Analysis
- max time kernel
108s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 3.1MB
- Sample260930-snfckaxhld
- SHA256 a5dab0a9fabbda1a275ec49e1189d7a541484f88d37b6f720c1d318b89c244c7
- MD5 eea3c7c5fb6c5f3030b8869412709737
- SHA1 76b7950d87ac6df2f9e7654573a44da0ef94c62b
- SHA512 761e33bba794655863b9117f4b7b5ed4ddcbea50c6affd71d8ae7d77086c10f597d41fb5586786a71c75e908d2ef50c6b2fd72c850813cdb8f5cacf5c75845e0
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5S9:TID41qW1PszVZX5e
- TLSH T1BBE59D42B7D54963E1771232487752A21E72B9210F34E28F2398766D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 2540 patcher.exe 1800 935.#.exe 3320 258.#.exe 5900 952.#.exe 5020 381.#.exe 2308 824.#.exe 3032 194.#.exe 3868 341.#.exe 3976 99.#.exe 5928 287.#.exe 5032 194.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 341.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 99.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 935.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 952.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 381.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 194.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 287.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 194.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 258.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 824.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 341.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\ 194.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 935.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 935.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\ 935.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\ 381.#.exe File opened for modification C:\Program Files\dotnet\shared\ 935.#.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ 341.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kok-IN\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mr-IN\ 341.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\ 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\ 381.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ta-IN\ 341.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\ 258.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\ 824.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\ 258.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 258.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 381.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 341.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 258.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\ 381.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\ 258.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nn-NO\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ 258.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 341.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\ 381.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ 258.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 935.#.exe File opened for modification C:\Program Files\dotnet\host\ 341.#.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 258.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 341.#.exe File opened for modification C:\Program Files\Microsoft Office\root\loc\ 258.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ 381.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ 258.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\ 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\ 194.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\ 824.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ 381.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\ 258.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 341.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 341.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\ 824.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 381.#.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 952.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\ 824.#.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 258.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ 935.#.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 258.#.exe File opened for modification C:\Windows\:\systemlog.bak 381.#.exe File opened for modification C:\Windows\:\systemlog.bak 824.#.exe File opened for modification C:\Windows\:\systemlog.bak 194.#.exe File opened for modification C:\Windows\:\systemlog.bak 341.#.exe File opened for modification C:\Windows\:\systemlog.bak 99.#.exe File opened for modification C:\Windows\:\systemlog.bak 194.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 287.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 935.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 381.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194.#.exe - NTFS ADS 12 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 381.#.exe File opened for modification C:\Windows\:\systemlog.bak 194.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 287.#.exe File opened for modification C:\Windows\:\systemlog.bak 194.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 935.#.exe File opened for modification C:\Windows\:\systemlog.bak 824.#.exe File opened for modification C:\Windows\:\systemlog.bak 341.#.exe File opened for modification C:\Windows\:\systemlog.bak 99.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 258.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 952.#.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3040 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 2540 patcher.exe 1800 935.#.exe 3320 258.#.exe 5900 952.#.exe 5020 381.#.exe 2308 824.#.exe 3032 194.#.exe 3868 341.#.exe 3976 99.#.exe 5928 287.#.exe 5032 194.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1800 3040 2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 91 PID 2540 wrote to memory of 3320 2540 patcher.exe 92 PID 1800 wrote to memory of 5900 1800 935.#.exe 93 PID 3320 wrote to memory of 5020 3320 258.#.exe 94 PID 5020 wrote to memory of 2308 5020 381.#.exe 95 PID 2308 wrote to memory of 3032 2308 824.#.exe 97 PID 3032 wrote to memory of 3868 3032 194.#.exe 98 PID 3868 wrote to memory of 3976 3868 341.#.exe 99 PID 5900 wrote to memory of 5928 5900 952.#.exe 100 PID 3976 wrote to memory of 5032 3976 99.#.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_eea3c7c5fb6c5f3030b8869412709737_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\935.#.exeC:\Users\Admin\AppData\Local\Temp\935.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\952.#.exeC:\Users\Admin\AppData\Local\Temp\952.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\287.#.exeC:\Users\Admin\AppData\Local\Temp\287.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5928
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\905c0769f9a06c95a24ddf945\258.#.exeC:\905c0769f9a06c95a24ddf945\258.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\905c0769f9a06c95a24ddf945\381.#.exeC:\905c0769f9a06c95a24ddf945\381.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\905c0769f9a06c95a24ddf945\824.#.exeC:\905c0769f9a06c95a24ddf945\824.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\905c0769f9a06c95a24ddf945\194.#.exeC:\905c0769f9a06c95a24ddf945\194.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\905c0769f9a06c95a24ddf945\341.#.exeC:\905c0769f9a06c95a24ddf945\341.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\905c0769f9a06c95a24ddf945\99.#.exeC:\905c0769f9a06c95a24ddf945\99.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\905c0769f9a06c95a24ddf945\194.#.exeC:\905c0769f9a06c95a24ddf945\194.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5032 -
C:\905c0769f9a06c95a24ddf945\590.#.exeC:\905c0769f9a06c95a24ddf945\590.#.exe9⤵PID:2864
-
C:\905c0769f9a06c95a24ddf945\231.#.exeC:\905c0769f9a06c95a24ddf945\231.#.exe10⤵PID:3664
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 a5dab0a9fabbda1a275ec49e1189d7a541484f88d37b6f720c1d318b89c244c7
- MD5 eea3c7c5fb6c5f3030b8869412709737
- SHA1 76b7950d87ac6df2f9e7654573a44da0ef94c62b
- SHA512 761e33bba794655863b9117f4b7b5ed4ddcbea50c6affd71d8ae7d77086c10f597d41fb5586786a71c75e908d2ef50c6b2fd72c850813cdb8f5cacf5c75845e0
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5S9:TID41qW1PszVZX5e
- TLSH T1BBE59D42B7D54963E1771232487752A21E72B9210F34E28F2398766D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$
- Size 3.2MB
- SHA256 aa9da7fff9a9003db3ab3040794795c103f4121f10dfcb97a4bc7aa10c643096
- MD5 e3a4f17084f128b524eaad5a6551d452
- SHA1 dd6c38e1760b8d8b21c56b8b0a4e091472513d15
- SHA512 2003fe6da69292972f41707867c24da22ab3695ea075911f545ace1f50ed89f2e2f56d9b4f714fe0e7608757522a94eaf7616a88f450a1cb06b25850decd6b88
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Si:TID41qW1PszVZX5T
- TLSH T124F57B41F7D54862E17B12328A2752923E73B8210F74928F23D8A67D5F337C0AA76797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe$
- Size 3.1MB
- SHA256 90ca036d40afda127af834821faa42e9af48aa3d7885d6756fafa3255b362b39
- MD5 4cf76a64e9b58252b64d63f91f772828
- SHA1 664321e3c870da0d9f187aaccc91b0506c64cbd0
- SHA512 c08e425ac9f68161ebb1f091af6c6e3d381e7011d4de06be40fb370cc3a1374855bc3322ef732844efd0490a6ac02b73ead85bdb7e61c96cdf02d7b858eb89f0
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5S8:TID41qW1PszVZX5J
- TLSH T173E59D52B7D54863E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe$
- Size 3.1MB
- SHA256 5aa527cad0ffd83d23173ec6622c0a079f7b594835d31b73462fc125ad37f6fa
- MD5 71e61139dc90c19f3a5cac39ac16962b
- SHA1 58af1cdd48fc1d87f3e25c14f3cc31b9f339b4a5
- SHA512 dae71e9a52561cfbf3d8104ace4988ffbed92c01c2ac09d9938fa3042841b1c133b9155fac8410d14e277a5f306f712d5b610c55af42b2fe10802449ddc2c6bf
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sd:TID41qW1PszVZX5w
- TLSH T182E59D42B7D54963E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe$
- Size 3.1MB
- SHA256 9092192b170d6b8f251ed63dd88ada6c1ed18e8fd6afbbc7b31aa23c1da78116
- MD5 4b818832ff3a8f1ca550778bdd0aae8e
- SHA1 60731c674e2c29fc35b19b81994a4d2b3ed0f06f
- SHA512 15324a85aeeccd0bddc6d2fb230b397e4ee1bc20d7feffdbdca3ff458fce33dd05c1d98f3a87efa1feecc7f8f339ad8e59d8169e1fce3198c81210fc7dc0f75a
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5S5:TID41qW1PszVZX50
- TLSH T1FAE59D52B7D54863E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
- Size 3.1MB
- SHA256 87a9b34e2021c99434a8cce49492d1f24a81808eefe0b33d9a52b19508dbb9bf
- MD5 5311457fd45a86747882f75e3e21ecae
- SHA1 74e622fb1bc6c03c07870395cb7ea31b92f535ef
- SHA512 61706fbacd7a3e76b7bd80dd0ed81bb8dfbac97733ab4d277035c7e49e681ceb816772dc565a1bc73349babc262203cc11b03a08fd211b47586fdc1e9b8c8928
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sx:TID41qW1PszVZX5k
- TLSH T1C0E59D42B7D54963E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$
- Size 3.1MB
- SHA256 5bb1edbe3fc639827115769bd31772be7cfbbde1f0c0e1c26d4a9d2de3e78247
- MD5 e821c4f686eaec1c65003861c38d2348
- SHA1 480334a7d44567cbbed198431fd17ce3b0ded5ae
- SHA512 be1a0a64e46afab8b8abf9dc4665d671afd50593cc0df135c6dff2ddad4bafd275fdcf62773af4e298153ecff3c890fe018a4e9eaedf134957052bf2138e785f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5St:TID41qW1PszVZX54
- TLSH T19EE59D52B7D54863E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
- Size 3.1MB
- SHA256 b59f13b3bcee61578e52dc4204e35de01a809503c8acbb4d748b070d6b371f62
- MD5 c8d4214289185c84e22d5dcc67cd1052
- SHA1 bf9522d8e8bc4109bb14fe2ab82bcb7a68896bdd
- SHA512 8ebcd675a3f67ab3b0c084f56456e3bc2222f209406b62e36adbd7ebe16a5bc2a1c9b69a5f785b7dc776381323d2eb2829fa8983245e64b7028f910d27340d1b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5SM:TID41qW1PszVZX5B
- TLSH T157E59D42B7D54963E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 3.1MB
- SHA256 2af20fc3eaf08faf3da7d19983ab120083dc46ca9ebdb982b878926854b57b81
- MD5 88a4dff8de6dd041f47324f0d933e49e
- SHA1 755157f9fe670148680e6e757daef4ebd2124aef
- SHA512 3c7bb7aa794d103263e7b30971f33210e8baaa0a8b5e28c348a6f418793e0ad817b24740b1d6b8891dd7bed1f606d59e38c9d8715c427a2c88694c222f265eca
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sf:TID41qW1PszVZX5q
- TLSH T1B1E59D42B7D54963E1771232487752A21E72B9210F34E38F2398666D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$
- Size 3.2MB
- SHA256 71ef3433162bb8e0e3bd13b8c12d5a66767723f4f11dfe9e4d586022dbe5261b
- MD5 8fd7284818f67d56970df74700ac736d
- SHA1 24d8c86d705c3b39435185983bd7301556142bb3
- SHA512 6b3ec3a59d5e79d1597ae744a502730c29a6130ea2dc832de5640ab982c5b0c146ef665ef042743cb1ca5385eb13f2db3d9c8aee68bdd4b676331a9cf97c7a6f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sqs:TID41qW1PszVZX5m
- TLSH T132E58D42B7D54863E1771232587752A21E72B9210F34E38F2398666E5F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 3.5MB
- SHA256 890252a7e43ff90714d3c8bee97f14cbb91cef389cbf9840258ce5cb6cbf081b
- MD5 c3143dcf0d4a2bf56a6eedd1910595d5
- SHA1 e7a094e52db39065b0ac872c62577d5b974b2085
- SHA512 30c9f93dc53e3348aaa98a40ef34683b26b741d15485c2318a97c7d64a354899f21dbe9662726aed41e852a44eb0049aa073c90e32c7aa27d48a0dae4e50f4f4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5SVUOlk09:TID41qW1PszVZX5g9
- TLSH T1B0068E52BBD588A2D1771231497792921E727C210F34D38F2398A66E5F337C0AB37B66
- MD5 SHA1 SHA512 SSDEEP TLSH