Analysis
- max time kernel
80s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.3MB
- Sample260930-fsdnbaygqa
- SHA256 cb9e65910ab2ee67689713f5a7494effee43e05b8f5816af370db34506750626
- MD5 162de1c4f3423b0627da68f7fe55a7f6
- SHA1 de67b7529ae6bf5c90f5eb65124d840b649c28ac
- SHA512 04dd65fc51bbdbb4dc823a6fc51d0847fa5e7d84f35d5da5786b62229916513e90593e1d01ee248e3cf294399e998b8bd5b97f4de93b8f071a4df9e19882c81f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2:TID41qW1PszVZ
- TLSH T17CF58D42B7E94862E1B72232497752521FB6B8110F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 4604 patcher.exe 1908 815.#.exe 3988 948.#.exe 5100 749.#.exe 1476 249.#.exe 116 198.#.exe 2140 585.#.exe 4908 629.#.exe 2080 144.#.exe 2596 483.#.exe 4172 782.#.exe 3712 44.#.exe - Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 815.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 948.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 749.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 249.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 198.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 585.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 629.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 144.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 483.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 782.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 44.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 144.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 782.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 948.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 249.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 585.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ 249.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\ 749.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ 585.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ 948.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 815.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 585.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 948.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Crashpad\reports\ 815.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ 749.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 815.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-PT\ 249.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\ 198.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 198.#.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 948.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ patcher.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ 198.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 198.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 249.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 749.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ 749.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 948.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\ patcher.exe File opened for modification C:\Program Files\Common Files\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 585.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 585.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 629.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 198.#.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 749.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ 749.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 948.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\ 815.#.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ 749.#.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 815.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\ 948.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 815.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\ 749.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 749.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\ 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\ 249.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 749.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 198.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 585.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 749.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 815.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 249.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ 629.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\ 249.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\ 749.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 629.#.exe - System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 249.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 198.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 144.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 483.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 815.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 585.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 629.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 782.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948.#.exe - NTFS ADS 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 198.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 629.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 483.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 44.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 815.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 749.#.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4404 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe 4604 patcher.exe 1908 815.#.exe 3988 948.#.exe 5100 749.#.exe 1476 249.#.exe 116 198.#.exe 2140 585.#.exe 4908 629.#.exe 2080 144.#.exe 2596 483.#.exe 4172 782.#.exe 3712 44.#.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4404 wrote to memory of 1908 4404 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe 91 PID 4604 wrote to memory of 3988 4604 patcher.exe 92 PID 1908 wrote to memory of 5100 1908 815.#.exe 93 PID 3988 wrote to memory of 1476 3988 948.#.exe 95 PID 5100 wrote to memory of 116 5100 749.#.exe 96 PID 1476 wrote to memory of 2140 1476 249.#.exe 97 PID 116 wrote to memory of 4908 116 198.#.exe 100 PID 2140 wrote to memory of 2080 2140 585.#.exe 101 PID 4908 wrote to memory of 2596 4908 629.#.exe 104 PID 2080 wrote to memory of 4172 2080 144.#.exe 105 PID 2596 wrote to memory of 3712 2596 483.#.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\815.#.exeC:\Users\Admin\AppData\Local\Temp\815.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\749.#.exeC:\Users\Admin\AppData\Local\Temp\749.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\198.#.exeC:\Users\Admin\AppData\Local\Temp\198.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\629.#.exeC:\Users\Admin\AppData\Local\Temp\629.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\483.#.exeC:\Users\Admin\AppData\Local\Temp\483.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\44.#.exeC:\Users\Admin\AppData\Local\Temp\44.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\731.#.exeC:\Users\Admin\AppData\Local\Temp\731.#.exe8⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\166.#.exeC:\Users\Admin\AppData\Local\Temp\166.#.exe9⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\954.#.exeC:\Users\Admin\AppData\Local\Temp\954.#.exe10⤵PID:2356
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\905c0769f9a06c95a24ddf945\948.#.exeC:\905c0769f9a06c95a24ddf945\948.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\905c0769f9a06c95a24ddf945\249.#.exeC:\905c0769f9a06c95a24ddf945\249.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\905c0769f9a06c95a24ddf945\585.#.exeC:\905c0769f9a06c95a24ddf945\585.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\905c0769f9a06c95a24ddf945\144.#.exeC:\905c0769f9a06c95a24ddf945\144.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\905c0769f9a06c95a24ddf945\782.#.exeC:\905c0769f9a06c95a24ddf945\782.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4172 -
C:\905c0769f9a06c95a24ddf945\318.#.exeC:\905c0769f9a06c95a24ddf945\318.#.exe7⤵PID:512
-
C:\905c0769f9a06c95a24ddf945\915.#.exeC:\905c0769f9a06c95a24ddf945\915.#.exe8⤵PID:1320
-
C:\905c0769f9a06c95a24ddf945\551.#.exeC:\905c0769f9a06c95a24ddf945\551.#.exe9⤵PID:4384
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 cb9e65910ab2ee67689713f5a7494effee43e05b8f5816af370db34506750626
- MD5 162de1c4f3423b0627da68f7fe55a7f6
- SHA1 de67b7529ae6bf5c90f5eb65124d840b649c28ac
- SHA512 04dd65fc51bbdbb4dc823a6fc51d0847fa5e7d84f35d5da5786b62229916513e90593e1d01ee248e3cf294399e998b8bd5b97f4de93b8f071a4df9e19882c81f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2:TID41qW1PszVZ
- TLSH T17CF58D42B7E94862E1B72232497752521FB6B8110F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 3.5MB
- SHA256 aa494bf612b14307bd9826543b3f0999bbf0ebbc0bc9adc7f0516ea46bd39c0e
- MD5 bd0d54f822c6f477a7330959cdfe9cc5
- SHA1 ff46304b04747e7c2f8f5bc628284bffcf99deb3
- SHA512 21987eeb6cf38d4da8cbc68df50c414a2854455b2ebb5a0aaceecbdd08daaf3b85bba1c9ce160327a26b38788515c472b60f3cbe987999a804a088f7914e5d7b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2P:TID41qW1PszVZ0
- TLSH T120F55B41F7E94862E1BB22318A7242522A77B8110F75D2CF23D4A67D5F337C0AA72767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 3.3MB
- SHA256 6bea29f5d4bf62b78dc83bd6320622887ae7d8b0f2ba7a1fda7fe61260fd3213
- MD5 454f6d10d2bc04c45dba73ce59c92680
- SHA1 62084835c6fbf1103cc35eb32cba9a1c30be5e47
- SHA512 814dc6fb85ca2cf124140aad63eac7303809b14e234b6458debcd7d53630eb425a269fa57a66497bd4bb8cd5a168eb301285c63346f3d3e440336789a08a49e6
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw24:TID41qW1PszVZr
- TLSH T1EAF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$
- Size 3.3MB
- SHA256 f58b7c71565ed96c56abb5e0127167f37a15c89cb873f460ef54825a7537aa5a
- MD5 966d60008014e2b0490fa6e6f19e11f8
- SHA1 47dcdb879cf423ab473a67dd0bd6bda1cfa630c1
- SHA512 5d60d4d56341e299ba52151fe5426c8438d5dfe6d00a57b08fe6c61fcd5f8559e79d9c93488f7d14079676aa0b0f0ac0683e708b06bde179ff505ed7f18fe913
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2g:TID41qW1PszVZj
- TLSH T195F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe$
- Size 3.3MB
- SHA256 fbb07a546789f7f5ce38ce0782727bc242ed0a44f3e90691017769eea70203cc
- MD5 6a3a6df0bf087965d2210738368dacf6
- SHA1 a39195bc88ea945de702075fe66490c4a33cb0ef
- SHA512 8bfa11ea65013984ce1c509b319325de48955b7c3c137f95940e44372d01fa97f587fb50508308290aaba65613dcc0dc5ece3d85acdfdc6c5c7732cc95463e1d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2m:TID41qW1PszVZV
- TLSH T1CDF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$
- Size 3.3MB
- SHA256 822dca71a9fa0e5c1eef5cc220efd0b4ec18b1b85fcacd5782bdac3bba1b3825
- MD5 6c58ab4cf2ee6f2763bc35c9107dc40d
- SHA1 da031a509ca10ed5e542d3d2a31bccc96029b850
- SHA512 ab413716af89b3bb434f027b810fc87a8d0fc56f38af88fe2f6aeaf2d1a3c33ef2c9465d67082e9d79ed39a2d36807f6374a3461c3bab58fbbeb745e11fa46c8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2T:TID41qW1PszVZk
- TLSH T195F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 3.3MB
- SHA256 2eab097a73cfd860d0b8b86940b3350444752e4a45f64b07d62563507633e0c7
- MD5 6c17f90f87fe0a3b551c19761017aa20
- SHA1 addcab8edef400d437b54ba1d1d049ab8ce6e7f0
- SHA512 6c651727dd8dacfdfe1504a19139a76d55923a370f2cb900fcb81dc2a856267e02f83b6dabeea18a48af8c639adb468a8bb7a60f4c6c030dff044aaef40bd36a
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2S:TID41qW1PszVZR
- TLSH T1F1F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 3.3MB
- SHA256 1d33fc4d15a1468e49a3dd4b71c37f31322329dbee7632216769f0149c45438c
- MD5 ab3b645f0957d9b2a862f9399cd8dbed
- SHA1 dd86cd6be16e3a73f80aaef57d13b706b65e2aa8
- SHA512 5d840c81fc8b978c50b3702e7fc49324adb7dec67a1fbfe4d6c3b20654d21907fccbe5efac12ca612eb0d2ab7ee0b58a1cca94f2ba4a27a75523640ec9999215
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2o:TID41qW1PszVZ3
- TLSH T1FFF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 3.3MB
- SHA256 9366824e0b4aa0c28cbfb1a440232adf833fbc9f426ae0106b001d5ea2c43c03
- MD5 79ffc6388a8fa55f60114748236c5352
- SHA1 828447dff558313e22f2e9325f9a314f935d5f20
- SHA512 333695cdb8fb5367ffcd595757edb6d4bc185f14b9ebd286313010693ba6aa02328153623bb5506a524b42db522092883ee1064601b8a7d87c83e21c18d0c25e
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2E:TID41qW1PszVZb
- TLSH T18BF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 3.3MB
- SHA256 bcf7c414224c6f2c61ea579ea7b9bccf99848de2d3d5abcecfa3040678a74f4f
- MD5 52bcf8de8307b6f267fafc69c06870ab
- SHA1 ce51885880e6e7c693b08e90b8f71d1753e8e0b0
- SHA512 4ecaeee4faf451924e2b4c0f3624665d551cb39191db90fbc4cd023eddf689758bf512e9a8c8362bf0be7a802556b5a89cabae3daaa27128731e432a23e0deac
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2e:TID41qW1PszVZp
- TLSH T193F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 3.3MB
- SHA256 57b234f0f4171310a01e1360e591d182f188fc087372323f5257af0dc709deee
- MD5 b1c586dfef93f4b38f62c8e16e83f5ba
- SHA1 59eff3df8c5f1bb5fa09cfff3184898d28edb31e
- SHA512 223cf91ce0ec082d54cf92b41cf852cac705f8448fa1826e8dc520a67ec49aa2bb556625fa557e168df5492aeb39395ddee8b59c2bc9d15c44d5762d682e0add
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2B:TID41qW1PszVZW
- TLSH T16EF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 4.1MB
- SHA256 d5882505889aa3a95ab5a51e26449c688c3168f0296c457d7457cf2880edaf07
- MD5 325a0a37a32c5671f7bcd75279331954
- SHA1 3374cf34742691cf4dedd7c5b057219393c080e6
- SHA512 d618a7e51e59229d3ae97e97d85eca0944bdc526a21e03901022e16a25f3674f800f776173895fac0209dfdcf69b08295575da777f8ec36e0e96720ef7a9b880
- SSDEEP 98304:TID41qW1PszVZQMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVW:Tuqxsu
- TLSH T117167C42B7E98862E1B71231497346511EB2BC611F35D28F2398776E5F337C0AA32B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 6.7MB
- SHA256 24f786a859f5850dd94fc1927e12adf82bc579d3f45a25bd0baf1e71b2e08366
- MD5 596fbb750c5ddddd650c411dda1e4aa3
- SHA1 3b71d4cafb50249c9527bb496b09c98d1682c5d4
- SHA512 1ab627ed0575c61b87a397fbd2f2c94e603d9fbce80fb73be91c8d42f16cdc1d01f530b3c7e0319d8ad26f19671ffde25ccf6deab340bf1f6954539b32b908a9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2Q/4C:TID41qW1PszVZcID41qW1PszVZb
- TLSH T167668D42B7E94862E1B72232497352521FB6B8110F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 6.7MB
- SHA256 1a2e0519c85cf4357b5f33791130aeb18556a61f82d25e243df35bcb83e7b24b
- MD5 9fc00ab4755ee0afd1c5e20cf7851514
- SHA1 3295aa8c17a473f6393a46316cd929350928eeba
- SHA512 a58f4563fad5cf14c85923c63650749779cd0f73a6ab427eeea27a67fc3f744a7b60889cc78de7bc327ab9830f25f48c3bd0fdeddc856c716fbb741e0a5bbc68
- SSDEEP 98304:TID41qW1PszVZQMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMV9:TuqxsCxsb
- TLSH T1D5667D42B7E94862E1B72231497346511EB2BC511F35D2CF2398667E5F337C0AA32BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe$
- Size 3.3MB
- SHA256 2537e96b4b5de540eeabbdbaad1e8b20f34d2e1d0c91303ccceadb2b0f81a1d2
- MD5 551829c0ae711a3833e4d34095687898
- SHA1 8e754e75a3bb35b570e38831a49b54d806f29106
- SHA512 fe75e3c96a6dde3297dbbbbdbf5ded0cf99fd5b33400d2bc96905423c5b7a7982a786b156314878c9f2d6e40c7ee9312e1ff479a29e23051adde10fa65684f29
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw20:TID41qW1PszVZ7
- TLSH T178F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH