Analysis
- max time kernel
108s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.3MB
- Sample260930-fsdnbaygqa
- SHA256 cb9e65910ab2ee67689713f5a7494effee43e05b8f5816af370db34506750626
- MD5 162de1c4f3423b0627da68f7fe55a7f6
- SHA1 de67b7529ae6bf5c90f5eb65124d840b649c28ac
- SHA512 04dd65fc51bbdbb4dc823a6fc51d0847fa5e7d84f35d5da5786b62229916513e90593e1d01ee248e3cf294399e998b8bd5b97f4de93b8f071a4df9e19882c81f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2:TID41qW1PszVZ
- TLSH T17CF58D42B7E94862E1B72232497752521FB6B8110F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 2012 patcher.exe 4684 536.#.exe 3428 506.#.exe 4984 124.#.exe 3264 904.#.exe 5020 812.#.exe 2892 36.#.exe 708 633.#.exe 4516 528.#.exe 5280 953.#.exe 1776 568.#.exe 4556 969.#.exe - Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 633.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 528.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 812.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 36.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 953.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 568.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 969.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 536.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 506.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 124.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 904.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\ 633.#.exe File opened for modification C:\Program Files\Google\Chrome\ 536.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ 36.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ur-PK\ 633.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 506.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 536.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 904.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 904.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ 904.#.exe File opened for modification C:\Program Files\Google\ 812.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ 812.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLSTART\ 812.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\ 904.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ 36.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 904.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 124.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\ 36.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\ 904.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 904.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\ 812.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 904.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 506.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\ 812.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ 812.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\ 904.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 506.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\ 812.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\ 536.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ 536.#.exe File opened for modification C:\Program Files\dotnet\swidtag\ 904.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\ 36.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\ 904.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ 904.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\ 812.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\ 36.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\ 506.#.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 506.#.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 506.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 506.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 812.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 633.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\ 633.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 536.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ 536.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\ 36.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ 36.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\ 36.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 506.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\ 812.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 506.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\ 506.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 528.#.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 506.#.exe File opened for modification C:\Windows\:\systemlog.bak 904.#.exe File opened for modification C:\Windows\:\systemlog.bak 812.#.exe File opened for modification C:\Windows\:\systemlog.bak 568.#.exe File opened for modification C:\Windows\:\systemlog.bak 36.#.exe File opened for modification C:\Windows\:\systemlog.bak 633.#.exe File opened for modification C:\Windows\:\systemlog.bak 528.#.exe File opened for modification C:\Windows\:\systemlog.bak 969.#.exe - System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 536.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 812.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 568.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 506.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 633.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 953.#.exe - NTFS ADS 13 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 633.#.exe File opened for modification C:\Windows\:\systemlog.bak 568.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 536.#.exe File opened for modification C:\Windows\:\systemlog.bak 506.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 124.#.exe File opened for modification C:\Windows\:\systemlog.bak 904.#.exe File opened for modification C:\Windows\:\systemlog.bak 528.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 953.#.exe File opened for modification C:\Windows\:\systemlog.bak 969.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 812.#.exe File opened for modification C:\Windows\:\systemlog.bak 36.#.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5704 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe 2012 patcher.exe 4684 536.#.exe 3428 506.#.exe 4984 124.#.exe 3264 904.#.exe 5020 812.#.exe 2892 36.#.exe 708 633.#.exe 4516 528.#.exe 5280 953.#.exe 1776 568.#.exe 4556 969.#.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5704 wrote to memory of 4684 5704 2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe 93 PID 2012 wrote to memory of 3428 2012 patcher.exe 94 PID 4684 wrote to memory of 4984 4684 536.#.exe 95 PID 3428 wrote to memory of 3264 3428 506.#.exe 96 PID 3264 wrote to memory of 5020 3264 904.#.exe 98 PID 5020 wrote to memory of 2892 5020 812.#.exe 99 PID 2892 wrote to memory of 708 2892 36.#.exe 100 PID 708 wrote to memory of 4516 708 633.#.exe 101 PID 4984 wrote to memory of 5280 4984 124.#.exe 102 PID 4516 wrote to memory of 1776 4516 528.#.exe 103 PID 1776 wrote to memory of 4556 1776 568.#.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_162de1c4f3423b0627da68f7fe55a7f6_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\536.#.exeC:\Users\Admin\AppData\Local\Temp\536.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\124.#.exeC:\Users\Admin\AppData\Local\Temp\124.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\953.#.exeC:\Users\Admin\AppData\Local\Temp\953.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5280
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\905c0769f9a06c95a24ddf945\506.#.exeC:\905c0769f9a06c95a24ddf945\506.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\905c0769f9a06c95a24ddf945\904.#.exeC:\905c0769f9a06c95a24ddf945\904.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\905c0769f9a06c95a24ddf945\812.#.exeC:\905c0769f9a06c95a24ddf945\812.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\905c0769f9a06c95a24ddf945\36.#.exeC:\905c0769f9a06c95a24ddf945\36.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\905c0769f9a06c95a24ddf945\633.#.exeC:\905c0769f9a06c95a24ddf945\633.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\905c0769f9a06c95a24ddf945\528.#.exeC:\905c0769f9a06c95a24ddf945\528.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\905c0769f9a06c95a24ddf945\568.#.exeC:\905c0769f9a06c95a24ddf945\568.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\905c0769f9a06c95a24ddf945\969.#.exeC:\905c0769f9a06c95a24ddf945\969.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4556 -
C:\905c0769f9a06c95a24ddf945\13.#.exeC:\905c0769f9a06c95a24ddf945\13.#.exe10⤵PID:4492
-
C:\905c0769f9a06c95a24ddf945\428.#.exeC:\905c0769f9a06c95a24ddf945\428.#.exe11⤵PID:5112
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 cb9e65910ab2ee67689713f5a7494effee43e05b8f5816af370db34506750626
- MD5 162de1c4f3423b0627da68f7fe55a7f6
- SHA1 de67b7529ae6bf5c90f5eb65124d840b649c28ac
- SHA512 04dd65fc51bbdbb4dc823a6fc51d0847fa5e7d84f35d5da5786b62229916513e90593e1d01ee248e3cf294399e998b8bd5b97f4de93b8f071a4df9e19882c81f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2:TID41qW1PszVZ
- TLSH T17CF58D42B7E94862E1B72232497752521FB6B8110F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$
- Size 3.3MB
- SHA256 0157e7af59bc3021b2aab8c8c4071a46b709ba7638d88e5edecef39aaf8784d7
- MD5 c1b451a934864d7dd0e6381fd7fd1170
- SHA1 bddb582fb44a087d9df1715a2bc1863eb0e37b32
- SHA512 b53eb4f65d3fd5bc6156333a14e00d66dc79efa4b8a830ab85a0550094fcec31e7d3ddc01d1b6bf831cbd9b5d1d1b02162521554b47f0847216fc6abb2d5fe27
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2n:TID41qW1PszVZg
- TLSH T1CEF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 3.3MB
- SHA256 e61b07acc578378dea6264f7dacd877a6ccc376791f7b4fd18b0f90cd8985fee
- MD5 02234076d0ecaeadf6b7e82a2f6a6859
- SHA1 99e4c469496260df28e2d2db9944d8f86422be33
- SHA512 dbe0019d8945e5822c8c8a3c9a88f11c3d6041249a8c3ae8654b45efce94e896ae47378c984493541192919de5df79e9e25fe8c588e9def7b3b927c150f277ee
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2H:TID41qW1PszVZg
- TLSH T142F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
- Size 3.3MB
- SHA256 2aae8ec94cf8a632dcdd01489c57e6ebd0b8c35a03557153eb64d0806a8b0a03
- MD5 f13c557fbfad2f8983d0328c70767ee6
- SHA1 f6ac7cb7f43ada23b5fd28042bf101ba51d5a349
- SHA512 9ed31ba1a8ee5bf8906bb69856cca3192c16f8d3e04c3e24727f0a72ca32903f56044279032808b7854736d75193b49c9880e8e62e4992d020321b86bf9fc10c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2a:TID41qW1PszVZ5
- TLSH T19FF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$
- Size 3.3MB
- SHA256 b59c40a8735b702b6fede81a545476ee3dca5a73560a30c8e63b55c6ae4dd52a
- MD5 a73f1cab3765a212819645b9092cb167
- SHA1 bdbc4a18cff8658430ff2cb8d0b4c5bb2c13af2f
- SHA512 5e9a30ca84902497ceba8badb89c0b74714f8e3cf15fd71fe32c7aca6b0ecda3e9103fb5fd867bb25a22b9d76ba359ab4ae446acd393436a3475f5d54d546f4b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2r:TID41qW1PszVZs
- TLSH T1BCF58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$
- Size 3.3MB
- SHA256 647eb42db3f20f2c2d5b5bc190579a6da72384f88fee0f9b4a33b4b26261f9cc
- MD5 a47f5cb48c9431204410b52e58dc1b84
- SHA1 911235ae77446bfe64fdc64fac55e29119390b09
- SHA512 07cfb17de9349419d2e9dc8a73eb81fae34360bfd099526288bf7490711af0b2c375202ea17c109008e7f1178bd31c38500b174e27a6d3e32b3e1af3d205fc22
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2e:TID41qW1PszVZR
- TLSH T1A7F58D42B7E94862E1B72232497352521FB6B8111F35D2CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$
- Size 3.4MB
- SHA256 19bef969b29bf970c12f42afcd00a4378675824efdc431a2f171517a56746f2b
- MD5 b389e8f66abdc4a2e21dd7b4524f8675
- SHA1 c5bc1a5265abf36dc7b5b5f6695f8c5a8cf4344b
- SHA512 79dd7081168869c6ba517a96c91ec98d9cb80ab75e720a9a1610da68ecfa4d18dfb6cc267d27492ad97ce5a45c2ce79815de168cb615bc08750317954e690927
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2I+:TID41qW1PszVZs
- TLSH T12CF58D42B7E94862E1B72232497352521EB6B8510F35D3CF2398567E5F337C0AA327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\updater.exe$
- Size 3.8MB
- SHA256 78e5bcc154b2e46a36d9094751751da5e010c5729e858be868f75d387c5bbca0
- MD5 ee5871b76d1eabcc692138b402e51d01
- SHA1 1d27787675cb1d1b7eb5faf44fcdd8ca9e0d7594
- SHA512 743cda4809fc3f8b0d5b12ab2cc6f8d967d60e3fc382fcda1b28dea82e49109a6fc47179c564649636875a1c2fd44c568a7037ec56f98df85398186302618a85
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglYiw2aiw2oW+v:TID41qW1PszVZ4+3f
- TLSH T144068D42B7E94862E1B72231497342525FB2BC510F35D2CF2398567E5F337C0AA36BA6
- MD5 SHA1 SHA512 SSDEEP TLSH