167e048f6df35ce68a959651c7f4db7106ae03dbbd126a42d84a2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqq:TID41qW1PszVZLq6L
- TLSH T1CC067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
- Size 3.6MB
- SHA256 e548a94c0e354c946178a9b67bbfda4909e628b27dc374b59495ca1e733a7a87
- MD5 73ad39c0b6ea4b1fb6dba50484aebf25
- SHA1 9de411854d8a73422de674efb3e4dcd602df14c1
- SHA512 ce5ed88e41d7e5001c11f92420d06fe53fffe93937da9d5057a6f0017e99db4b235d66851d073980db8164aa778fd7eaa2369550447be637f8a75c514e5be14b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqN:TID41qW1PszVZLq6o
- TLSH T1F4067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$
- Size 3.6MB
- SHA256 75473fa9005a5aecf5eda42a24145d6e2fbb038dcba2dc80f972a57a0175e720
- MD5 2d0a3ad3ea345442114a36b2f88c8bf5
- SHA1 d58ac6d95dbab8700b6642ad6702eebd97a7bef5
- SHA512 f99b0c25aea8b2a49cdabcf044710acaa5e5ae7c7610917076a4378783f51a9dac3c6e4833186fcecc0ec4fa65774180b04679f7f461818176915f8941bba3f4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqk:TID41qW1PszVZLq6F
- TLSH T152067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
- Size 3.6MB
- SHA256 71d7c975e246d20ad5660ca129366385e50eb5a57038df47ba0fcb91e83936f3
- MD5 4d2b51aaa18891ee5e66d073f84cd379
- SHA1 a4a922a9604d6b636a13cb1a8aaea891ee212426
- SHA512 2d694ae53681f7cbe0dd55b51149c1f1975d2bb649ed410b3171950052c6ca66f7d2b6446c42a7de31a0b49768cf8af192dbbc9e8a612a62022e096747b22682
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqs:TID41qW1PszVZLq6p
- TLSH T16A067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe$
- Size 3.6MB
- SHA256 dad354de4115d51173bb54dd255bb098b9fe87761917a92a802e0108c58dfd65
- MD5 c9b17fa10f47fc785a2dd637eb224855
- SHA1 84cea461e77107030764b2a8a1bbce4c8299b729
- SHA512 1460e0c2d403c058a89340cc6a25491c561f5a9f0727b89bc3f9c6eed8f692883eec683c1a9b0966578605f14bebb3677130075998244eb4d4520cd546574559
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqq:TID41qW1PszVZLq67
- TLSH T16C067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
- Size 3.6MB
- SHA256 c835627f6a4c8c053bfee457f694ddb4ac0e4509b6bb9b20a803fdf2c992281f
- MD5 f55e6efea08557adc7f6b534e47c696b
- SHA1 580bd67b01b984321e0522c0ead4c2eda5334364
- SHA512 03b2b450d6b7bc2091af3443f4d55af6833896c65bca10d46706b18292e399cbfcca2f46d4d754e9bd07e8732b67bc2c8a75a7a4582fc6f6ec3308a0a622a8fe
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqv:TID41qW1PszVZLq6O
- TLSH T16B067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$
- Size 3.6MB
- SHA256 68bf42c147142e7eac03b22d67dfb2f434476c480aa614116450548ec0fd5e1a
- MD5 5405bdc11bbec59d2ce655a98b40f837
- SHA1 02600f86b695157401e6dd06948451f7fd2bd279
- SHA512 bb17c6a2e80007d84ae9e284de4eea5834bd15dc1de24b725fa4b2ea23dd15262c6c31a198eb2661ee4844b97f51cf4d277d128d646e0bc4c36694133155d60f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYq8:TID41qW1PszVZLq6V
- TLSH T164067C42B7E58972E077023288B752925F7278151F35D28F2398667D6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$
- Size 4.2MB
- SHA256 3497c76c05f1e642fcc5b4559a194de3e9e0bee7d4dd001fd9c8d2a9da10a031
- MD5 323811491d0ee1bdbe5b7f4be7572b7a
- SHA1 c7026bc908f29a3361869e4c5dabfa8725dbbddd
- SHA512 e48e86d89470b466952e708153380789b85e1aa84906d1af60f18859837e6ee5fa6e4ad4099b8d05ac0d77d396de041e5a4cfeaa020bcb1467a44f16996d6682
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqg:TID41qW1PszVZLq6ixGX
- TLSH T188168D42B7D585B2E0770232886752A25F727C151F34938F2398A76E6F337C0AB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$
- Size 4.4MB
- SHA256 36c5b39ca200a8c6d81df9b0aac11116429d92b17c22b72122f0e554f21ab405
- MD5 8b807069f88664dd65ec87d5e0a1d966
- SHA1 3c2e8e04f157a8361a93a25c30a9a073ac304008
- SHA512 9c098f0f0f9db84ffca98a6c24efd67e0066c3113cff0c1deddf6313f9901377b61c14437c975596ed13f62a76fc0e8b06649dac5342be89733da95b4d0f0990
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglvSqatgl1pYqG:TID41qW1PszVZLq6cUEW
- TLSH T158267D41B7E589B2E0B71231897756A2AF72B8111F34D38F2394926E5F337C09E36762
- MD5 SHA1 SHA512 SSDEEP TLSH