Analysis
- max time kernel
66s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 2.7MB
- Sample261002-w2awsaxs2n
- SHA256 c5b12b9b62b404dd781d2f74f391d9bc509f8b7e9189ff4a54dd7688930a1c56
- MD5 223d37a6242802161da5e2f549ad9647
- SHA1 825c78bbe82b59b74a5a82f2f716a2aeb7fc66e4
- SHA512 3bc2abd963a57e9e255755ab843543066cf78f5fed8f1ce9b2412a287ad83ce023edc2ccf95d31c04f876c37ada7a2686d6bebceac060adaba83ad13600e8e3a
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhO:TID41KqLrr
- TLSH T1A3D55C4677D58AB6E46B0231886742925B73BC211F2193DF2390B67DAE337C0BA31B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 4516 patcher.exe 1372 475.#.exe 1564 692.#.exe 1120 219.#.exe 4668 951.#.exe 3076 54.#.exe 4444 220.#.exe 2804 352.#.exe 4432 960.#.exe 4160 48.#.exe - Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 219.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 951.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 54.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 220.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 960.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 692.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 352.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 48.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 475.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.exe 475.#.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 475.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ 54.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 219.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 951.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 220.#.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 219.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ 220.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ 220.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 220.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 219.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\ 219.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 219.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 54.#.exe File opened for modification C:\Program Files\Internet Explorer\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 54.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ka-GE\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ 220.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ 220.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\ 475.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 475.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nn-NO\ 951.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 475.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 475.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mi-NZ\ 54.#.exe File opened for modification C:\Program Files\dotnet\shared\ 54.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 220.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 219.#.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mk-MK\ 951.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 54.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 220.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\ 220.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 951.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ patcher.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\ 54.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\ 220.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ 692.#.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\ 692.#.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 219.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nn-NO\ 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 54.#.exe File opened for modification C:\Windows\:\systemlog.bak 220.#.exe File opened for modification C:\Windows\:\systemlog.bak 352.#.exe File opened for modification C:\Windows\:\systemlog.bak 48.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 692.#.exe File opened for modification C:\Windows\:\systemlog.bak 219.#.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 951.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 960.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 475.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219.#.exe - NTFS ADS 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 692.#.exe File opened for modification C:\Windows\:\systemlog.bak 220.#.exe File opened for modification C:\Windows\:\systemlog.bak 352.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 960.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak 219.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 951.#.exe File opened for modification C:\Windows\:\systemlog.bak 54.#.exe File opened for modification C:\Windows\:\systemlog.bak 48.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 475.#.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4840 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 4516 patcher.exe 1372 475.#.exe 1564 692.#.exe 1120 219.#.exe 4668 951.#.exe 3076 54.#.exe 4444 220.#.exe 2804 352.#.exe 4432 960.#.exe 4160 48.#.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4840 wrote to memory of 1372 4840 2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 91 PID 4516 wrote to memory of 1564 4516 patcher.exe 92 PID 1564 wrote to memory of 1120 1564 692.#.exe 93 PID 1372 wrote to memory of 4668 1372 475.#.exe 94 PID 1120 wrote to memory of 3076 1120 219.#.exe 95 PID 3076 wrote to memory of 4444 3076 54.#.exe 97 PID 4444 wrote to memory of 2804 4444 220.#.exe 98 PID 4668 wrote to memory of 4432 4668 951.#.exe 99 PID 2804 wrote to memory of 4160 2804 352.#.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_223d37a6242802161da5e2f549ad9647_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\475.#.exeC:\Users\Admin\AppData\Local\Temp\475.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\951.#.exeC:\Users\Admin\AppData\Local\Temp\951.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\960.#.exeC:\Users\Admin\AppData\Local\Temp\960.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\905c0769f9a06c95a24ddf945\692.#.exeC:\905c0769f9a06c95a24ddf945\692.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\905c0769f9a06c95a24ddf945\219.#.exeC:\905c0769f9a06c95a24ddf945\219.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\905c0769f9a06c95a24ddf945\54.#.exeC:\905c0769f9a06c95a24ddf945\54.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\905c0769f9a06c95a24ddf945\220.#.exeC:\905c0769f9a06c95a24ddf945\220.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\905c0769f9a06c95a24ddf945\352.#.exeC:\905c0769f9a06c95a24ddf945\352.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\905c0769f9a06c95a24ddf945\48.#.exeC:\905c0769f9a06c95a24ddf945\48.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4160 -
C:\905c0769f9a06c95a24ddf945\693.#.exeC:\905c0769f9a06c95a24ddf945\693.#.exe8⤵PID:3364
-
C:\905c0769f9a06c95a24ddf945\369.#.exeC:\905c0769f9a06c95a24ddf945\369.#.exe9⤵PID:1196
-
C:\905c0769f9a06c95a24ddf945\980.#.exeC:\905c0769f9a06c95a24ddf945\980.#.exe10⤵PID:4128
-
C:\905c0769f9a06c95a24ddf945\483.#.exeC:\905c0769f9a06c95a24ddf945\483.#.exe11⤵PID:5716
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 c5b12b9b62b404dd781d2f74f391d9bc509f8b7e9189ff4a54dd7688930a1c56
- MD5 223d37a6242802161da5e2f549ad9647
- SHA1 825c78bbe82b59b74a5a82f2f716a2aeb7fc66e4
- SHA512 3bc2abd963a57e9e255755ab843543066cf78f5fed8f1ce9b2412a287ad83ce023edc2ccf95d31c04f876c37ada7a2686d6bebceac060adaba83ad13600e8e3a
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhO:TID41KqLrr
- TLSH T1A3D55C4677D58AB6E46B0231886742925B73BC211F2193DF2390B67DAE337C0BA31B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe$
- Size 2.8MB
- SHA256 17ef859c8eba458e5800fd9e17271005089f9694faeb9c9c189e749b4c7a4e73
- MD5 ab5bfe85a62afa496a876a543d9a09d3
- SHA1 2df52fa73a847b1ec6ec295ab380bdea0cee8c03
- SHA512 3a2f373c40804f3984166858b91a17d070c44d917c26b34b733054d70853380799c8e67e24dba4dbbf65e7cbb48202732e006a530ec755812716d2af66ad0aa1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhOl:TID41KqLrrk
- TLSH T19FD55C4677958AB2E46B0231886742925B73BC211F2193DF2394B67DAF337C0BA31B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe$
- Size 2.8MB
- SHA256 f5b42caf65ac3abfb58a7929a32cd65813005af9831ccce822df99b7c604ad77
- MD5 b1c9163805844fbf960508f1b7be28dc
- SHA1 deff0d41281fea017b47428c68fb6c72a70ec537
- SHA512 d68a72c4e76c0e5d2d33246ad7650907a6afe87205354769fc9dcbee017e0c0936a9d2c5a4522f3ea2a217bd00ee730e84109e814c45b510f456f138c700b2b3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhOo:TID41KqLrrB
- TLSH T163D55C4677958AB2E46B0231886742925B73BC211F2193DF2394B67DAF337C0BA31B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 2.8MB
- SHA256 601b31af05f08ad0fd0e54e27964059e588f2bb4ca3e292092f805d99783e5c8
- MD5 317587e0300126d9cffe86e106bfe387
- SHA1 15e3b509a032358efd37aac513ae5c64cf2e4864
- SHA512 d1f606ac600f6a1de50e9af43b474beb7f8fc9d6aaa493eacba783516733884c0b25e11c49548195828b33fed6d780415c846ca0269bfd75fe05680290a4eaf4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhOO:TID41KqLrrz
- TLSH T1C2D55C4677958AB2E46B0231886742925B73BC211F2193DF2394B67DAF337C0BA31B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 2.8MB
- SHA256 d0671cdaddd4ec03c9447777a5a75c0243a715a6e497b4a99791cb96baa3da1d
- MD5 e0ebae020117361cffcc2f1a40212b21
- SHA1 cb443c0a7d187f1dd082058ab0e5888c576f5b11
- SHA512 d2071ea9bc1294d8a13e9f60781420ba495208fbc19c732df9ee642cca362ad8668a7d97bb61561ab093ee3ead9ff21fd2dbe1157b2eb575634d6e52829e6d9b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhOf:TID41KqLrrm
- TLSH T105D55C4677958AB2E46B0231886742925B73BC211F2193DF2394B67DAF337C0BA31B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$
- Size 3.0MB
- SHA256 73512633d8ef707d00761f5d97c41d7997126b1e252b62c94ec5db0271381437
- MD5 3536d978f918f132b80b913cfd8bc6a6
- SHA1 be9399de3edea4a32088aadc3509409cee99f084
- SHA512 9e188a6722126289bd963b3a01076b0d4208b6f9de93ede1ac4cf82beb25a4ca40b4c473eccdae8513cd2b118f67adb149a7a858b6c8019b39fb0634e77a9584
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmlXpChO9XqatglP56rrhOWTeX:TID41KqLrrdTQ
- TLSH T120E55C46779589B6E46B023189674262AB73BC211F2193CF1390E67DAF337C0BE35B52
- MD5 SHA1 SHA512 SSDEEP TLSH