Analysis
- max time kernel
87s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 14:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.7MB
- Sample261002-rb18tsbf58
- SHA256 615ad187cb73a58faa60be6a55dc2ebb40d20e1aaf6858cdee05d6c6e42563db
- MD5 5ad11a7579533cb063e8c44df019118e
- SHA1 f3174b646160dc2931d995118bace57dd90ba089
- SHA512 cf1e6713c2665889ef47f1b2568319633a5b49e0acd244e947e0bc47eb636f81070a74b674a72740e8c933c1db705067e238844d20bc97c4da5d08eb9b38ed6d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1z:TID41qW1PszV1XAt
- TLSH T1F9067C46F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 5744 patcher.exe 2036 884.#.exe 1276 723.#.exe 1452 497.#.exe 2984 773.#.exe 2580 738.#.exe 1672 647.#.exe 1104 276.#.exe 4972 733.#.exe 3312 467.#.exe - Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 884.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 723.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 497.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 773.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 738.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 733.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 647.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 276.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 467.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\DESIGNER\ 723.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 773.#.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\ 723.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 647.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ 738.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 773.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ 647.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gd-GB\ 773.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 738.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 738.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mt-MT\ 647.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\be-BY\ 884.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ 884.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ 738.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 723.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\ 276.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\ 647.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ 647.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 773.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ 884.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 884.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 773.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\ 773.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ 884.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 738.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 647.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 773.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 723.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 738.#.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ 647.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 497.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gu-IN\ 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ 723.#.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ 723.#.exe File opened for modification C:\Program Files\Google\Chrome\ 773.#.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ 884.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 773.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ 773.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ patcher.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\ 884.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ 738.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ 738.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 773.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 884.#.exe File opened for modification C:\Program Files\Internet Explorer\images\ 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 773.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 773.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 647.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\dotnet\ 723.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 738.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 647.#.exe File opened for modification C:\Windows\:\systemlog.bak 276.#.exe File opened for modification C:\Windows\:\systemlog.bak 467.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 723.#.exe File opened for modification C:\Windows\:\systemlog.bak 773.#.exe File opened for modification C:\Windows\:\systemlog.bak 738.#.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 276.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 884.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 497.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 738.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 733.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 467.#.exe - NTFS ADS 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 276.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 733.#.exe File opened for modification C:\Windows\:\systemlog.bak 467.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 884.#.exe File opened for modification C:\Windows\:\systemlog.bak 723.#.exe File opened for modification C:\Windows\:\systemlog.bak 647.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 497.#.exe File opened for modification C:\Windows\:\systemlog.bak 773.#.exe File opened for modification C:\Windows\:\systemlog.bak 738.#.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 476 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe 5744 patcher.exe 2036 884.#.exe 1276 723.#.exe 1452 497.#.exe 2984 773.#.exe 2580 738.#.exe 1672 647.#.exe 1104 276.#.exe 4972 733.#.exe 3312 467.#.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 476 wrote to memory of 2036 476 2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe 91 PID 5744 wrote to memory of 1276 5744 patcher.exe 92 PID 2036 wrote to memory of 1452 2036 884.#.exe 93 PID 1276 wrote to memory of 2984 1276 723.#.exe 94 PID 2984 wrote to memory of 2580 2984 773.#.exe 95 PID 2580 wrote to memory of 1672 2580 738.#.exe 97 PID 1672 wrote to memory of 1104 1672 647.#.exe 98 PID 1452 wrote to memory of 4972 1452 497.#.exe 99 PID 1104 wrote to memory of 3312 1104 276.#.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_5ad11a7579533cb063e8c44df019118e_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\884.#.exeC:\Users\Admin\AppData\Local\Temp\884.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\497.#.exeC:\Users\Admin\AppData\Local\Temp\497.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\733.#.exeC:\Users\Admin\AppData\Local\Temp\733.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4972
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\905c0769f9a06c95a24ddf945\723.#.exeC:\905c0769f9a06c95a24ddf945\723.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\905c0769f9a06c95a24ddf945\773.#.exeC:\905c0769f9a06c95a24ddf945\773.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\905c0769f9a06c95a24ddf945\738.#.exeC:\905c0769f9a06c95a24ddf945\738.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\905c0769f9a06c95a24ddf945\647.#.exeC:\905c0769f9a06c95a24ddf945\647.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\905c0769f9a06c95a24ddf945\276.#.exeC:\905c0769f9a06c95a24ddf945\276.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\905c0769f9a06c95a24ddf945\467.#.exeC:\905c0769f9a06c95a24ddf945\467.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3312 -
C:\905c0769f9a06c95a24ddf945\393.#.exeC:\905c0769f9a06c95a24ddf945\393.#.exe8⤵PID:4104
-
C:\905c0769f9a06c95a24ddf945\465.#.exeC:\905c0769f9a06c95a24ddf945\465.#.exe9⤵PID:5668
-
C:\905c0769f9a06c95a24ddf945\346.#.exeC:\905c0769f9a06c95a24ddf945\346.#.exe10⤵PID:4752
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.7MB
- SHA256 615ad187cb73a58faa60be6a55dc2ebb40d20e1aaf6858cdee05d6c6e42563db
- MD5 5ad11a7579533cb063e8c44df019118e
- SHA1 f3174b646160dc2931d995118bace57dd90ba089
- SHA512 cf1e6713c2665889ef47f1b2568319633a5b49e0acd244e947e0bc47eb636f81070a74b674a72740e8c933c1db705067e238844d20bc97c4da5d08eb9b38ed6d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1z:TID41qW1PszV1XAt
- TLSH T1F9067C46F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
- Size 3.8MB
- SHA256 2506c5e1bbc70f0fe96e9691523f74019a506e282074a328180ce7eebd30f1f7
- MD5 0cd7cc407c64fa0a30035759ff34ce15
- SHA1 beee92faf71ff859da0cf056d3c9be9654045689
- SHA512 e2ec5e2f8d2a18ef012931ab385b70d293bb67d9de811133e9a5cdd68afd76a0d1c974f7f231c495a3c6a2e9f7dc0d71361a91a9e898540e83895587df4dae39
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zW:TID41qW1PszV1XAtj
- TLSH T124066B46F79481A2D06B4131C6A752A6BA7378111F7196CF23C4E67D6F337C0AA36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$
- Size 3.7MB
- SHA256 371672037c7352226a2ed9f77340c4f17f5f2b224251d021b83695b4f195ca4b
- MD5 93c4be4280b2fe04dbab144e672e4425
- SHA1 fbb2ffb9cefe718d8cc36bd8cb1b64b4520a7105
- SHA512 b7afb432dd8e6ebde8beedafc93c70f46f01c0b4b8291045f3ff647d12b30894a5076ea8b257ff9dcdcc7846c2a550fbfaf7e49cec829c2a90f4a50fcc359a52
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zL:TID41qW1PszV1XAti
- TLSH T192067C42F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 3.7MB
- SHA256 f16064fed2a0a01a80a1f26701862737732d83a4b6e73463cc15e964bc799780
- MD5 86d5c23954c0c6177410131243c102cf
- SHA1 904e47c4243ecb2fcf9f75862985e13fcc2c2a1b
- SHA512 1d910e131446b076f80fdc5684de64d8770c758ccff85bb04e4507ad0598927763b9a12017e249245574969f5b248890311443f3266a8e5957317402f47aaf97
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1ze:TID41qW1PszV1XAtv
- TLSH T122067C42F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 3.7MB
- SHA256 f66dc5e95db796c6a90f53ef3fdd5ee7332d837a51a298ad8d03bddd75d95469
- MD5 1b5038619ff882a5978ca6b584e73ab3
- SHA1 ada62744bba7568346771781f3135401d221b375
- SHA512 c5cedf06c2f1591cb6397e0af90bdae68301e7d3b968a6a61004b246fb46c77aaa603968ccd99c94b7fde01aa0137e2022de99e34e8c3db539fb7da506c44c03
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zJ:TID41qW1PszV1XAtE
- TLSH T10F067C42F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$
- Size 3.7MB
- SHA256 489893b949e963affc53afaca6e92354c7a57a40129f955b4f5bb6a116227049
- MD5 47d34330ff8d7c1612d5c3fb909fac74
- SHA1 4ad1c3bb49ac93b62a51eeceec8e5ee199f76da9
- SHA512 4da887079fd66a7ad4f356568960a832a491714406fe4f1f6c2f9ff4faf60bedd660837f90f79600c937fb51665ed1bc856d459466e6ea7fd1c94e2c8acf4fb9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zb:TID41qW1PszV1XAtm
- TLSH T1C7067C42F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
- Size 3.7MB
- SHA256 dcc93388d0ab513c975f0d60545d96b00d018395d178246b07a02066dc8ab9b2
- MD5 46ca57e2b84b567ad548dd9c24233deb
- SHA1 9db05aca01458988f7431e38fb0e5b1aa5d14a42
- SHA512 494657a5341a8f0d9e5df29d5f3d733d393b6e97950b8de07059009faba94d21f7370059e0b5f098640d7c6e2be127a5c589cec06582a1ad546113b1953d8a0f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zo:TID41qW1PszV1XAtx
- TLSH T1A5067C42F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 3.7MB
- SHA256 41213f843be3979403a3a218ffa948a0ea6fdcc0b16c0560386bffd456be3805
- MD5 abd271987bd3a38553f7e316b136d5b8
- SHA1 45b64d70f776fe8ccc649d7eecb9f6f66cb06ef6
- SHA512 a2c37ab5f43837c0e008b45375386730254086d33a45d8b99f5e496d07b0a427e09981c7a57fde11425fca6bf77bd8d33294821187e68ef374fb31693ebaec95
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zn:TID41qW1PszV1XAt+
- TLSH T1F1067C42F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$
- Size 3.7MB
- SHA256 88bfa5c12b137ac4f559e4e83d42f1eefc39a45cf918adf47ae490578f045ef3
- MD5 af2ed3f58e01723fcb12bfb9e6c0bd40
- SHA1 d2745b4181499a374a6011c279fa0a5b2c4d914c
- SHA512 538aa90e186ad2a49f796376843c4c577c14c6ab3caf50ac2ab5fe7e73b3a082180478cf4e7da9d8146abefccaec4e7eeba499c186d2d7216a593d7d3c89eae8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zR:TID41qW1PszV1XAtQ
- TLSH T1FD067C46B7D482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$
- Size 4.3MB
- SHA256 25a7f526c7e0a78548aca7293275fb3bebd7487ffdbbb49e1a339878fbb526f5
- MD5 5d04e09414394a178e54ae9667afa1cc
- SHA1 9ffce5eaacfe92aac9d52814b06bcbcfed171750
- SHA512 958bac3fa95924bc99fdbf5eda26539aa79457fc94317aa15808bb950592d15bf7bfb484ec7df9d8336df495f967c240ea7c4c51081340a6d4331bf5468ec386
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1z5:TID41qW1PszV1XAtBxGX
- TLSH T142267C02B79481B2D0774131C9A752A6EB7278121F3096CF2394E67D6F337D1AB3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$
- Size 3.7MB
- SHA256 4f64d9b431226c4c11bdd734f6fdeb1af28d806c120da34dba0c603fb4c104aa
- MD5 1a04d82d1ecdf7f3bfa055ab92cd38c5
- SHA1 f2ab7f62a06828544f1c6dd549008967434f1ae8
- SHA512 ff1064478557c8214ea1522f2972e88f8a49fe3f7a9fa9bee7c6e30e8da409c42a83184fc9f54c95cf596b033d7fae7778743bf9cf15049729d7460f732c5c17
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1zo:TID41qW1PszV1XAtR
- TLSH T12E067C46F79482B2E0774131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$
- Size 3.7MB
- SHA256 20efd5fbe4bfacd579b131ef39720039c172530f80a0330e70061856bf71672f
- MD5 f39c2bdfe0bcfaab4f8b54dd02e19e46
- SHA1 a4cbbc2f9cd346ed938a726e65902516f4f27151
- SHA512 12515b9585edd50965c0bfecaa2b6b16835e5adc2197a426f2d0a5df3a8703708d09ba06083567e3ac2aaf0002051cdbba16ed7050190059150488d5b5442b6f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglYqatglCJqJtb2IZy6i1z7:TID41qW1PszV1XAti
- TLSH T1CE067C42B7D482B2E0775131C5A752A6AF7278111F31D6CF2384A67D6F337C0AA36B26
- MD5 SHA1 SHA512 SSDEEP TLSH