Analysis
- max time kernel
104s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.9MB
- Sample261001-pfmvwsseqf
- SHA256 b52cb34a1b4509dee759d28aa1eabf210ce5734656e727c4d148daba5435d98a
- MD5 7241d20562ad8a29fa884aabd90fd4b3
- SHA1 c58dc6f8b80062fa37ca26b1d9a1ccbf5ab3076f
- SHA512 be6890c3bf8deda625353c23be07937b25b4b8a97dd9dc74b8c1f7077591723c32dd98ec32f3c8aa93c0e45e2876a38c177e1e1543fe9ead665e720eb61d618a
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMME:Tuqxs
- TLSH T14E167D42B7D58862E0B70232593752A21E76BD150F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3592 patcher.exe 1536 401.#.exe 436 72.#.exe 2820 327.#.exe 4228 803.#.exe 4812 177.#.exe 4296 450.#.exe 3340 96.#.exe 892 980.#.exe 4876 100.#.exe 4752 619.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 401.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 327.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 980.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 619.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 72.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 803.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 177.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 450.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 96.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 100.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gd-GB\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ 72.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 401.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ 72.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 72.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ 177.#.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 803.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 177.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 72.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 327.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\ 450.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\ 450.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 401.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\ 72.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\ 803.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\ 177.#.exe File opened for modification C:\Program Files\Google\Chrome\ 450.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 96.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\ 72.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\ 450.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\ 72.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ 401.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 803.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\ 401.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\ 401.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ 72.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\ 803.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fa-IR\ 450.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\ 450.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 450.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\km-KH\ 327.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\ 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 450.#.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 72.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\ 803.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\ 72.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 450.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hy-AM\ 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ 401.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\ 177.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\ 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\quz-PE\ 327.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\ patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 803.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 177.#.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 803.#.exe File opened for modification C:\Program Files\Common Files\System\it-IT\ 96.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\ 803.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 450.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 327.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 450.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\ 803.#.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 96.#.exe File opened for modification C:\Windows\:\systemlog.bak 100.#.exe File opened for modification C:\Windows\:\systemlog.bak 619.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 72.#.exe File opened for modification C:\Windows\:\systemlog.bak 803.#.exe File opened for modification C:\Windows\:\systemlog.bak 177.#.exe File opened for modification C:\Windows\:\systemlog.bak 450.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 327.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 803.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 177.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 980.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619.#.exe - NTFS ADS 12 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 401.#.exe File opened for modification C:\Windows\:\systemlog.bak 803.#.exe File opened for modification C:\Windows\:\systemlog.bak 450.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 980.#.exe File opened for modification C:\Windows\:\systemlog.bak 619.#.exe File opened for modification C:\Windows\:\systemlog.bak 72.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 327.#.exe File opened for modification C:\Windows\:\systemlog.bak 177.#.exe File opened for modification C:\Windows\:\systemlog.bak 96.#.exe File opened for modification C:\Windows\:\systemlog.bak 100.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4184 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe 3592 patcher.exe 1536 401.#.exe 436 72.#.exe 2820 327.#.exe 4228 803.#.exe 4812 177.#.exe 4296 450.#.exe 3340 96.#.exe 892 980.#.exe 4876 100.#.exe 4752 619.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4184 wrote to memory of 1536 4184 2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe 92 PID 3592 wrote to memory of 436 3592 patcher.exe 93 PID 1536 wrote to memory of 2820 1536 401.#.exe 94 PID 436 wrote to memory of 4228 436 72.#.exe 95 PID 4228 wrote to memory of 4812 4228 803.#.exe 96 PID 4812 wrote to memory of 4296 4812 177.#.exe 98 PID 4296 wrote to memory of 3340 4296 450.#.exe 99 PID 2820 wrote to memory of 892 2820 327.#.exe 100 PID 3340 wrote to memory of 4876 3340 96.#.exe 101 PID 4876 wrote to memory of 4752 4876 100.#.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_7241d20562ad8a29fa884aabd90fd4b3_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\401.#.exeC:\Users\Admin\AppData\Local\Temp\401.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\327.#.exeC:\Users\Admin\AppData\Local\Temp\327.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\980.#.exeC:\Users\Admin\AppData\Local\Temp\980.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:892
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\905c0769f9a06c95a24ddf945\72.#.exeC:\905c0769f9a06c95a24ddf945\72.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\905c0769f9a06c95a24ddf945\803.#.exeC:\905c0769f9a06c95a24ddf945\803.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\905c0769f9a06c95a24ddf945\177.#.exeC:\905c0769f9a06c95a24ddf945\177.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\905c0769f9a06c95a24ddf945\450.#.exeC:\905c0769f9a06c95a24ddf945\450.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\905c0769f9a06c95a24ddf945\96.#.exeC:\905c0769f9a06c95a24ddf945\96.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\905c0769f9a06c95a24ddf945\100.#.exeC:\905c0769f9a06c95a24ddf945\100.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\905c0769f9a06c95a24ddf945\619.#.exeC:\905c0769f9a06c95a24ddf945\619.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4752 -
C:\905c0769f9a06c95a24ddf945\283.#.exeC:\905c0769f9a06c95a24ddf945\283.#.exe9⤵PID:4728
-
C:\905c0769f9a06c95a24ddf945\602.#.exeC:\905c0769f9a06c95a24ddf945\602.#.exe10⤵PID:2024
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 b52cb34a1b4509dee759d28aa1eabf210ce5734656e727c4d148daba5435d98a
- MD5 7241d20562ad8a29fa884aabd90fd4b3
- SHA1 c58dc6f8b80062fa37ca26b1d9a1ccbf5ab3076f
- SHA512 be6890c3bf8deda625353c23be07937b25b4b8a97dd9dc74b8c1f7077591723c32dd98ec32f3c8aa93c0e45e2876a38c177e1e1543fe9ead665e720eb61d618a
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMME:Tuqxs
- TLSH T14E167D42B7D58862E0B70232593752A21E76BD150F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe$
- Size 3.9MB
- SHA256 811e817e3928f314e5a2358c8e2854f4a4c411adc1554902b0a2f7ebc6a1de5e
- MD5 2ecdf4f56bb48cb57c59f55527e54b1f
- SHA1 6872458aa2019f4a1ad441982373e7e99d4133f7
- SHA512 04039ffbedafbe3ad269c266cd21d90192473925a760313ed16f920cefed96d5a38c2fb9c38911d10e770c710fce24d2a61ee0adb2ece17801e153f199f6eb72
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMM1:Tuqxsb
- TLSH T1BC167D42B7D58862E0B70232593752A21E76BD150F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe$
- Size 3.9MB
- SHA256 6990c276b267a2b68d69bdd25e7a67b46fdc9067ad305d99fdf9f18c74d1bf23
- MD5 425f3aaa46798a1f051e368d5d17ed7f
- SHA1 bb9cc54d7fadf7a5c512f957e0c232de18209d10
- SHA512 1ae6ba9eb71a0918138e2a1939740514238c0b6b76fc44cae3d383ffed5485afa194600761ef53eb6b24b54384c3e832e2a465ce768edc81e124af2e9791423e
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMI:TuqxsK
- TLSH T1AD167D42B7D58862E0B70232593752A21E76BD150F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe$
- Size 3.9MB
- SHA256 e8ded8177883fa3166b70e75756f914cdfb6f534ddbb173262afd30efb70bd09
- MD5 a5312ec9b93f589bf88a54d25f1d2c7d
- SHA1 9cf2e91f50c0f4c7b8ed34118b39c00551831d33
- SHA512 4ae6ecc93900523bd304c070b2455f44f1fddbbe36834f9450b7055ab40a30b90eabfb791fa7614cbfc9fe66a673ef301cba72f9c3955683e9e6781f5f5888f0
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMI:Tuqxsm
- TLSH T19F167D42B7D58862E0B70232593752A21E76BD150F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 3.9MB
- SHA256 ba4a2c6a81eca84915724e4ae70406a677d19724e2341d823469411d5e04f3d9
- MD5 0b06541579eb597294980d3f46cbc250
- SHA1 6548f6c96a142722992d3aa9f2fe8bb44e28959b
- SHA512 78fa3bcc88b41d169b085449b90afd0036ae7cd834ad90e08c7ee1d1859c417f74c0b1bf681ce4ea60f38d95a9dba21a55181436413e1b1c9667fb4a780ca3fd
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMu:TuqxsQ
- TLSH T129167D42B7D58862E0B70232593752A21E76BD150F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
- Size 4.1MB
- SHA256 a83793e5e225ceb218931f0c63e61b94baaba0360cf01a20f361eba16de7d72d
- MD5 acef8bd8a248ed7dbe58c4993f0b1d26
- SHA1 f55c31785ddb555b62b3c567253e5399b9bb9d88
- SHA512 97598433fb005bf44b0914becd8ce52fbac25133b0c8def6aad1cad48a121d293b567db397d5a9896bc827b2a128bd0b88d2548daf311399c8cf1cd748d1cb03
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMT:Tuqxs4TQ
- TLSH T1AD167D42B7D588A2E0B70231497756A21F76BD110F25D24F2398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 3.9MB
- SHA256 39f60410968ca950b8ce94e0650e1fd2fd6fd31797172d425b69481c06d6a8bb
- MD5 17df44d50b14e8645660b8e1713eabee
- SHA1 67c47990e57ce41abbf9a247c34e8497fa3982ce
- SHA512 03209161f6a2d595e92e6bb753afe0f9f80235810e79253608ebe4688deccc2f93f2f163c1327d6f5095d482e68393c7ca5bf0a2bd6c7a96e4ff54d686505de3
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMl:Tuqxsr
- TLSH T1D9167D42B7D58862E0B70232493752A21E76BD151F25D24F3398776E6F337C0AB327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$
- Size 4.3MB
- SHA256 294212e0164e506780635a7f9776919fb30f77c7965018c9967d27dea7d2b686
- MD5 bfcd78c9d6995bb54ff6c69121fff70a
- SHA1 54ac9e73c12b8d73a63e6b89506c1f61eff02322
- SHA512 9f8140a9db0896d64d4bd98ba48387914178fcdfa5dd5b67b7de32dbace07967b970cc5516ca74fa8080762c9e6657e333694c64ae8c49bf223fa5a64493e9e5
- SSDEEP 98304:TID41qW1PszVZ5KMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMw:Tuqxs6
- TLSH T1A6267D42F7D588B2E1B70231497796A21B76BC150F24924F2398776E6F337C0AB32766
- MD5 SHA1 SHA512 SSDEEP TLSH