a36b4152e7051fb0047f7160a9a7cba7c48584d9bbce23f5306d77e1a780d5a9

Analysis

max time kernel
114s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 878KB
Sample260629-mvasrsa161
SHA256 a36b4152e7051fb0047f7160a9a7cba7c48584d9bbce23f5306d77e1a780d5a9
MD5 fec0403b7d99a7707e8fb41b3959cb0f
SHA1 f115796b0b79180ab52752e79b85868068f35630
SHA512 0f3a953ed8c12fc3bdb737f8623f950125ab2e406a5b4c9b6c7210211ecdb1b436a68bd3203a62b0ff18eb3b4ae104ff42b9493c99064c71d308fcccb6003f12
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpT:A3mnXoZjzyaT4aewsAjxTcEpT
TLSH
T13E15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 48 IoCs

resource	yara_rule
behavioral2/memory/5668-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e4-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5668-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1320-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fb-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c77-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896e-192.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018970-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018972-309.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a19-471.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4f-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983c-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-663.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a4c-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-754.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-847.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-957.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1025.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1251.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1408.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1410.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 45 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e4-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fb-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c77-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001896e-192.dat	aspack_v212_v242
behavioral2/files/0x0004000000018970-259.dat	aspack_v212_v242
behavioral2/files/0x0004000000018972-309.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a19-471.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4f-502.dat	aspack_v212_v242
behavioral2/files/0x000400000001983c-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-663.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a4c-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-754.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-847.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-957.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1025.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1056.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1142.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1251.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1348.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1406.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1407.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1408.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1409.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1410.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1320	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5668	2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
1320	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_fec0403b7d99a7707e8fb41b3959cb0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5668

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 878KB
SHA256 a36b4152e7051fb0047f7160a9a7cba7c48584d9bbce23f5306d77e1a780d5a9
MD5 fec0403b7d99a7707e8fb41b3959cb0f
SHA1 f115796b0b79180ab52752e79b85868068f35630
SHA512 0f3a953ed8c12fc3bdb737f8623f950125ab2e406a5b4c9b6c7210211ecdb1b436a68bd3203a62b0ff18eb3b4ae104ff42b9493c99064c71d308fcccb6003f12
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpT:A3mnXoZjzyaT4aewsAjxTcEpT
TLSH
T13E15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 83ac7236af50240b888b5031eb27d3a85c83952e6b8635e31aca4f0b264d9ba9
MD5 b59b44070ecc1f68921914731025bdba
SHA1 30053604326678b189e0c32095d2cb24248ad79c
SHA512 2a6c403d6ec1ce240a4149f758ed71087dd1c9eb887c62e1f6d2a85fc8ddd41172e994d22eb4ec982ed825c0ff2bd2bbd717dc8077e1e3576d3a33e16e4c1abc
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcEpP0Le5ji0hmxNrM:A3kMPljdPji0Aj
TLSH
T1A0658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 892KB
SHA256 6c82c8dc35f54dadd9e3ea5c60a3d315c282624e897abadeab1f63fe3e6c5fd4
MD5 218d0996fb81813f87877cb786096974
SHA1 bcb43d7d44403d4adbcb3c2fb3277e7368b4b7fc
SHA512 16e28723e57bf57a2da5de358b45e9ca7d10574c9d631e5be9000cace0879bdc01ea24898a5671ef34b9c7d675f6c3bfe9698937abc414a4e82a210e954b5c49
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpRa:A3mnXoZjzyaT4aewsAjxTcEpRa
TLSH
T19315B023FB7090B5C23B49705B65C712EB797C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 925KB
SHA256 f19b65515f2b68c9fb655d9c9870e91736fac4732c0e3587292758ac744491a6
MD5 ae736cba4d7c8f978d05de9b2f3c5d32
SHA1 30ac7174a21b09b1759fa69780d0821f2f35ce3a
SHA512 efd329b35d3967d299cd727da4d45bc3a85329b924e95cecae8a619bb462732ad315d9837527d55913549fcb5df347518a71e32d462f652892f8f6e75dc6d3b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpyb:A3mnXoZjzyaT4aewsAjxTcEpyb
TLSH
T10B15B023FBB09075C27B49705BA5C712EB387D610B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 901KB
SHA256 3951935a0249db4da6eb6686b824a8cfcc60486b604c3274ef51fbcd516317b8
MD5 f9fcc3075c27e2f0310ac82f6595bf7d
SHA1 c9aee24ee3febaccb2a4dd68c22a793c57a5f777
SHA512 a48deac81a3d14fddbfe96721bd04e476b8afb9a4c7be9cfb81c8bcc54cdd76ee4e8503885bbc8936c406cceb918fb590678c90fe808492518ab9ecafb4b6250
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp6s:A3mnXoZjzyaT4aewsAjxTcEp6s
TLSH
T11415B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 922KB
SHA256 3c3d3f5ac812ed5636164f3ff7818df4af1911a3997c26394cd661c08a55e7fc
MD5 5a8bfea4f4ea1356970600d3008905cc
SHA1 f32a2a9257d464353aa31f0f9c8b086fda9ee43d
SHA512 4eda7147a0fa5037ccdaaf6752b4537c432b3be42cdce97492129cff7fad9cc99b084997c24b59e085d7401b9bf846d56478e2a8a7f2160902dd7739ff23906b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpLVc:A3mnXoZjzyaT4aewsAjxTcEpm
TLSH
T1F315B023FBB090B5C13B49705BA5C712EB797C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 901KB
SHA256 da1dfe5af6045718c9f44fde4f6dffeb6fc3a97cfe2d498718e3f1d1169e889b
MD5 8f3ffd9781eed7e0049ab12f3b58212a
SHA1 982f75f1871d047fc038969c560fed0b85fd98a3
SHA512 d72acbc4f4dafd0cd6bfca3e09fc23870c10d8552dd4a42bf96378282b2fd202a5f03465991a48c4780d00b027866461b27f35682b97b966e2886b7fb5c6390f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEppZ:A3mnXoZjzyaT4aewsAjxTcEppZ
TLSH
T16E15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 901KB
SHA256 7498fcfe276deecb03b38a5efdd1bd67a19753aa9c602ddb8e0883aa3c6fdc36
MD5 73f88ea771ebd008b26b1796f872e421
SHA1 d0a141b0db70a04583db4cb4abd5ee0676059f9d
SHA512 f229d115dac4c61a693ed12e9bd0c42331458a1b1da9338853dde70fdf2e7d45a81607ecc52e2291d4359f36df94f8aec0bac357ea42cbe188e0eb597cb7390e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpC1:A3mnXoZjzyaT4aewsAjxTcEpC1
TLSH
T1C815B023FB7090B5C23B49705BA5C712EB797C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 901KB
SHA256 72755149ac7ca0ce3f1d16bf818867e16fb0b5da5e72311f1a60d9a96aa9f710
MD5 45c9946086969150cf733d769723d016
SHA1 2f2a83773177e6e8423278ecd963d58510a9c3c7
SHA512 c44c45c83c53c7253b4784aaf0264ab1f2173c7b958763130e48bfee348f3338ebb46019d02997850a27db47d366fa7cabca9bccd499f6f1f585b436efdc41e4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpo6:A3mnXoZjzyaT4aewsAjxTcEpo6
TLSH
T17715B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 901KB
SHA256 926c32275f2d115fc12fe73c46732adce2bcac15a96f2ea3f6f727100b2e4a7c
MD5 16743472997ab4d828aa9b23f09fce77
SHA1 b2b09362840f94ed530f2cb7fe6e97e8378d35ca
SHA512 f3e0f1f89f43f5b5884fb83106bd06a3ae4c9c9be9d86d2417808c82b39aaaefcba56c947ea7d890e14d44dc5e89f62b654081e5ed0408204fe5eadb33a962f4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpsN:A3mnXoZjzyaT4aewsAjxTcEpsN
TLSH
T14A15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 901KB
SHA256 22645c2d9ca1ae7b0928a4dbe2913ef79f578372075860b342c3fef6dd198e70
MD5 9dc9f7d14eab38a11bbaaf5d98f46244
SHA1 3397b46cd0b045b2c2833ccd3b1209f87119de23
SHA512 fed183b53ad616e542423b85b9a01521b327bf94d12a077fb3208bd3841c18f2de4f4bacf841b6c7dd7e1c45e37296108339a654b5024cbf16b155e0cf9684a9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpif:A3mnXoZjzyaT4aewsAjxTcEpif
TLSH
T12A15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 901KB
SHA256 01faed6907db499c7e208312cb8ff9c7299099bf4ce3335b8ef2f17d85d1af63
MD5 c093a3cdd32779e2c47bfa0edfa763d4
SHA1 f0fb60887f5ff9cc07dfa312e91e5fe4e749d8ed
SHA512 66427325257798a20ea22083d625f2cd2667644e543bbe0989c5219228a5d2faaa02d8a35bef66fc1e9859de28e3aa686c04989bfd3dc79121dca97643a5f957
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp8o:A3mnXoZjzyaT4aewsAjxTcEp8o
TLSH
T18715B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 901KB
SHA256 de0de7b4c6bccbd236b929a9a3b821a72a6c59b31528b89b4365da2688ecdbf0
MD5 1cea5104897d28ce6ea23d1b63fe6815
SHA1 aa31ff8547ec0a94fab403dc5f0fb3c2abf47452
SHA512 985be2c71b9937f72e16a4259037f87dc16a8174be84e8c1012954067e69f0829a5f12c3096f031d9d2f2d4466942722a0fc24c9abceec5b2ac245c6c5c98703
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpcu:A3mnXoZjzyaT4aewsAjxTcEpcu
TLSH
T1BE15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 901KB
SHA256 e11cf25587493fa33a825581e95e083b0da1926a7670046087c24ce26f3f3256
MD5 fa317beb3b5050634c941e2c8ae6d69f
SHA1 90b7c859fd78a472e3f55c319531013d14419225
SHA512 9fa71911f8eab902b1fdf4a997ba3b816041c988629867256bf2e2c5dc46cb1cb6487c79ace2b4f0182a3c45d1a0e37dfb6ff59f465fd991fccb96c697ab88ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpg9:A3mnXoZjzyaT4aewsAjxTcEpg9
TLSH
T16115B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 901KB
SHA256 b3a3b7fdd7447b92e92d0cace709c808a16cbb7468dd6537a1ee3084f06358ea
MD5 02f169d48cd53c8a795ab456d2fb488a
SHA1 27c0b9e7bfc9885d0934a57a7b402b9514f4d053
SHA512 9bd00a72f31f6a0b66e85341c3f45eaeb8d94e730d5b91c77ef52b3d12918518e5b5731ec2ec9ebb9b2ef2531925febd9f5c742fc935b903ef7f3a85bf41fa62
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpoc:A3mnXoZjzyaT4aewsAjxTcEpoc
TLSH
T1F715B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 901KB
SHA256 94517fbe90354dbaeb1e583398a68c1b15ed1496a46804b176520353ae67ea9f
MD5 c4a3d8c01cf57e9df3dc2f8ebd5f8678
SHA1 153f1812fbbbef232ce38623776a5e8f45028777
SHA512 38ac2ffa111fc8d3fd868331a4925ba6d5a68152a86896973ad65259e94d0dc3a173eb15acd0dea272989fd10c97f0461e724f3cb9f3e811e17d6a089523f3ce
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpBp:A3mnXoZjzyaT4aewsAjxTcEpBp
TLSH
T10915B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 901KB
SHA256 30cc7be4fb70e5a5044a16e250e3354f20411719b37f4470f32ec0ea87df571f
MD5 a701fa97b4fa4abf0bfdb245369e58f9
SHA1 5aa94908889c4e42e4d3e05ea614892bd8c26f96
SHA512 f43ab48ad0d32df9fe93e65a7435c50e10ef66c22315cc8021ff2b7ab7ec1e45b52471341acc0cfb4bbfa5b0592f72ed68a72697bf65a81a844bd4ecfc567d3e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpW0a:A3mnXoZjzyaT4aewsAjxTcEpWN
TLSH
T19315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 901KB
SHA256 f3a3fa4b9e75097c0ade123a502c94dea59b23c10caab4444eccf2f752a62339
MD5 8cae9b4f0497e0dda02b9a013cec7576
SHA1 285f04acaa53a2dc43acb26cd0694fb534efca42
SHA512 c9aeaeb937bfac0803f033c07fe2c324da1b6ed7ecff32fc869e5c1230dfe9393693de817ab0925b017d89d2d474a188933f3d34a0240c82ff86732cccd8eae2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpaF:A3mnXoZjzyaT4aewsAjxTcEpaF
TLSH
T1A815B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 901KB
SHA256 1e2566b225a4311ec147adaf8547b69b46f95092a180d0f76f7fcb38ec714693
MD5 e7033b54ed74311854f596f1698ef6c8
SHA1 a072b110b212af33883fa2cf0883c84905f19c91
SHA512 109170063a570d3f259b6b10423a3acaf5cc9e0841ba4f7df50a2ce2afa0758a3fa3a6569997830ebfa9e86974d6571d48d086442f3846a9bddf6eba78666867
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpvC:A3mnXoZjzyaT4aewsAjxTcEpvC
TLSH
T14315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 901KB
SHA256 eb2e3a8d91eaddb24e5c9041343f2e2ec9a4f5ab4526086653dbe026db2b1672
MD5 5756294f539baeb686e2116d3eda6885
SHA1 5753448d50811a0df0b6ef004ea4f87c0bf1c077
SHA512 97df67655e48acc1188333510b49dd086314e95bebf005fe3c9a29c6b7ee03c1f4b8602e3aa1abd4e064f4f4986d5843b31db72906d9f281560a426a88dd8a19
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpQw:A3mnXoZjzyaT4aewsAjxTcEpQw
TLSH
T1E615B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 901KB
SHA256 0c94e607085649f43703286c939fe9b1a41ec4ec3497f32f87a65807570ab604
MD5 eedf2c7f59cb6501f65719e0121004a4
SHA1 07d32b6f66125f747b4523e77f1ba09a635ce9e9
SHA512 92cd927cd96ecc97899ea765cd22dda07f166e71aaaabb46d903a08e382f58e1b15c0d82eb4ca80ef32110f8423a07ac8e2a5fa3961cbeab3679e5038def3a08
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpvT:A3mnXoZjzyaT4aewsAjxTcEpvT
TLSH
T1E315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 901KB
SHA256 a7dcbd5c8937ad218656cfc0198b0a0e777bc7f9fe54e8f1036b76e7b820dcc6
MD5 0809765efb7638156ddc0c0bb9af96e9
SHA1 e20e4895e774982d11e773882663335e7a45c65e
SHA512 a9a8a2ca21e10443963a249067908d94683c70edeb3ad85c8d1c84be97a641409cf4d86b6d4db7612f4b69e07ffc1dc78551fb4d8526237ad6d32c749c7f8092
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEppu:A3mnXoZjzyaT4aewsAjxTcEppu
TLSH
T10B15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 901KB
SHA256 32a30d5785ea927e1ca99a6254fc89449687026f780442ce1a28f375f82aae41
MD5 77fc1cfb1bcb299a5a2684967bad6a75
SHA1 5e70690a2a1bc9606e42b50c38956b69b18ef555
SHA512 d7b0315842f1194bd72c0130e5986ebc40998ce22e6cfeaf2c27590410a85c9d899ef37f3ea709927e357271be3a95b11ff4e6eeed4c0df341fa8481638beda6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEphb:A3mnXoZjzyaT4aewsAjxTcEphb
TLSH
T12D15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 901KB
SHA256 0c72a75490c3a2b4e6192d159e6df9c0a6e8ea35ef6c3474fa02c8bfec425fca
MD5 0b57db5cdf810bb286320460945db597
SHA1 15aba3d7f92caa237682d54aa63fbd61e8024cfc
SHA512 5a4c308c09fd3f5755474318c93538c7876ea4b5b1b71549716ef3b214976ed852e97af8356826cc1b5c7ae38f3f08a400551ad4410d4b6c5cb28f1db71ed209
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEppf:A3mnXoZjzyaT4aewsAjxTcEppf
TLSH
T15515B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 901KB
SHA256 6f8ee7ae3eacf34cf203037b662639b2490e8461d6d1565a04ce8f5443265ba3
MD5 d335ece384043585683bd3a02b3f77e8
SHA1 afe34b1d871bda23f771be31df7006af595a7024
SHA512 ccda02531a82499f348e80dd9de36483085ff043e60392d08204fdaf1c25753dcc2ec24ad8c2b30da2f46d8636d65679ef0d68089ba434bd124115d9cdeab359
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpSK:A3mnXoZjzyaT4aewsAjxTcEpSK
TLSH
T13715B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 901KB
SHA256 50f39eb0ebb8b515645fca6244490d64f98d5a865f72faeac0ae163d4173e81c
MD5 ddf3b9dfe1eff12128e6408f94b49270
SHA1 0758bc18f4ac3508c2bf368edd9d27f9f0025023
SHA512 0b44dc9603f2eaaef1d3c92fdd02543ce48d94a65c49de995692051cebc4b915c9727092ee1ca550bcc1c8c30793bdf65a9d0b660f79c37a42ae88ead4022f18
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp3k:A3mnXoZjzyaT4aewsAjxTcEp3k
TLSH
T19315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 901KB
SHA256 90b2d46f0e3b0c486e504e99c0f723213e831c58b34c6cacba725b6e973e743a
MD5 23c63d4b4f33f8211167a34f45882369
SHA1 0eb2efcae2aa91c43454fa3d7c753064bd45fc39
SHA512 431a429242b7e048074beda758b6b7a4957db62bc2721de0695a11718a3377ae31709993a1ddafb33e74c64f9bcd41bedd813c88067cef71a4b813af5e2ce7e2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpA0:A3mnXoZjzyaT4aewsAjxTcEpA0
TLSH
T13F15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 901KB
SHA256 afc04236434c1b8a81b81c8a89fe5a351c623f6a4c4fe505706a077480132505
MD5 b2044c1bd9cbb794741012b4b826d8d3
SHA1 dc8eddcaeddc169fe734ff98fe78c552740a3ddd
SHA512 c07e3625e8d2c75ab423098033c23e26cf63384109a0d7f3a2df3c047c850d2f0ad4190a46bb0868ad0dcda70824633780228392329c02259c032db3cfb0906e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpb70:A3mnXoZjzyaT4aewsAjxTcEpbg
TLSH
T1A515B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 901KB
SHA256 d4e2a5bd862df28555a5e225f2a1290da7fa6c5148becda4bf9364ed5e1dd7e0
MD5 8328bff1d3b40d9013ad7c1eb498a107
SHA1 41e24490f7b3d458de9a0cc4c28baddeb5abb4fd
SHA512 f3f052fb79a943c5f641a5ef8d27d3bf375d96e6bd5a6fa247dbd67d910448b533639bcb2bde1e203bee7e3a04d4d191e2c88f51ef03aaf459e8a8fbe3d39510
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpWr:A3mnXoZjzyaT4aewsAjxTcEpWr
TLSH
T14E15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 901KB
SHA256 81fab3df45e59e8b3ef2439ff884dd88f51b6531257b6ba3940092c409d82774
MD5 10f7e5dafb9834061cdb6215d61922ef
SHA1 384c15e3bf1ae268919916f6678fe0d6c01de63a
SHA512 8017c53d9544abbdc35cac29251071cb44aec63fb54c66274e4ea7a8fe63958b30b3d1088a1f79983ca354eda72c932667d89df33a1d8a0025d0fe5461fdb35c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp8n:A3mnXoZjzyaT4aewsAjxTcEp8n
TLSH
T1E915B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 901KB
SHA256 1539416d20d0bb1e71c3aaa130b7375a12ef8c267bc006298ff0badd83eadf39
MD5 7bf65273358099e260b5eae08a5dc9de
SHA1 9064838f5bd9e63a3eafd5b3d927251d2280e641
SHA512 0db7fbf0cc2ff8946033daadf82dfc0b30cf584afb9cba9631d4c3b1d7c7ccf9c593074818a11586c7f9b09883dae92e4f7de0a4610768884fb3bf0f337d7790
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp6x:A3mnXoZjzyaT4aewsAjxTcEp6x
TLSH
T1A415B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 901KB
SHA256 ee0bf42819b1c4f7f30f412aa91357b3ecacb47770d3d85d5b22977e6ebbbcd2
MD5 88ba68fd48653d959a0a224af0cb94b7
SHA1 9f6802780957fb9020ac078f5d0b37a72abd54f0
SHA512 b88cc132fdb9136b2de7de24ba07ad3a8c0f6901f47e42b2fb27b63c25fae9c4a4b90b76ca40a14b746df8054305956710f1add128fa8aa8e59b0ec59d785a07
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp8A:A3mnXoZjzyaT4aewsAjxTcEp8A
TLSH
T1F315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 901KB
SHA256 26a8222dd393df529fd77c349398987d2298adaf741e29143a00987781eb3029
MD5 3f400b7bdaf3085ce39f09994937500f
SHA1 41a1bcac234aac4dc05256afb1e21526564bde74
SHA512 c7b2b359d60d978a604ecf72ce15cae24b6872bc1902bfb62b8ec52c0a7837f0f9f3cb579b64abfcf936888222abee99eb9998631f2cce6f487e7446f85bcaaf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpl9Q:A3mnXoZjzyaT4aewsAjxTcEpl9Q
TLSH
T19615B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 901KB
SHA256 33dda8768917c08d6c574909a81d295031eedd67d221469f29b9142c4fd8597e
MD5 de65b17ce2ec0fe565ac2602c5ade8f5
SHA1 15104050c9e1977a3f15359669a9a117bfb58b3b
SHA512 d2672ab9aa42c62aa3ec78344dd8d88efcfac6b553db56c2ae3b28faf32f2c2ec7d49c997dd5716bf55bb160ae1d85ba914f5232bd2ba20155a7dc1ccdbfb549
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpQ4:A3mnXoZjzyaT4aewsAjxTcEpQ4
TLSH
T13215B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 901KB
SHA256 1586b8e3069a6e0b954f7772afa1faef2a07ad8ac77d18463eee257ed444ec65
MD5 775c91ce837ba95ed8ba4ce8cec298b3
SHA1 0c9142511dfdc224f37084c9d7c00c37dce6344a
SHA512 29f1cecab28d373d5f45fa83ada07e986d4310cb8e06567b5c1d05622046e98dc4fa551feb03985c558031065758198e54eec30b744fdc248b9cc5bb76a037ca
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpTu:A3mnXoZjzyaT4aewsAjxTcEpTu
TLSH
T16815B023FBB090B5C23B49715B65C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 901KB
SHA256 38436eea4a3069106bbc75cec4a57a73968373b24a6d4b9db9c0941ea069cbda
MD5 816968e2adcda7ce2c4873881250ef29
SHA1 3d19dac4d05f52ed8ad2127beea42aa998f801f5
SHA512 6b98414aa72f7e9a3a343bd18eaef616c278a6062ff0396405de3926d1e2c9d2deec617fdd79a11d40d538274acd59b7519eb009e268581658f36a1d4c18cddd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpOj:A3mnXoZjzyaT4aewsAjxTcEpOj
TLSH
T1B315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 901KB
SHA256 a01339be8e1d4759e3314ee60924eb65a6dde9cff52ebc16d25d753364e4adc9
MD5 f0b417c1c89ba49fab7a896405f99368
SHA1 743a8f9ca81c034cae7ce721e6cda1798af703e0
SHA512 e4ff16077193e5616bb015a77c2b16b3fbb3373e61fb5c0f9d1b96900df14dd5a7d7b5e359bbad31a8a58ef6c0a2181b5816ef5223e99a0884664531d02fa014
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp7g:A3mnXoZjzyaT4aewsAjxTcEp7g
TLSH
T15115B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 901KB
SHA256 414361cd0033cafd5cbf68c6cdfce22ad0e121db91795a7acab58875a62f78b3
MD5 abe3e0543899890c3fdb05deb785457e
SHA1 04e1f7df27ded0a3a9685cb79738fb25476547df
SHA512 8b4b666500f7f663b249f4b8ed270cfe722275ed955b9dd5cb95186ff4e6fcbd03b25b961e3aabfa64fe54dfb9a466cf7edc94893d0a7bd468e8022aeeb42c52
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpmI:A3mnXoZjzyaT4aewsAjxTcEpmI
TLSH
T14815B023FB7090B5C23B49705BA5C712EB797C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 901KB
SHA256 4ef4c06a9c23fea875effc55f0c2015bea333aba00e950cbb0076bea0db417a7
MD5 f71a002bc0a6174b9e774b8262db2f25
SHA1 513c4a89f8c66aa2f3e6218dde195a9300a9d739
SHA512 b048482c4a6666113f1241b48d667928d9baad3011ff974c272acb396ca28e2c6dedb5806aa1cd3135a57eac0afa0e939f42d58d9e5edbb48e917d46218d8687
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpUo:A3mnXoZjzyaT4aewsAjxTcEpUo
TLSH
T1AF15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 901KB
SHA256 616ccd78171826506a627db2805a502feddbcc6b5263bade8c32a563de712757
MD5 65f15ae10c32387e33c2550e80777c1d
SHA1 27736c88a3698da12f5c49bb1795ec16a548a010
SHA512 13f7398bd31ede16e9f6af920c55ce91f5e6ebef93cac22e4bd9a43f910e1693986f6e1ce4a9d942b06fb1a48300398ed4b45c528eff01fc9100323505300c0d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEp3+:A3mnXoZjzyaT4aewsAjxTcEp3+
TLSH
T12A15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 901KB
SHA256 1e5105d46c06f8e65bdf7f48621e8ff815d1ab1df23042bcea4c4e9c9e9829b3
MD5 13c0b212f36d64541f588e411cbd4938
SHA1 a5895d38732d407d36cbfbdb9677f46c0a8ff834
SHA512 82ade71078f248f6c43d1b506e22cb6416962d176377c5d4e952a606152f3bf011fd6b3f5a3f5ec77813a165526e0f8ff8f08541560291b36ace614e84fd26b0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpNQ:A3mnXoZjzyaT4aewsAjxTcEpNQ
TLSH
T12315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 901KB
SHA256 a0ee8ae5e01492b611a2626b3941b435e32ed4ace78414c8773997ed302ca10a
MD5 f9ba7d05bc3a1c0652a400b8d77a4f71
SHA1 d9761268bed2880855750c1cb22c37eb08e1cda9
SHA512 0778b64a9fa430bfed5363ad7fed139cc62ea55b41a286fd82913e62706a8b03209aeff581f189eada942a5bb21c999e11587983245f4394141db6bf531ba4c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpCX:A3mnXoZjzyaT4aewsAjxTcEpCX
TLSH
T13A15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 901KB
SHA256 0cec0e4f85b6b2fa7a6fec0006f634cb02cc9a94b951a373770c6d04d494728b
MD5 2888483be52193b846ee3adf8ec712de
SHA1 60cc8333883b81f344630524360a7942b2251813
SHA512 691e6c728042b7ad0f87bb32f14d017ff7df65e6623b65b32a547b428d3cb6441c60fa15386cc1e765dea7b07884c9ae3d3a79655b104bc8b9deff456b0977b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpkL:A3mnXoZjzyaT4aewsAjxTcEpkL
TLSH
T1B515B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 901KB
SHA256 9efee84460759c217efd0c67bfaa8634701a16892845debbd07b73b7b6ac6454
MD5 406c800be4d7f15aee6a5ee35c9592fb
SHA1 cc48d87fd1d76ba4a05b6ea1802177f1e58b2be4
SHA512 2beb624314603780f2fdf812ddcff976beda0bb220285b4d25c88c96f2fd584d735f12a97fdbb430e3ff2d4f7cf27f3f0ec52c2b68b91c8310e46e54581a4f50
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEpAFC:A3mnXoZjzyaT4aewsAjxTcEpAM
TLSH
T1D415B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 901KB
SHA256 ae9a57c9b71e1198a76c0f8d1609fc083f61d9fa78a4c1fa12bc084af4460a49
MD5 31d11254afe1971ab162cd762da37d14
SHA1 9ca665b728b3fd7575524f662a669441b23ff93c
SHA512 e08fa27a6015c26d5bcec0b54fd00869fff2a019fdad3fa2e6e36b3b354cc1057c6f74b35d55ddab5eb47eeba4bb44123e4e01c1fe414306a8c3f9efc2296add
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcEphh:A3mnXoZjzyaT4aewsAjxTcEphh
TLSH
T12515B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1320-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5668-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5668-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads