Analysis
- max time kernel
101s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 3.9MB
- Sample260930-d4cjaaterb
- SHA256 9f3b226adab47474657c944fed1e6c7c644be11f44ef8b738e3e8ccc87b35caa
- MD5 2fca85a71339e275a0faec285f59daa5
- SHA1 c406c470da82f0d08a7b83df7af5587cd25774d9
- SHA512 d3079ea3c362a109ca3aa2c04290acf954b0e5a19592ca153af0137cd8ccdf52df27fbb90b9819bdfe563ea3fbfa34db387a104ca2ee7ebc6464c3470633e3ce
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaw:TID41qW1PszVZ4tk4
- TLSH T1EB168D42B7D548A2E1771232897752921F72B8211F35E2CF2398567D6F337C0AB36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 4992 patcher.exe 2568 75.#.exe 3332 489.#.exe 5400 478.#.exe 276 447.#.exe 6056 110.#.exe 4140 92.#.exe 1992 172.#.exe 1052 901.#.exe 3024 442.#.exe - Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 478.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 110.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 92.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 172.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 901.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 442.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 489.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 447.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 75.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 489.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\ 489.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ 75.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 489.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\ 447.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\ 447.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mt-MT\ 172.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ 110.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ 447.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\ 110.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\ 92.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ 489.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 489.#.exe File opened for modification C:\Program Files\7-Zip\ 110.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ml-IN\ 447.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 75.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 447.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ 447.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\ 110.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ 92.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\ 75.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 478.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ne-NP\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 489.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\ 110.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 447.#.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 92.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kn-IN\ 172.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\ 75.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\ 489.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\ 447.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 172.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mk-MK\ 447.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\ 75.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 172.#.exe File opened for modification C:\Program Files\Common Files\System\ 447.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\ 489.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ 110.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 92.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\ 92.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ patcher.exe File opened for modification C:\Program Files\Common Files\System\it-IT\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 489.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ 110.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\ 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 92.#.exe File opened for modification C:\Windows\:\systemlog.bak 172.#.exe File opened for modification C:\Windows\:\systemlog.bak 442.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 489.#.exe File opened for modification C:\Windows\:\systemlog.bak 447.#.exe File opened for modification C:\Windows\:\systemlog.bak 110.#.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 901.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 489.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 110.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 172.#.exe - NTFS ADS 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 92.#.exe File opened for modification C:\Windows\:\systemlog.bak 172.#.exe File opened for modification C:\Windows\:\systemlog.bak 442.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 75.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 478.#.exe File opened for modification C:\Windows\:\systemlog.bak 447.#.exe File opened for modification C:\Windows\:\systemlog.bak 110.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 901.#.exe File opened for modification C:\Windows\:\systemlog.bak 489.#.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4812 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 4992 patcher.exe 2568 75.#.exe 3332 489.#.exe 5400 478.#.exe 276 447.#.exe 6056 110.#.exe 4140 92.#.exe 1992 172.#.exe 1052 901.#.exe 3024 442.#.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4812 wrote to memory of 2568 4812 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 91 PID 4992 wrote to memory of 3332 4992 patcher.exe 92 PID 2568 wrote to memory of 5400 2568 75.#.exe 93 PID 3332 wrote to memory of 276 3332 489.#.exe 94 PID 276 wrote to memory of 6056 276 447.#.exe 95 PID 6056 wrote to memory of 4140 6056 110.#.exe 97 PID 4140 wrote to memory of 1992 4140 92.#.exe 98 PID 5400 wrote to memory of 1052 5400 478.#.exe 99 PID 1992 wrote to memory of 3024 1992 172.#.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\75.#.exeC:\Users\Admin\AppData\Local\Temp\75.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\478.#.exeC:\Users\Admin\AppData\Local\Temp\478.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\901.#.exeC:\Users\Admin\AppData\Local\Temp\901.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\905c0769f9a06c95a24ddf945\489.#.exeC:\905c0769f9a06c95a24ddf945\489.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\905c0769f9a06c95a24ddf945\447.#.exeC:\905c0769f9a06c95a24ddf945\447.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276 -
C:\905c0769f9a06c95a24ddf945\110.#.exeC:\905c0769f9a06c95a24ddf945\110.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\905c0769f9a06c95a24ddf945\92.#.exeC:\905c0769f9a06c95a24ddf945\92.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\905c0769f9a06c95a24ddf945\172.#.exeC:\905c0769f9a06c95a24ddf945\172.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\905c0769f9a06c95a24ddf945\442.#.exeC:\905c0769f9a06c95a24ddf945\442.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3024 -
C:\905c0769f9a06c95a24ddf945\686.#.exeC:\905c0769f9a06c95a24ddf945\686.#.exe8⤵PID:3956
-
C:\905c0769f9a06c95a24ddf945\562.#.exeC:\905c0769f9a06c95a24ddf945\562.#.exe9⤵PID:4468
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 9f3b226adab47474657c944fed1e6c7c644be11f44ef8b738e3e8ccc87b35caa
- MD5 2fca85a71339e275a0faec285f59daa5
- SHA1 c406c470da82f0d08a7b83df7af5587cd25774d9
- SHA512 d3079ea3c362a109ca3aa2c04290acf954b0e5a19592ca153af0137cd8ccdf52df27fbb90b9819bdfe563ea3fbfa34db387a104ca2ee7ebc6464c3470633e3ce
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaw:TID41qW1PszVZ4tk4
- TLSH T1EB168D42B7D548A2E1771232897752921F72B8211F35E2CF2398567D6F337C0AB36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe$
- Size 3.9MB
- SHA256 bcddd59463b5a36afbdb0a92bf23fec628cfff3c505a2ee8c5da560b722d5400
- MD5 2386d0dd67d013430b3326bdeeda233a
- SHA1 e7c90ae221ad806f20e343d3d4d758e4622ca6ad
- SHA512 d306ecaa0e5d4cee1355d8de7c259ae9e8dc2cded615e21e45f7fb8d0f1d11b9b1bd08fc2a4acaa9cba42e16e6723610a295fdff33538c08578d65faa90d6706
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaC:TID41qW1PszVZ4tkK
- TLSH T151168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 3.9MB
- SHA256 797fbbc80f364a0d64160ba6ca5d20e9c3661a4286e670c1d0d8d96b6d521ec7
- MD5 e4a4518d7e9411f363a12d29bf9e4773
- SHA1 d3a8037ac2eed5f661c179741b0fab0beb3f4a1c
- SHA512 3a954b35d9c4ead5228ed38691e9a7cf3e44d6cef26f896b4ee86ffa82f0b59e0e0ce347ee5d899601d5e53ac58a0b6a34d740de9a9bbf243f2c4965402483b4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsar:TID41qW1PszVZ4tkj
- TLSH T183168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 3.9MB
- SHA256 1bc091c96dc3bd2143fb21403735fdcc0f69c8aca067a2e652c612b24f0ec252
- MD5 1ff6e5a96039c33aa48aa6066a0e4aa7
- SHA1 b2f54494d965f293a62aa46711ea2389cce5cd54
- SHA512 f4009b30673c274e4daff9615999256a6a08f67d921b4a228a8f052e3504dd1be0374568fd0682ee5b203245e5466c71f90458c99b3fd9f5f1e4b0c9c2fdd3c3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaK:TID41qW1PszVZ4tki
- TLSH T158168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 3.9MB
- SHA256 9e2338a6b2e17ef7c55c7cd8b0621773f86a8386ad65692c6d431f7216142473
- MD5 e4b98c7c652283b787e768a1c4714baa
- SHA1 fcf26b378cd352735ed3e47835d342c90815a758
- SHA512 f5c0204962193a537cc7d18387e11f8da3a07cb8bfcab4e59824b4266a5cf3131119affd6a7c504e4eea4d570b08052b3ee6704b1f15871675e663ebafde38fc
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsa0:TID41qW1PszVZ4tkM
- TLSH T14D168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$
- Size 3.9MB
- SHA256 6df04368df4826d790bbc042075ae09048109d9c99c0309a1a73906cccb713be
- MD5 845be1e459f07ed0e8062d8eb50c64fe
- SHA1 e712b3ac1c678f4b31d4a695f7d28e340a1330fb
- SHA512 35b1c4f165b7cac0d9e3d9ab3eaa25a0aca3ff700c45c4c65922366c5db47ed73be1e1faf02494c56976cd84a7670f7c2476856c58817909921bdb3f17341a82
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaI:TID41qW1PszVZ4tkQ
- TLSH T129168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
- Size 3.9MB
- SHA256 16109dc3a5ff471eb8bce44fdfec781213e79e1de38ab531a0358ca1433fa88c
- MD5 32edccc2905515befc70df0d543fa421
- SHA1 699f39750cbd5f18317a46fa09ab1daeb5daf5e0
- SHA512 747e98a84e56281296044a897c730fab43a21150a8e170133737abfba78eff471f2284c7b0c4c3a63404d859cc2384c540bc47191d9b654f182a3212cb827063
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaH:TID41qW1PszVZ4tkv
- TLSH T1FC168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 4.4MB
- SHA256 4dbec3ecd93c03b4201961ed64a777e2ab4ef1432d5e8c8490e15a11d4e28759
- MD5 7ba2d19bcc8b1fbc2530b0b7ebaad838
- SHA1 13f43ddc97ac0d194570aaddd075005c73ffd362
- SHA512 979dd552eeffd0e063ba136684e2c040ded8115dfd7b2e34133ec056ac02302d3da2b427f477d5b964fed174cec19e46d294355f3d7f00be2b8dfa8fe0feeab1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsai:TID41qW1PszVZ4tke9
- TLSH T1D7267D52B7D488A2D1770235897752525E72B8211F35E3CF2398927E6F337C0AB36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$
- Size 3.9MB
- SHA256 96e82d267f29cfa75d35c85d96e1ac56749d722a6ee5e1b1499caa72d6554f51
- MD5 1fbd333039ffa26d6c7da35de7a635d6
- SHA1 8f033c37ecbddf183a21b0c587aa7ce510fbb16f
- SHA512 689a4e93257e7d24faf0dc05b14f6804a0e0c001ba7b6b737915bc94ad31d03e809b1cc4f000f102d75823d23ddafcc7b305f7d87a57b5a16fa39cc287d2a656
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsam:TID41qW1PszVZ4tk+
- TLSH T117168D42B7D548A2E1770232897752921F72B8211F35E2CF2398567D6F337C0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH