1c85645f1ff46266cd12a657203a8c5d8d3c53c85c93bf9230cf93d22e5de120

Analysis

max time kernel
54s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Size 3.4MB
Sample260930-c61s8a1dmd
SHA256 1c85645f1ff46266cd12a657203a8c5d8d3c53c85c93bf9230cf93d22e5de120
MD5 3d9c18736061d868d1f92f631b67dbe9
SHA1 325094daa16c651d8cc5d0cd7064416796a6998d
SHA512 1c05c3ac6afb836322da1bda6612cea0aa3d48177c0b6ba5472efffcfe59aaa4b9f4b54c1d669634a7314730692a6705d08eb52aa3e3c0ce0c965670a0966697
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkk:TID41qW1PszVZjF
TLSH
T12EF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2556	patcher.exe
3512	465.#.exe
3472	359.#.exe
4536	324.#.exe
3396	924.#.exe
220	553.#.exe
4516	970.#.exe
2384	692.#.exe
3804	493.#.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	359.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	324.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	553.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	493.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	465.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	924.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	970.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	692.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	359.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	924.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	970.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	493.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\	324.#.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\	359.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	553.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	patcher.exe
File opened for modification	C:\Program Files\Common Files\Services\	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\uk-UA\	324.#.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\8.0.15\	924.#.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	359.#.exe
File opened for modification	C:\Program Files\7-Zip\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	924.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\	465.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	465.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	324.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	324.#.exe
File opened for modification	C:\Program Files\Crashpad\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\	359.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\	465.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	359.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\he-IL\	359.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\	324.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\	465.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	924.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\	465.#.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	465.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	924.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\	359.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\	465.#.exe
File opened for modification	C:\Program Files\Crashpad\attachments\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\	553.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\	465.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\	924.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\	924.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\	359.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\	324.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	324.#.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	465.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\	465.#.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\	465.#.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	359.#.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	359.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	324.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	553.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	465.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	924.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	970.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	692.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	493.#.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	692.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	465.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	324.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	553.#.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5032	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
2556	patcher.exe
3512	465.#.exe
3472	359.#.exe
4536	324.#.exe
3396	924.#.exe
220	553.#.exe
4516	970.#.exe
2384	692.#.exe
3804	493.#.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3512	5032	2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe	90
PID 2556 wrote to memory of 3472	2556	patcher.exe	91
PID 3512 wrote to memory of 4536	3512	465.#.exe	93
PID 3472 wrote to memory of 3396	3472	359.#.exe	94
PID 4536 wrote to memory of 220	4536	324.#.exe	95
PID 3396 wrote to memory of 4516	3396	924.#.exe	96
PID 220 wrote to memory of 2384	220	553.#.exe	99
PID 4516 wrote to memory of 3804	4516	970.#.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3d9c18736061d868d1f92f631b67dbe9_amadey_elex_glassworm_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\465.#.exe
  C:\Users\Admin\AppData\Local\Temp\465.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Local\Temp\324.#.exe
    C:\Users\Admin\AppData\Local\Temp\324.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\553.#.exe
      C:\Users\Admin\AppData\Local\Temp\553.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\692.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\692.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\957.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\957.#.exe
        6⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\336.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\336.#.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\913.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\913.#.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\19.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\19.#.exe
        9⤵
        
        PID:4528

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\905c0769f9a06c95a24ddf945\359.#.exe
  C:\905c0769f9a06c95a24ddf945\359.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\905c0769f9a06c95a24ddf945\924.#.exe
    C:\905c0769f9a06c95a24ddf945\924.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\905c0769f9a06c95a24ddf945\970.#.exe
      C:\905c0769f9a06c95a24ddf945\970.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\905c0769f9a06c95a24ddf945\493.#.exe
        
        C:\905c0769f9a06c95a24ddf945\493.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3804
      - C:\905c0769f9a06c95a24ddf945\485.#.exe
        
        C:\905c0769f9a06c95a24ddf945\485.#.exe
        6⤵
        
        PID:3924
        
        C:\905c0769f9a06c95a24ddf945\257.#.exe
        
        C:\905c0769f9a06c95a24ddf945\257.#.exe
        7⤵
        
        PID:932
        
        C:\905c0769f9a06c95a24ddf945\67.#.exe
        
        C:\905c0769f9a06c95a24ddf945\67.#.exe
        8⤵
        
        PID:1320
        
        C:\905c0769f9a06c95a24ddf945\301.#.exe
        
        C:\905c0769f9a06c95a24ddf945\301.#.exe
        9⤵
        
        PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.4MB
SHA256 1c85645f1ff46266cd12a657203a8c5d8d3c53c85c93bf9230cf93d22e5de120
MD5 3d9c18736061d868d1f92f631b67dbe9
SHA1 325094daa16c651d8cc5d0cd7064416796a6998d
SHA512 1c05c3ac6afb836322da1bda6612cea0aa3d48177c0b6ba5472efffcfe59aaa4b9f4b54c1d669634a7314730692a6705d08eb52aa3e3c0ce0c965670a0966697
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkk:TID41qW1PszVZjF
TLSH
T12EF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
Size 3.5MB
SHA256 7476b946ac4374054559846af6849036993b17bf36603127d87fdc5ed07193c4
MD5 67f9c723e558d4b1561c78bacda8f3b4
SHA1 4ed749841bc35f6cecc1923deb45bc369970b9a6
SHA512 2fa1388b0a30ef7eca27f84f760f5bf4144528f832ebff770fad56234b90347a5da9a97e0e255bd82310be2fcb65c2f74016da0e24cd6ad61c445c1b4248a915
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkx:TID41qW1PszVZjq
TLSH
T190067C42F7D548A2E16B1231867752622E73B8110F74928F23D8E67E5F337C0AA76763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$
Size 3.4MB
SHA256 d1b29a43e35566048312b241b82c359af625377cb78e58ede95dca7a75fbae2a
MD5 c59e71032837b613735d848bda3dca7c
SHA1 f8f4c936a00b452c4a77509f4c0f8d2d08b801ac
SHA512 baded8069d92aa89ce43c9d17ec7b056dc3f8e7d0e20796dbd5d83a44e8ce9f661b134f8ea33c2fc8c3c6e41f396cb9b82e3279dd3e319ff71e595fa03e5f93f
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkD:TID41qW1PszVZjo
TLSH
T13BF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe$
Size 3.4MB
SHA256 f592243298c2ea671b281bdd118f0aa2c0b3d8443a5d1d06e1a61eb219d4f07b
MD5 2c149e2c00358d776406b4c69271574f
SHA1 5d1281b3e3a6b14fe632e074425f2c997c1189ea
SHA512 15ab3eb7f0729943d2f06530d9a0d3d586f673f3033f0968800cdfa65fcc8f2fa8c180054b366f1a41cfc9ce78e7ce408077b2f4b6405a5684aa1f02b935da11
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkm:TID41qW1PszVZjB
TLSH
T1C4F58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe$

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe$
Size 3.4MB
SHA256 958877d9c16d30189c3624c772160fdc1bca6bcef71dd06a48d088cf9ddc2654
MD5 dba8d214e9a0e4998d9540be66a77f46
SHA1 9942263e4fbff0d6dfe2261e2760f92b4165a61b
SHA512 138f495bea29ee84badbbb5d29b68ff4902e919ebf24d4d3591a248bf287d64de0a67d564f9d4207d2a91a402ddcc2b5cbbb6c549a3b5b0bf69bc5d7bb7f3f19
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkQ:TID41qW1PszVZjb
TLSH
T10EF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
Size 3.4MB
SHA256 897c2711a993c2c439450f8a87a9c629b1096d49a53118ab1178da98fb1b20b6
MD5 85410e91ef3febf4e9e553d1debd5f4c
SHA1 c8f44d867ae328803f6fe3691e0073122ff29a76
SHA512 5c193c6eef2a689f09d646c12d46fa028b971170403a7c94f6cb9b58145e515b76ac8ab509f8ad6f53e0f5563757bdf4b50bb91eb12f7c21cb5a3977afdd7f4c
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkk:TID41qW1PszVZjf
TLSH
T126F58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$
Size 3.4MB
SHA256 d45bd94bf1c56237007e7aba8bd08979124e52f18246ef05b9664111196cbdbd
MD5 f56769be84d2a7643b8f7e96a278a57d
SHA1 d3c2a9c9d8e6abc1f3ce54ee9c36276def28998d
SHA512 effafd054e09214c027044a93f0b8232e67babb9af5b15d4f1df29af8154b8bb38749a4b5decdbfdf2a71444b4a8f413a7f22a0b6d225c0468064ed34cfa4c2a
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zk1:TID41qW1PszVZjy
TLSH
T1F6F58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 3.4MB
SHA256 321459d71efd8f49e65c5976a885626581c4d09315e2a967d6ac1e86e8cd5561
MD5 c2c83767239a540ea9b88ce6e8a5864e
SHA1 fe4ee28460f7018dc6600cbbc7b3ac807f75a403
SHA512 fb4983013d41e89228bbc3dbd451e8af78387c133e0ba0b07d6d0706bb8df379b9fbb5b6b9f6c0764d642a7008f2194ca21274bff793e3b10ada2a3a520587a0
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zkk:TID41qW1PszVZj3
TLSH
T184F58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$
Size 3.8MB
SHA256 4f098c15c8fbd1295b7a220497cfe65296701583bbd65b066138a14da7dd7b35
MD5 02f77304af7788de699acbf75217b98f
SHA1 1f7afcce59499eeeefe3c77a77bb3e32cfce1732
SHA512 d5951e62bacb39b0dde0315446563feed307a390906b3232d1a5f91dde4fd9970a84dfe483404206de4beac62aebb32ee28e7e66f69e93f77267da5d3245c119
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkmTd9CHE:TID41qW1PszVZj1CqL
TLSH
T12B068D42F7D548B2E1B71231487752625E76BC150F34D38F2398A66E6F337C0AA36B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$
Size 4.2MB
SHA256 972ca3ad3cc802376f898bc52bf896b230b5d2b33867ab7bffc7098ec8a5ee09
MD5 a1b970807c91bb2a9c8087cf5b5a15af
SHA1 4c72cd5191732ae67e471cbf81badbb1aa4f064d
SHA512 f9f8b60b19c9530cae22112212b49be2c08485d231c75ff8885a49dfc2028f60600acf3d6fefe79004120c636b32afaaddae20327783e261cbe32d2937f9e8a5
SSDEEP 98304:TID41qW1PszVZj9MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMU:TuqxsF
TLSH
T1D1168E42F7D588A2E1B71231493792625F72BC150F34924F2398B76E6F337C0AA36B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$
Size 4.2MB
SHA256 83108550ff52dfb11508c398391d97b9f91c371ba74d4622d4eaf9d362c78b6b
MD5 b464135189aecb287ccea6f720203d91
SHA1 d9b45e27cc60c8161c744589e41fc8a3a78dc9b9
SHA512 98a93044ae4a1c66ef3ab73473551ea4e138bbc9c6354e9f90ec029d3c0699c5501ee5778c56a5e65eb24570d17e8666eb3f13c60d2e0dbc051b3f4f816c5e55
SSDEEP 98304:TID41qW1PszVZjvMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMU:Tuqxsv
TLSH
T184168E42F7D588A2E1B71231493752615F72BC150F34928F2398B76E6F337C0AA36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 3.4MB
SHA256 1b255131b14b4c4e13a0dcacc088c515207ca587e23ba581d2ea8a66b2f4aa6a
MD5 4c007b91f88b1daa9de45fc96e427f15
SHA1 c7a07f06a4c365c7a94438e1886dc5d7ed508128
SHA512 611261ac05774dc3564ae52ea51250a638302793ae121023ba47749da2748d863328facfa6bcc31beb66a5628416f5e92c1ad41ca53240064002140d26576655
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zka:TID41qW1PszVZjB
TLSH
T1BCF58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 3.4MB
SHA256 4f284f3602f5929ac4cc6bb44690d5d646934beeec310e632b69b64f783fff89
MD5 bd93645a3190c390d836e813e43c422e
SHA1 db5c37a55eae0334ea3a8da30562e7c894eaa515
SHA512 47ac27dd26da19f9d8380b3ba6394ee728a7ddd09b1e5eab9d8a524aa038a4f0d73d6f54718f81d810abf4009f9ab2c3fafa143d50f70782787af0521f3f1014
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zk1:TID41qW1PszVZje
TLSH
T104F58D42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe$

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe$
Size 3.5MB
SHA256 bdc55a1b85f6dade14e95496f77354ec8995dec5c9875ced9fded2db79557bee
MD5 abe88fb47995ab431dafc240ab5e4716
SHA1 1668d9e558b15df29a070f4a54cf4bcf766a46c0
SHA512 ad68425035752e74fd74169d55502890c4718cc5c86a705c21f2f45908c035f1f5375220723f44e86b94a2e725e04eb42e364de86bacdc0cb2b8971f02c5bef0
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16Zke:TID41qW1PszVZjF
TLSH
T1B4068D42B7D548B2E1B71231487752625F76BC150F34D38F2398A66E5F337C0AA36BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe$

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$
Size 3.4MB
SHA256 016a4f316634120bb120b093f38c99a72b5eddd39d08477f07b456e2d08fb8ce
MD5 d19829f5180eb5608e820fbae22cade3
SHA1 289ae024074c8c04a60a04775be31ca64c840ec7
SHA512 7103e5ee4a9fa1b8b87402a1119cdcfb73fe0e2ede6718a21173bc11c18fe3dea7e00f5b44a1f8dafbc7cc076d801f4e1dcf9a6bfa651b7255207427a97be6b2
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglv16ZkN:TID41qW1PszVZjK
TLSH
T184F58E42B7D548B2E1B71231497752621F76B8150F34D38F2398A66E6F337C0AB367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads