8648d153ca0729001a5467b9c8fe63f7b4bae7f948f60327b0f549abc3351f5e

Analysis

max time kernel
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 900KB
Sample260629-ejnlgscw81
SHA256 8648d153ca0729001a5467b9c8fe63f7b4bae7f948f60327b0f549abc3351f5e
MD5 ad52ca73142bf285161c4240dc127059
SHA1 86140bbafc45034959262313307eb4e2ee6dff97
SHA512 f85b4e4350a86aa5413a12485286fcf0da06d785ffe8af0009dc405fa9b98a3a95913a5baefef5d0061e54cfb37bb4687ff49e82ed26a54e87bf19c000963652
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqc:A3k03kB56r7
TLSH
T1CA156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 49 IoCs

resource	yara_rule
behavioral2/memory/3784-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c40f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b309-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30e-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2632-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3784-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c7f-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-251.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-303.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-415.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-453.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-472.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-485.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-501.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-656.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-810.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-968.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1155.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018907-1487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001890d-1536.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001891c-1573.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 46 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c40f-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b309-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30e-39.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c7f-60.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-198.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-205.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-244.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-251.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-258.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-303.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-359.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-415.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-453.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-472.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-485.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-487.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-501.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-656.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-810.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-860.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-943.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-968.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-999.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1155.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1186.dat	aspack_v212_v242
behavioral2/files/0x0008000000018907-1487.dat	aspack_v212_v242
behavioral2/files/0x000800000001890d-1536.dat	aspack_v212_v242
behavioral2/files/0x000800000001891c-1573.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2632	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3784	2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2632	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad52ca73142bf285161c4240dc127059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3784

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 900KB
SHA256 8648d153ca0729001a5467b9c8fe63f7b4bae7f948f60327b0f549abc3351f5e
MD5 ad52ca73142bf285161c4240dc127059
SHA1 86140bbafc45034959262313307eb4e2ee6dff97
SHA512 f85b4e4350a86aa5413a12485286fcf0da06d785ffe8af0009dc405fa9b98a3a95913a5baefef5d0061e54cfb37bb4687ff49e82ed26a54e87bf19c000963652
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqc:A3k03kB56r7
TLSH
T1CA156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 929KB
SHA256 a072df1f7ed89017541f81c2c0baa0e06c5ca9e53f72f8e48072ff3ccb1cc3b0
MD5 38e1dbc99c81ae5fc7ea1e87a2817df7
SHA1 6ad0be6a53f359eb2c6039a8613241f2c7e7d83d
SHA512 204835911353edae53d07629ea136092033e7a84e67b3d0058f9d58b4ddc36756f5f54ae61ea3934e694047758ae0f9da491074d09d860e94550559cc8e57ed7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqGP:A3k03kB56rV
TLSH
T151157B03E6850FA5D10FC1749A968662EA777C125F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 947KB
SHA256 9f86605201066fbfd5c0471bdd5d53b052b3affa17ce97891e93d7c3481c265e
MD5 3d9dac5f47d0e57b1ecdfbb6a871cc61
SHA1 a5100f56efca335cb01180d3c5bfda7fa6ef71ec
SHA512 32f2602cf364a82c0aa4d36a9de2b17543af07eb62210c657474da27fed99c26be4f3f0e106cb28ff50f5f7bca81c10be27e8d29decbe71d88c89eec18782840
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqp0:A3k03kB56ry0
TLSH
T1A4257B03E6950FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 953KB
SHA256 536080d515ed458e0d9480cf77629b2d60cf21e4160437e26c3a8b63207fca75
MD5 79a6f3c3c39470011f307d720ebe9123
SHA1 4720d37c13f09688a766c40848dcae4938e5c5a5
SHA512 792cff227a63ea7f65f7aaa125d8e85ebff5a67476acc81a2d3ef35a4e71c9081caaba8dd59c0d050b38919c336cee82bca8e8cb1514c7eed93da4c32d676ff3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqHfj:A3k03kB56rYj
TLSH
T157257B03E6850FA5D10F81749A958672EA777C125F2093DF2358AE153F72BC06B3A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e73e9e685c76f969d3d1dd8a941915fe4dd9e6d14d8c04ed7e49013804648220
MD5 73d6a674134eb092d1f38b722a85e1b7
SHA1 7dd933c0d04ef72f336a8342ffa97e87471aab67
SHA512 2656df98ee088bcd132d16721266f777ce4d39f1b809df166fae4dac0bc8bbbc1a2d46f982783592df90b2786bd91c4000fdf30b24d44a2bb2e0f601ee63eb5a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqk0Le5ji0hmxNrM:A3k03kB56rnPji0Aj
TLSH
T16D655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 915KB
SHA256 0dafc1a7d7171213625a5030ed6995b38e7f19144ce56e1509807e468533b83b
MD5 046b92da1f194c5205ed0c573ea14dc8
SHA1 5a8b0358c9410f9e89bd060032131d8ac537ef74
SHA512 432bed2c3c2ca3cfe50abb61c97ce2e1a79e4fe9718fb2d07fe8dd9419a0e5e04e3faad11f1804797812ae631d436fc3ed40aa8045049b6f77c39d8bf4966918
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqOa:A3k03kB56r
TLSH
T11C157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 948KB
SHA256 f5b1186a1d112f9b7aa7c956e117a09c2e3c14f9c271d96be2c133ae4ed6bfcc
MD5 c6ed4be311ef5e8d22956de7d329f114
SHA1 791fadd58892a8afdcb05b994db18900d987a482
SHA512 7adc89d08e8e4335cc92592b5c258307a06f4600c4952284264a30b310e6f9fe4e74c901eb5292c7a78dfae94858dfd091b158cab9bd7810923f0b88131764ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqNb:A3k03kB56rqb
TLSH
T1BA257B03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 924KB
SHA256 a69e34ffa13f50935f26c65009e78def3f10a21e2f5a23a9a9290cab246da8db
MD5 423307060b78425ecb6e909c4895ac81
SHA1 d1dce729f8a1baf07f4f576754ff2b2de4937702
SHA512 bd6603b6b1e75d2f77e6d12ac6b783a49a238488da9bb74067f54880c764816eb3cb096faba3c6b549288d50d41de4cda64fa7a24a6462e8540cccf4b4dae062
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqQZ:A3k03kB56rL
TLSH
T11B157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 924KB
SHA256 aba9dd01b96c8a0e8497bd4b56cc19ea8c6961bf9b1a4f6d494e40c32faace9b
MD5 56257c6df09f88aff5cfc97dbd39a000
SHA1 9f45436288c871960d470f63f2bc623ab2efd9d2
SHA512 b7148fc45b05402ff76fc4d364a21d0570f00761104d1c29b4f4d9a49f1dd6b75aa4791bbd49e087237affab401e7da10d7e43b027bc1cfb4d57f1c0f765b268
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq31:A3k03kB56r0
TLSH
T1D5157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 364b1f8484e24e5d66a1897455318c5484e2ba4d0cd13adbe6e0c6eb149147ad
MD5 d23c51f5fe551a44e49af29a6bd60c2c
SHA1 8362681d28bb4ff1532e62965236f4d5334beb5f
SHA512 c4f0148b6d5a21859f84e08a0a2a1400121c367f652178397066e035d399b4df7005ec8e336ef56b82c6b91c26c0b0c11266093e634213164e41c2e6f0b9543b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqv6:A3k03kB56rv
TLSH
T17E157A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 a9fbc9397d5f852c2b972ad3901b137b74f0e14c62c2a849d7afbfa20cf922fc
MD5 e284253d12d49db9007302e51aa9f941
SHA1 4244b62f1446d814c5a6ac65c66c9adf1930f0ed
SHA512 d29bf01f6ee1fc8be12996e14d7ac453ab28da2ecc6be725e3fff4d4ae37db3d524e61d27dccb4205d8574c9ccbc5355a9fdd0fee20f2695e0b1d2e6b06278c9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqxN:A3k03kB56rS
TLSH
T1FB157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 5484f4e3ef2fd89061899e1a37f2dba2f73819e6b5c67a444edfdf68534184f6
MD5 d52e9fc8d68cc3896cb14fb4bddb94bb
SHA1 99c089b14f9727d258b563e5b2176ac04f98be78
SHA512 d94e7aa3b6160cb67fc3cb9de46f56de3a43323810e16789d8fc97eeba6f0c329f5b5f45c4eb1181fe21b87e15a51ab484ee36d1db0ebf39be3f8b9b18623427
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqnf:A3k03kB56ru
TLSH
T18E157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 26c255d8d87c936af6c9c56b1e2e26695419dc3b228c842ecfc9bf49a74c9751
MD5 86585b634fe29f82417c9d9d2015e0c4
SHA1 6da9816bda2e7cdea611f7bfe17d53cd90f67a90
SHA512 f488edd64e012e73ad7a1ec504bb9f34fc0ecd7f843e56d112d5dcb6b574b133747f4eaf82959e1a22a993a3a1e019ca6b857ddb5ddfa3f0c6d4339ef3dc7be8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqpo:A3k03kB56rP
TLSH
T161157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 b47e546bdfafea5b0535738f955f02c7b63115702e71a01542fc4373656f51a8
MD5 577d1b8ad597942398be30446ee2a4fd
SHA1 eb62d1ad034097a28f7d71464cb8066435a79dbb
SHA512 08acc117bceb54cfbdcecea75a8cd1ce64970edbe344a917779f4e2c9727b402178c2a0e2dc4e069f0f02b69b7841f29a9096b30d96fcf66e8c686b18668a0ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqZu:A3k03kB56rB
TLSH
T16E157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 059c4333219aac93891c4ad3ee30c861287ae52d0f4b66235c70c7a7230e42e4
MD5 a9eeed0086ca728c0beed8e707be0e5e
SHA1 1214cfe1959d844cdf4b503693fa29e3d8e76cf9
SHA512 2a5730780726fd81d7fec9601213fc5c172fdb7d8b923d0e0e7236d9dfd00e65cd527d2102e190c3e78a00c2d370a5c191eabc5beea380be91bc3da1d40e3c6d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq/9:A3k03kB56r8
TLSH
T14B157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 2158fb18b5e69861ee5e6196dd3f97ffa8691f669cf59376598e9002c9cb7d5c
MD5 1704102c1c0a925ac97b747ec151c36a
SHA1 2cc29cabde231372e59b7979bcde78cd71e83680
SHA512 09c71d21be0394ba64b273ff54fafab49ca20e766684bd39b121d282b7c9c40c4c2709f1fe6e5b10a37341acb2a51d46cb85d80f43c1201bad66ae99a13a8e8d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqbc:A3k03kB56r1
TLSH
T1AE157A13E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 ac84f6743e431833425a05fdf2e0cec25d0d0e3159edaf7788faf19d11850790
MD5 aad76cbcc3e62eda20df4a2a1c950461
SHA1 075ca4a80c2b69878fed389c663dbf260dee2401
SHA512 6558769e72264b0176867e180043a87e4e9f9f3fb556021054e7b17d59638d2c48795b1618ec4273db76b212965a76b3d71ea44ad1ed3f13760e04fd90e4e0d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqEp:A3k03kB56r7
TLSH
T106157A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 1f93a97d87a6daab8a4cfbf23f4a88a9cf91502fb4ed3eeaa374de360ccd6a69
MD5 ab8df362181efa636d389bd87b82ff5b
SHA1 99f772afa621d74f12e9aa7a6b382f2ceb185f25
SHA512 4c417cae6b39489048c3e8f8b10622c2024c4cda9b85b0374b002b0f7faf46219aa98d0db8a9a1292a923dbf71589641c4ee179d6210369d5261f22c3ef6baca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqLN:A3k03kB56rA
TLSH
T194157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 e707b2e2a3b28cda7cbc4b3f71be7dcabc82421f47d124b4ee323a11f67751b3
MD5 b7dd07502aa0885f04d20440a8fbea0c
SHA1 55191fbf0d8658cac3a798e3ebb46df5a89be1f3
SHA512 852ea0bdbac13fda742f5de29eeb74fa5b7d9915c401b7ea5cc5f348b052ca36e53f295f01158ca545f3e1fed43a5dcecb65bfb9071dacb64fc296a36a6ca45a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqZF:A3k03kB56r2
TLSH
T1B0157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 c25a7f33028e2fe0921f19f8921427e26d5af05aa7721a11f56d31c90d3bd7f2
MD5 03ef6b8c9edf45e19a8cd92890803190
SHA1 9dc5a48e1a19d55cb9799fb1501e936626750980
SHA512 9f0497173b644ee84fbd79048ac841819715da6bc10177a89898d1f6570642ca08949f628233bd776a872c71d09e806547e38acf77477621e7fd711f754c625a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqyC:A3k03kB56ry
TLSH
T12A157B03E6850FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 27f34cdafbdc1e2d01083fae3f72795e6591b4a5de663e60c6157087656ce0b3
MD5 52909a953c24e0d708ee7871ef0fdd5c
SHA1 32fd2d5113cf315a979b8c1c6bd98d733b4a5869
SHA512 7ff46c6a259a532f60f636fbe539485ffc6db325c4d9bd3c95ef774b858780c0fbfb9bf1f536f44aa22a85e9322fcc5a0a449469ed941672d6dd8e108712999f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqtw:A3k03kB56rH
TLSH
T1B3157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 46b75698648de31ca405266e4150e7650d598d1022d58b1a4a87d50746fc6013
MD5 cf6b85d0a3d9e8f7aa57c935e4d1be2b
SHA1 e348b42ab9dcf52883caea49f7ebfcebabbe0d9e
SHA512 e164e0657bd075207956d78dcf657a529ad017a21d909593b85fee76fcf1b81e8e076675c2567a10725c784b4bb079e6e6f9bf86505e6a7a018526404c3ad96c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqcT:A3k03kB56rD
TLSH
T1AA157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 38981c3c955cfdf37c5e20cb122b1a4c07a87aee13e67b313241a4aff7c0dd69
MD5 8fb2f52e0b6b094920fc62841c30fd8a
SHA1 ad8eb356b024927dee89bbbd694f031f86afec24
SHA512 997cb6b2b04bb749cbecc05420ea7ce7a5979b540145b977a58daf8c968f92a67aa2521389e37abe759723d356651c2201be02ae3ef5d8836c75cf6308875eca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqwu:A3k03kB56r0
TLSH
T1F4157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 64e14c405d86ba0024f67c81ccfc66a862e8c4a12383d11cd743c197724519f5
MD5 27a0ac3a9b22f6b22633fb898042aac7
SHA1 e24cc9a0414d30a13eac844aa8201b26d5b04667
SHA512 8ff50582eab1e6a3460472f14dae5b9836ee066d44989f5f8b0bbc03fe5826f77a81de3331ed139e13fe0288e02bf10a29798833d2547d9a0c8ba0be46cd69d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqOb:A3k03kB56rd
TLSH
T101157A13E6850FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 7dd9b690c3f1a0136f640e9c204d6d4df3794c832a5c8e8faf5fd504524e59e2
MD5 9421310165c07f06768f3ddf43277bbc
SHA1 fb1a864c38b3108fdcc08ed87d4afa513ff1a749
SHA512 4c188537268034168073f23d5a890d42e0d4306ab3f0afdece3b236cfc0730c5d0cf4cbffe5705d610daf580136b1923df3bd70aefb2c909f8734849e0b1f13a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq4f:A3k03kB56rN
TLSH
T152157A13E6850FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 f713b2647ce5da23ae2210d1ef6639a616fe86bbdada54a2fc59b6c9d00f2e86
MD5 898a28e4311562194e5ef3f30513cc0c
SHA1 d8b770948e51f20f15167039d401f84a0ffeaa09
SHA512 7ed86749ea3a7d4e35cca24716c47408586a543e23c16fe3ee229703aa21807d0c1cb72592b9dc64827189ab306696d8d2bcd36ae1cd35dd2feb9415917402c8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq1K:A3k03kB56rF
TLSH
T12F157B13E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 d6e8ea08a3ee303b6db771f6b1a4c9547ac735fe65b2b342545a358a25ecd956
MD5 ec65b021b91277f34a12aea7c77e3570
SHA1 de4552024139450e170f9b47f27b1c4348160910
SHA512 b6cc24ae549f8aa4a22e7bcb42a1262186c3bbf74237610b9fbf0a24a435b3f523fd3e191eb3e67787da5b951cbaef7caa2b8147fd04c3360bfe823783fa1fd6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq2k:A3k03kB56rs
TLSH
T104157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 2d8332f96385da753a7f55ea2424d8af71d464e02f4c112fa54d9f453a968d93
MD5 83381f4cacb371fbccac89a1aeebe32c
SHA1 81c4982ab7144da59cd0d0310a495847606f4248
SHA512 7198a8fb92d9d34dd651bdfdc287db0d000f813fc61b4a935f50d1c9c4f1aa5f03bd3c74004f9257ac1c5824cac2292674f9828be4c2675a8ad2fed5fde6a3a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqT0:A3k03kB56rF
TLSH
T111157A03E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 a724e8fb99fda95b4211218a338b558b65715cd929ef2bdb3d4fad5de66640ed
MD5 648ec4a559b3d97dd574dbf251414a9a
SHA1 6015073720431a304c314ff86dd18a6eba4d08d9
SHA512 176c33766c6c514589494d22747553d20a177e6e0ff4116a386475c0f79c2bf33cc02f1c34e65e0e8f5b65e1406df8cf01a0bc6126ddead3a67115494958ffbf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqig:A3k03kB56rk
TLSH
T19F157A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 9d0dbde2022e31524591e063d0be739e8d87573ee14b74f399bcf320a55764fa
MD5 2d640bcf84f02c8c770b264a2c8beb87
SHA1 8cb612d8c95cba1ddc071f450a6b6654bdc06900
SHA512 5434e4579d6e37de815e6f9c83504805f5d462e42b2cfc0df139fdd8b8145d0844a25a8484bdb4bc1af10d5e2b62cc809d26d8afd7d66bd0bd19211b8ce230d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqDr:A3k03kB56r2
TLSH
T1CC157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 1ebd76d52c3aaaacbe892d11ae204a52f2a0adcced3496b6c351f78f0d3b8cbf
MD5 36daf64b12281b71c00ea4b553e065eb
SHA1 313e520d9a977465cc0be5fb1ece99bf43ea4d46
SHA512 2274c3eebdbf88a7411d0517fd3cf778e3a0dc2bff840c9c65ed4b99dda8a2419d35afff3f18dfec675ec2a43df7af46dfd82cf9605a5b92cb2076c8574bf973
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqln:A3k03kB56rw
TLSH
T1DA157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 471a95611385855f63c729b96f1696b4d887fe65ead513445ce755c627d4ebe3
MD5 49aad1e7ed66b7edd5eea285a7da9915
SHA1 631752978fc25e09d5895c7ed428d03284ad0da4
SHA512 b1cef2d6483911958ecaa40f6c53d1be70cb4ea9852ce64033eba9cf0027bd0572fcf9b1b778549e9be894d170ba95b2c1b5abb2af670559859c45f0b0af3b47
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqRx:A3k03kB56rW
TLSH
T106157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 8278a83481a4870f2fa8a49e8b028f9e0f5573bd2b73df332d7c7fbfe50beb5a
MD5 d39a69363733601a70234fa78d9c0ecd
SHA1 deda78280f0ec95398b9127cd16765200a78e850
SHA512 6a488738c7ed32677ac223d53d9f5fd1f922a7ba5fbef856978391ebe48a7fb4455cf2b2c8fa5143e3cac3954e5fcee4bb0a1c60aff294c963cbfd7acfb989e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq/A:A3k03kB56rN
TLSH
T143157A13E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 956aa7edcde7be264898ba5f48d82751eacd70f434326f7e5d9864addfd03ef2
MD5 57b9ff9f24f0761f0b5f23c87a4cd8b6
SHA1 dfad86cbe5ea9c10f99d4a005545e9a727ab4b3a
SHA512 f7b28f92d2d62ace05a9ffcc60f4f5e5458d1cf1e359ac850e178fdf6f103b6db586c27c543b929acf2ca7bfebbd2914277cd344a364e87cb04d15e610804aa0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqQ9Q:A3k03kB56rc
TLSH
T100157A13E6850FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 dfcda44a89771d86cef44d26320531dd324ade5fca09b6aad8b4c28f40e06fa2
MD5 e732c678ad5e1765a93579bc57af5efe
SHA1 162f79c65358a5e8cad9768d77d3c09d428925a8
SHA512 fd9603f8c0802db4889296b889134948d4159cb26be0a4305bf2f1c2ca96bda9759682a9c2a774896c1928bd89b560bf0403b987e06f40bc8b21ded8fb0c9549
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqx4:A3k03kB56r3
TLSH
T17A157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 f27aaba324325f992e20cee5224e0ab6216746123f79809310c6ce9ced07dcc7
MD5 541dbad3b55238e19d48ee56d40a10a7
SHA1 740ced8495bc96d61dcf4df3b4ab8728694d429f
SHA512 01e743edc3335aa182f659d060c9548096e667c23c9f79eff1753bc667c7e9a836ee8743837d3176e9c708451f4285f4808b404f771187fd5811e92dc7f52905
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq0u:A3k03kB56r6
TLSH
T147157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 18ab084c1d87d7e1195db75b020a2518901ff58cd28f9f5876f6336f923ea07b
MD5 020924e9c32f2786a0e5f52aca98a7f7
SHA1 59f413f64d9fba2612f3c0ff52a14722412a6264
SHA512 7dfb90f822f91a35aeed358639df76624c572301147fdf898da3e0efce067830b9060a7d9146b06589786a998a147c43bff03453e8590aa1018d7f48dc4c0a95
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqFj:A3k03kB56rU
TLSH
T19D157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 a2faa948d4f53d04ce8f612d1160ba20de0d49f562f0c2c238784596b6f24992
MD5 3515cce329ecbd888ddf272b73ef6ddf
SHA1 e9a3462a65ab28244eb58449275c504841effaa8
SHA512 02aa27ce885f9144aeca97e4b597ac1f96db2814c4c5918148e792db9863077f596a5daa9c04ec03427db6778a6db7c2034859bc293d43c856c4e3f9b4cdfd3c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqMg:A3k03kB56rc
TLSH
T144157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 e0bddf5c43e6c9573caecf4d72ba9d723f0995bd06e0d04a6ff2848eac7426ad
MD5 ddc6d00d7fd8a5eb7595205f7618ae97
SHA1 f052c483664c4d5b9de93adf3815f5563bf78f71
SHA512 875d216c481e720633d3d1f455baa08feea76eabf773a07701380324411611cb9ffd4ed06f179a63ff49217c46bd6527b83543d0495d03fb4a0b373c8e6a329e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqTI:A3k03kB56r1
TLSH
T1AE157A13E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 211fed6eb93cdec85cadf7a111b169df04bdcfeeb63ab40a266085d207470505
MD5 e2b0747029d2e8304038e0bd9a6a85aa
SHA1 ccaa9465b430a32813b51af20aa755e66fd57abf
SHA512 52656deaf6cd8b312b41337cd449204decd86ad0af59afd6168ee353aa0d5e452724418e02e2eedf221031471235e16f5ee758c95ef56fc9e5cd0d7b115699d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqpo:A3k03kB56rj
TLSH
T11C157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 f8286e02157e02e2f8b114ed74cfc0d8db46cf309328f86d26e6832f25dd68ba
MD5 c5954e1dbcedab052896e5756dfa1b5d
SHA1 5c99d5a1f5fdf11e00d15e90ac1441a1170054a8
SHA512 e799363f8910878c2e5853d0f857251e1fe378b332a73313f3dbe5784da646fa17a22b50afdb3a4cb552a7a510c8c8ac3acd3cb0785f4f18683b3a9ddfe06bcf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqa+:A3k03kB56rm
TLSH
T179157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 8a13f3019cc6ccbf29cbe6c082ae07c059778a31a75915d3df41c9c47dbdc3da
MD5 ecc71dc9533bc9083cfd62ed8c4a89db
SHA1 5f5ee02a1661a2dc199d04d35c4254730207cea4
SHA512 f2efc08618f2818aea8746d1aac9baceee7f7675df4e5fda23c142a1f1c5c56855a09e643b72cdea94121bf726d08a062d6846310dcb2d1ddd5fc1af5ff57b6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqaQ:A3k03kB56ri
TLSH
T152157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 f448e4d5ad7ff21d6c341308d9f56e6f9156c4088306ee3988d0f58b7ef8190b
MD5 a755a67b9d3bc1056253b8ab5cffe582
SHA1 fed097b8e1c42638bc59052a8aa245cb2d3bf4d2
SHA512 a4da96f6f05a9f7a243c8fab998eb538d5a46f88e896620fbf0a98decc3d2b8822de6d47265a0908dae42867ab515dc6d39687c4de239073a4d9dc373f7ea007
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqrX:A3k03kB56ry
TLSH
T197157B13E6850FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 32488958e1f019940b68c911aabc8d2dd5b54bb523949b88c5624e7238fba13f
MD5 e226c2d3cacc99bd56051ee181ada9ee
SHA1 6a1a7ec335a30dc6883355c9000992f1914ab453
SHA512 b277c0e026f9af31164efd594aa5ce54ffec659702038bcca49277545c7fdeb5210843038a52e9d8eaaeb0bf097707b92c6d81abbed47b0f10cb5f9b083cc83d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajq5L:A3k03kB56rc
TLSH
T1C0157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 80df89443e8c5af456786e5987fd8e2ac122a3a4b5716210140969e2273fa0a1
MD5 17810b93337469d489fbf355e12673db
SHA1 c1ef07895483fc25f25ec5201ff350b21c11d185
SHA512 866d6589a4b5d7bcdca7eaccafc6c0b53f6fdb3d796fab1a5ce3184ee3cc4730d0767186aa642b1676a2d318538e2a5c14e75eb511838181f0e0e829f11f92e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqnM:A3k03kB56rt
TLSH
T152157A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 7122a300c714d044f4788c3f278f7dd34cf3e201f5ac6982c9670b1715b0a9dd
MD5 db893a85d852315267a1b23d5f0606dc
SHA1 efa198feb4a69a953e933666b5866b910038270a
SHA512 2dcaab7e81413eb35708dd97c093b4e03a7031649a63d437ca51a023adb7b97475e2c7bd56582e68a4cc8dbafb495afd14b3c57cc1995931b24b95fff4aad044
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagajqQh:A3k03kB56rH
TLSH
T18F157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2632-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3784-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3784-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads