1a1c2124b826787982c3d6102798253f6f3940223cd8e82fa0f669c66a3bd988

Analysis

max time kernel
115s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
Size 835KB
Sample260703-cs1ajah19x
SHA256 1a1c2124b826787982c3d6102798253f6f3940223cd8e82fa0f669c66a3bd988
MD5 fc87c59d479c94af18105ff4b894625f
SHA1 d8a31b6f7acd477fd1ab3ef31bbb9d9b83543683
SHA512 9be7a10c572a2f6354dba93726c65277c6b079baf668b60ca4b3b9821b951450510cbc6f25b64ffa0ff884894defcac1a1f2d7153dbfcd8a43740efea917562c
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKW:N8RFEL8XVav9MkTQfOKW
TLSH
T121057C13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3600	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{61D7035B-BA7D-40D0-A332-CBE11E8DDAF4}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
3600	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_fc87c59d479c94af18105ff4b894625f_cobalt-strike_conti_elex_glassworm_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2852

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 835KB
SHA256 1a1c2124b826787982c3d6102798253f6f3940223cd8e82fa0f669c66a3bd988
MD5 fc87c59d479c94af18105ff4b894625f
SHA1 d8a31b6f7acd477fd1ab3ef31bbb9d9b83543683
SHA512 9be7a10c572a2f6354dba93726c65277c6b079baf668b60ca4b3b9821b951450510cbc6f25b64ffa0ff884894defcac1a1f2d7153dbfcd8a43740efea917562c
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKW:N8RFEL8XVav9MkTQfOKW
TLSH
T121057C13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe
Size 952KB
SHA256 ef4d9fecef36eaeb3970dcea1dc33478de1845b74b386efc5a16b8f3c8d30fe6
MD5 913322e915048284008058c668b3f59d
SHA1 f249df6522ba41125b920e8bbed45ed9f09c5a79
SHA512 398bec14e731b6c582a8da31b5308fca7fabed082ac973f3bac83c18afa201f4c9ed4e6e8f951dbd4b579a21e5f06e01e915783ff87740d8a77439ccf10dcc49
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKSUBUjn8CxoFi:N8RFEL8XVav9MkTQfOKSv7MFi
TLSH
T1FC258D13AA6898F2E57A4AB94B718605AF357D310700D7CB93B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 3be87d4fd79c85fb54b68b9137145ad7c5775a77104510ef05fc7f127f1a282b
MD5 4e0c4a4009f18152fd43e0e2ac963252
SHA1 3f8905602db4973a8beb722f83520f6d4962f7c5
SHA512 ab4ef3c321a50b7e1250e73ae96dd6a1d705dbcd5bed5f10c145f0a90090019562ccda9e9ff3f0c171f3092c1ae94494dbc0a85c2d71cf554212b6876cd7662a
SSDEEP 24576:N8RFEL8XVav9MkTQfOKW0Le5ji0hmxNrM:fv9MNfKPji0Aj
TLSH
T19F656B16FA7886B1D076C1B9CAA29649EE313D510720C6C79394B7AC6E337D18E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 849KB
SHA256 669ab01e7483f8db6114075246699d09eee7f94d8ebc7b2130fe39d7534152b9
MD5 8077e261c6af8ade03619e8356d3054d
SHA1 3683c7476d2c672b203630b0f3695623836f4c6f
SHA512 c2908edad115706836b7cfb7755486fa69ba6905048ef57f662d039f870526757771936599b8cec36e90d68aa5897c408b59a6c08ba1745c7e182ccf32998f01
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKAa:N8RFEL8XVav9MkTQfOKAa
TLSH
T1DB057C13AE6898F2E57A4AB94B7186059B357E210700D7C7E3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 883KB
SHA256 aa0ce52310286cf540a507d09559bbd511bf88765dd728c590c54aceeb69bdce
MD5 353970bd2e69dbb7908d40f7e0458522
SHA1 730f89bf4a54d79e519d852affd44ff52378a60e
SHA512 b7322fb3c05bfd6ef88b251f9baf4f8e9e59f0c3f678a71a813d91985a0480e6cef2beee3da67a9f6bff76d94bd69042c5bffaf534b41e1efb04a4ac4196044e
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKLb:N8RFEL8XVav9MkTQfOKLb
TLSH
T112158D13AE6898F2E57E4AB95B7186045F357E210B00D7C7A3A4B79D8D333C09E3A625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 858KB
SHA256 497b1a1f135c387424a6e93e0c11bb3c6c9870de6bb0f2f6a14c5c61b11c8ebd
MD5 063ebac91a720d15cba7033abb5bf0af
SHA1 bfc67e03e85fe67932c0c7c6c7a4cc66579c9581
SHA512 de62565cf80e28e3f8960c4ec3e42ff1b7b78dd00515eb38172415c6f9b467e896325a13b71f700d4bef3c6d78c307f0cd8754c7c76dce8c5b9db6b7a1f5d006
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKiZ:N8RFEL8XVav9MkTQfOKiZ
TLSH
T15B157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 858KB
SHA256 99e7046a821a9354f61697744a48e370d37a3a88294a0411090deef6f730db40
MD5 3261a3f04ae2d7ec4815ae55416cc1fc
SHA1 4a9674bd3839c6ce609168593f44d33921eb65c0
SHA512 d199acab6aa83865e293e8c0f724765bf9774ddf3104bbb8d2b5a14a35bb6b7464851729e241a60d2aaa5400e4a55fd195c822ee1bc3c22adf916658082b8bea
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKd1:N8RFEL8XVav9MkTQfOKd1
TLSH
T1CA157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 858KB
SHA256 d4b671d13508ee2728f9d243c5f26d3fb4435e5f34aa4352f59d50354997d236
MD5 70dc56036407eeb141e72f5df3d9e867
SHA1 1272e3cc440469b4759ec361789e78a8c2fb45ad
SHA512 044872e16fa1bba4e0da51e78b1595954613f0164da676e9f136fa711111e4adee3e6ff516bc4612d5ccdcbbd5c495d4d795edbf0cd0c82bcd26854a567199fb
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK56:N8RFEL8XVav9MkTQfOK56
TLSH
T196157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 858KB
SHA256 d3919717d19f52ce9293be4fdf9550b06eb91408520c42a68a25738e2fd4cf0f
MD5 ffc609f1bb530b8e805b118279d75d7d
SHA1 49c846838e9d6d6207f62282121ec996a2bd5440
SHA512 1f1c55cfdbf094fa6dbecb7174bf29e88eb35998a130d05a369e183b10ca6543f34688a9eff16b6bfde8d6c9206babf58148acf31fb162e9f1d472bc659c3a5a
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKPo:N8RFEL8XVav9MkTQfOKPo
TLSH
T1B5157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 858KB
SHA256 6838517dbefa2d3c1290f20ef45cb9d0e491ca6390778b76f9ed69a2e6365a00
MD5 b2b59dd10efe5d12fce1f5e7f9a80c70
SHA1 97bedf64c6dea0751ab098e6e23297e2d2b7418f
SHA512 a0b4ffc3457d0765e5dfbc7fc33aaea57236f234d5400e7df3a253c2f8c98ab4c8f5f96ac597fc32ba969d39aea61eb91b11a3758973858e0688484cc8ab3394
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKzu:N8RFEL8XVav9MkTQfOKzu
TLSH
T12C157D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 858KB
SHA256 206bc0da49741d2e373eda9b7feec046a68138eaaccbe6675b1840ff55b695d3
MD5 36575e604ce4f87df7adbf2e050728a8
SHA1 27dacf57ebdf353cf601621af54c50f5bb71de02
SHA512 3d25782c36f2e5856199d385d81bb265c1668d3ed2573d152d3d0905557c344e5bd5021af0a5cbcfea9ee014d6187d4426032c5a838c59ac84c75ab2b54b6af3
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKh9:N8RFEL8XVav9MkTQfOKh9
TLSH
T14D157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 858KB
SHA256 cd92ba23d4bb59789168e80100e674c45126bcbbbabac7784d8e053a1fa7d9f4
MD5 6eb4314c4ed94e93a1706294d8553288
SHA1 38e018110e48812cfd07e399dd8c1a71473d4e4b
SHA512 b1a9397629c982562901cf51919cc79cabb93aba2e17803ca4c1856be9acc02d424edae48f57798c3dc900f6b8532bd899d863f39404f2304f162137d93310ac
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKdc:N8RFEL8XVav9MkTQfOKdc
TLSH
T19B157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 858KB
SHA256 e62c8702c1536161b575a8a8ca1a8ab66c033f338b806502ed0b00d21fb7e52e
MD5 7e0e61dbddb0208f380d4e5b0a408efa
SHA1 c01c09ac89066e036681283c40abfee97b705838
SHA512 0538f73155c3330361286dc315e2bc9851225ea25af73852ab5215abd8e84af3a20efc4679b7d7d1fc44eda2a41a5a2174cd63ea3f872068fa3a3c3c4edbbc2c
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKmp:N8RFEL8XVav9MkTQfOKmp
TLSH
T181157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 858KB
SHA256 041b9993447e922b02f44c14f0dde88c45a2b254b564a0801d8a40d6c5553e7a
MD5 e7d7d58654bcb4611282522e644d796b
SHA1 e3293c1bf9e2b28c61fa5e2ea9e99f0ed810e18c
SHA512 560299cc34213a4bcb75e12145631cdb423a4278453651bd1f9d2c4d9ee92763f19e2ea3f7e9277e3d7852b2889ae3ee11ab76e886430767ff65ccae4aa864e5
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKJ0a:N8RFEL8XVav9MkTQfOKJN
TLSH
T124157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 858KB
SHA256 90fd46eba9ef8f18271ae1ad998a88da1c53a3ebd58e5ecb6191235503073963
MD5 e94bf1e1fe72ee5ffb5251fd8ae17ca8
SHA1 0f350b7be2d78659b13fcb82da5240cca145cfde
SHA512 fdf6d69105ec242a80fa88096c56d71554413f5e78fe6978a8dc3246ef61ea8efa129acddd3ec0d0117fba607d5fb8c67dbfb485c65ab25d64ff622a8e795da7
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKrF:N8RFEL8XVav9MkTQfOKrF
TLSH
T144157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 858KB
SHA256 713f3b758fae9a2f145a95bde875462a71e8f093483efdc09bb2c27a19e5646c
MD5 3bc33c54911e4ffaaf164c245ed89fe0
SHA1 cdebd1d332e015d9649c2ac5683233c8b478442f
SHA512 671b2119cfffd79e1cec0edf19c87ddef466d8b14e460ca5999c7d188e2561e0f8482c45f11ea0661ea45613429147378815aeb273d1a4524447a56863749c3c
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKkC:N8RFEL8XVav9MkTQfOKkC
TLSH
T1AC157C13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 858KB
SHA256 80b2e510f0d1e1f3b5c4a808abaf6d96211bf287e407063d56f4e291f5e86e4e
MD5 d7891afe7f20fb1fc348599e87c6fdeb
SHA1 d3afc006529ce4acd05201a232b2edee351754f3
SHA512 84f19c9b306f963ae9a0a679bddaa73957ee1f11c8f5aa0a530014c8f78f03fe949ca7708643dd1a2dbf363ce68432d632295a36e678219942c23a5ce2de0f9a
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKfw:N8RFEL8XVav9MkTQfOKfw
TLSH
T1AB157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 858KB
SHA256 aba3852c0d0e2571d518578b32845839807c2ed5fdb662d6b5253522952b8e3a
MD5 ec2dcf1d549a6f1e1bb9c712e0bd4938
SHA1 19c6436b11a85f1261cd6729fe9741efe56f1ace
SHA512 10414c0e4f39f543361278f3a8df8212b55916c059f452848fa07c6d86286c8d6c4820213f291ef49ced11db125bc08e6691a8a46631eea605500a8f527be081
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKOT:N8RFEL8XVav9MkTQfOKOT
TLSH
T1D5157C13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 858KB
SHA256 77c0c0e42b193de7129e1463d197262a850e2f5b2aa47af69998b1af4e4c3334
MD5 c55b2d30bfbf432ca7dbb856d500f4fa
SHA1 f18556aa4914155f16dca29e1c64161ce7c95ffc
SHA512 6460aa480fefe891dcb828489a1dfb8218bd4c8b098a713b75fe2f97100cf2f1bfdabed9ec30168cc596ee9dd053eb398aeee6da211bb7194da4680b71975ed8
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKWu:N8RFEL8XVav9MkTQfOKWu
TLSH
T128157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 858KB
SHA256 b5b7c914bcd2671498e1ddef5bc6aa662110c62ce2cb8328f96157300c01fdbb
MD5 44de9a7382cb0b554e1dcf624c43ad15
SHA1 73365da5c47e2c08f650b73a89684c2afee38fc7
SHA512 31143db335b2c0bb3d85e432e532b8182c3b199495d0721e1863a6240c8a987afa350d8e1a8bd313cb1c8d240049be4a121c1185b7038328d9b9f66aa2fd7196
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKAb:N8RFEL8XVav9MkTQfOKAb
TLSH
T167157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 858KB
SHA256 cf3c1c7ab628e68ffe20e4ed85b0db43accf917862eb04a979560f5b236b959d
MD5 1ff2ce688ef69a69476813e1a21247a4
SHA1 29876ec030266a6e3b08d9351423e3756e52403e
SHA512 e8ef33c5e9e6757bf4e26be2c103d4f232807f3ce23f0e41ae08b08f2bc41304b36f1730305f7fb9565ccfa8ed3ec741b64f7e6c7c86ca3d2b3c813222491256
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKuf:N8RFEL8XVav9MkTQfOKuf
TLSH
T10B157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 858KB
SHA256 8ef28147020453cad1f52c7249400169213c34f4e1e5817addede799b7171ff6
MD5 7a0ec0d557d47506a0be40149ff18841
SHA1 c58b80a4b630e36ece702b04754b1c97d476a4e8
SHA512 a2987bcc47687740078deda14c2098032770f9498883d6ee664f606260e0c5b1fd1d18d023bdf52db13c41d343dee16818bf8de9717914bfb1ad3ddd3b6a3a7f
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKrK:N8RFEL8XVav9MkTQfOKrK
TLSH
T11E157C13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 858KB
SHA256 7329e4a08fdf2346d92b74397d9f8d4be8d986f60af347ab373509ee0008319a
MD5 22007e4ac4e30e5557ab1870fbf469d3
SHA1 8311032659ad91f2fc39295783b45aeb648dbca6
SHA512 25213ad0384eece08a49141a46babccf44803f75b868eb0da8fbf40c31d0d4675d338222e23ad97ba6f97d668907af4c9537d57618578d4f3d1cabe03b82a608
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK8k:N8RFEL8XVav9MkTQfOK8k
TLSH
T153157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 858KB
SHA256 6a610ed4a207071b0d1271c947691fc0e01ee0ca2f68b53b4c0258806f6d8d4a
MD5 7a97c969c90756e4fbb682deca28f8d5
SHA1 bdc7fb78777de9f51fd34b0869411a40f5103135
SHA512 247577b974b517d3dc2faef81790706c42eabb41380934597de16dc4494ac8cf821588312169c36d2c82fd9cf218d6383da2b9247030a7c54c7daa0ea1ee4173
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKV0:N8RFEL8XVav9MkTQfOKV0
TLSH
T141157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 858KB
SHA256 72c98821edf128b0858c4655f840f44b506736411e0cbea8c297597bff8e6fa0
MD5 f3c2c1fbaa7e489d9237f68aa121a6cb
SHA1 6aae4c672dadc6f281ff5cf32429b0546f887598
SHA512 ff7dba6e39e584087ae3587d127bb81ebf59a48e16b542b65e65a802cb888a43f30f970426f015609326c857fd6c0fd0bd0c84e43ebea95f1679156b00d32a37
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKY70:N8RFEL8XVav9MkTQfOKYg
TLSH
T178157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 858KB
SHA256 80a3d1b2270de53f101324df073a53ace64dfcc6e1929f2cab6e60aa51cb1050
MD5 1c08003d862cc2e8c44667e4cfc82282
SHA1 d067bb5f3faac7b1b21523ab611535b9721c78de
SHA512 2573204c623bbcca0db17523916bc4730a80ac4fd126b4fe7e598c2964e98e05d03c2608958e94ef40fecbfa8be51b5dfb0716e9299df424bbd3967c92b7449e
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKNr:N8RFEL8XVav9MkTQfOKNr
TLSH
T1FB157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 858KB
SHA256 716d09b8ee64924c02205558576c65ec20b9ae3534b1e9a8dc0a906608b3a938
MD5 60b293d04f560aef32599b575cddb309
SHA1 be389d293bc63c2106c44e6bbb15ec35aab0f349
SHA512 6b336cff77a10e67d90bad3cb2775a3d3af84917a29bc75a0b5f3ae6bb5387273800e6407367cdefb877a157945491fb95d500c28a8f015f380163b4481e7422
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKXn:N8RFEL8XVav9MkTQfOKXn
TLSH
T176157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 858KB
SHA256 b9f54bb3d7cd1026bb9bcfb114456fdeca3be3a9eed1368970baf6f1e95fcb1a
MD5 0325c5bc6f6fce5c5d420aa9854c1f1d
SHA1 6f84655ea8c775c845a9ec71680af5f888eb20d6
SHA512 1ffc46ea28b4e9f2bc88138f1c45ec3d282dc9abb917d12ecee46d26abb9ee5175c72b5d957e9c8de11ac3e35e93dae46070d8fa365e25f71b9ecd7a6dbd4485
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKTx:N8RFEL8XVav9MkTQfOKTx
TLSH
T134157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 858KB
SHA256 839c98c43fbeacc3e46b2c97d718bc536815f37d6136ccfaab31be5f2b49c698
MD5 cefc1ce34f850962da5008cf4e53db82
SHA1 9ebf429fc83edb94d4f95e816a7f4f4bc2294e8b
SHA512 959ad87bdae63fede4d2edec3a7fa9787b5ce3db47b3b2c8beeb55cfe38642d1d3922cac92d204b2a34ff0358477705ae0d8b56f09eae847614c1c35865e1bc5
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKRA:N8RFEL8XVav9MkTQfOKRA
TLSH
T179157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 858KB
SHA256 83e201e026dcb63026278aadac84c2475dad00d0b99bbc246f2622bccda65131
MD5 ba02cb2185000e7b6a27ac51a052848a
SHA1 2cb17cd852751eb07d4b69d563d84d4b75f135d2
SHA512 b32cc20bfca9ee1b3d712bac2950f73f7e854cbb852df94f336958c3cd754c0133d1d8f1d0218d4b4d7d3b6ea6844f4f34c0746d2574c104ec1549fe6bdb472b
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKK9Q:N8RFEL8XVav9MkTQfOKK9Q
TLSH
T1DF157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 858KB
SHA256 527ef9f5c6f38beb6124c512933777914ee949a0ebb1527925fca9e1292e0dea
MD5 625c2d02217dd8847bc346644ddea111
SHA1 22a297d90b379c8c66289bf0b3ceb9d85e0952c5
SHA512 9be0d28e1ccc88373054b885ed07d48210c3669376bfd580a83dfc5b7f41d98c9ffc222616d7a9b4dba871fcd187efe582c3e5558de74a87b2a1991e7e139b7a
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKf4:N8RFEL8XVav9MkTQfOKf4
TLSH
T11A157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 858KB
SHA256 7da8da71e73613d5f6517563839477e68a73642f6c06e4f5337a2185d3af85e8
MD5 402a794854efcb2c32072a750b7a76ca
SHA1 23d5eb5e23f3b5a33443ad6d5f792395dd31a454
SHA512 c580f7a905e35c2acb866c60b29c30edeff98fc51948f9ecc0fe8bdf4f380f61354f55a9511eb58c0576ecf7bcb78356f63ab5f2d232f0945782c30ef03d96d7
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKOu:N8RFEL8XVav9MkTQfOKOu
TLSH
T114157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 858KB
SHA256 35494d9e26dc54d555260eaf38f44536029af14388202c49f404011ba5d7ad4f
MD5 07d0821768b3d0447884c06d2a0ab57b
SHA1 a20bc3350abc701be471df8c27fbd9e9cdea99a5
SHA512 635d3a86aa04dbe19317f7219e98aaf1be9fcb9680e83818729e829c5fb1b1ac2cb1a7f25642f347e4852378ad0983a193fe3b7847d59cb9a6b0fd65741e6ef4
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK/j:N8RFEL8XVav9MkTQfOK/j
TLSH
T1E2157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 858KB
SHA256 25d15349f654c75120825bacf94921dc1e251475756e372a89a7a255658d0252
MD5 dd431acd71d0ccd4e7b0554e5fbf72b3
SHA1 02c7b5411e0e233372133906d06ce21067b09fa2
SHA512 f4d271b7c8a70c44f6a0e9e27fc71ebbcfd3924bdf1067c7f12adbea4710199a741bb43671575a241925f5bc8cb3e87c3c50f61666fae50c574e37dd2ee27290
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKqg:N8RFEL8XVav9MkTQfOKqg
TLSH
T135157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 858KB
SHA256 38fa5e58abc8b18bc2ef7d310cb6607f2ea1bdcff1fffdc0e5372af7660e3a7d
MD5 7bac06150e6057f900c20b993a1353ec
SHA1 e69788635a834dce16f02a928e1d2fa236594b29
SHA512 ca6a611ac1336a792dd828ffeddb67a7118a2971de85c621f2328558b1156c2e2833c68d7225017a00cdcc4c6843ba786058611a62f250d2dae0be39ce803e4c
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK1I:N8RFEL8XVav9MkTQfOK1I
TLSH
T1DA157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 858KB
SHA256 4b122f6028f3d53aa497a57a11172487c61e487920872531234732b8c3ba38b3
MD5 c3dc48138d36d68c5269b5cca5190617
SHA1 3258d6f0300b5ca0a00932f05faee0d1809c2466
SHA512 f5f5987137302e5891ffffe9d1b58b564066ac78634277003b14174b10e52e8daa8beff4cd485422d0d52c505982d2d957b21e7d446b8e15a52a367270b17ef9
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKno:N8RFEL8XVav9MkTQfOKno
TLSH
T1AB157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 858KB
SHA256 5c4b6c9274acd7b2c6ad4ecfedf7707ffcb383cf4f7266b9a91e893bdfa1cf63
MD5 303344cac8e14b4c8fe6f7047e110719
SHA1 6e4cbad8d8115648bd9927766b56b553a56b52fc
SHA512 21f9508fce9d5d4de50e7197797396da6cebe517052019364a141ac4291f0968c8747020c339aa123636437c160e308056ed2a11215296dab2f1816b58c5edf6
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKM+:N8RFEL8XVav9MkTQfOKM+
TLSH
T1AD157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 858KB
SHA256 83c5d279a08b8969e9cc8473fbc20ce4cabdad7ac21bf2196cfa799ff73185f3
MD5 a57eea8b65d393ee2a76411fd169941b
SHA1 ee03d59dc2dca0646461ae10f6e92a24cd4459e4
SHA512 295442b200b7678f8dde5f1a243b74e39e85fef460246d54bff8f629108273bd78b839306290804662b073b2eefa5dcb3e74e1e097b8d4ac2fae75ba44cd8d9a
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKUQ:N8RFEL8XVav9MkTQfOKUQ
TLSH
T190157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 858KB
SHA256 975f9dcfb22ed65321828e3292ffe847ad6abaa3b40ac0f71278fe8c67d809d7
MD5 d786f49073bed1f7d2e6be380723ab3c
SHA1 bae11d4bb573b97c0aa95f5e2b27a0e42d9ddc31
SHA512 6643724302186eef1482cddebea610f44be06a21698f4865da95ae3247009ad06bb5b5af2990e647dc854d3952d59e2e32b2355163d9d0411d48f1622e2b9bc4
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKNX:N8RFEL8XVav9MkTQfOKNX
TLSH
T12E157C13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 858KB
SHA256 504311e6bc8f1f3f5313e11fc4259991da322098d6e8e41cd940300f4a341a7b
MD5 f93010780249f910244891acefeec344
SHA1 e0e48aa04fed053303c4a235ebff42bffb5c8531
SHA512 36b963ad8e20000e01c94c3ed7a2fdfcbf6ccbe0b6af92180ef6316d1c52579203bbdc71a3545e26538a576663d1228c61673a34d309eebdc39b8a9377207fa6
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKvL:N8RFEL8XVav9MkTQfOKvL
TLSH
T1CF157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 858KB
SHA256 5c6cc30c651b5215fbee97655936ceedc476e41ba78eacb1f4d50d4c429f92de
MD5 c34a3175a3733fb9bac3110eac6176ae
SHA1 23b849c219381a43d2386a75b586b6e3dd8a6a09
SHA512 e388908dc4c35131e2efaa0292b35b58c504e698af926b58d6a6fdc2b66701962d96858f51b345371eb90f3ecba1b5c5694cb3ad49c790aa4f2fbdfcfaf19b4f
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKlFC:N8RFEL8XVav9MkTQfOKlM
TLSH
T12E157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 858KB
SHA256 fc742921bc40b76e6a1c40326ccc57307ba6518113b1c2182355a712273311dd
MD5 f7262525304c08e40db090d5f417db40
SHA1 027985aca30281e7fcf6f1248e92396c160a178e
SHA512 bad55fc0f383fdf1d59ea53c7601db3032d9e2fec7c5a72bd07c1e586312f8e2d56f9c03199cdd5d38f45c315ff8cd705c76280179364ca0a9a5fa2c02cf3c28
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKWh:N8RFEL8XVav9MkTQfOKWh
TLSH
T104157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
Size 868KB
SHA256 9987f29dd114d645c5a715f29ae1b898b00bb85067386bec5990dcefa62aa505
MD5 f451e4301c4d5dff63dd365a5af371b1
SHA1 13d787ad2f62ce9a5b9fe83de37767f62f6abcfe
SHA512 795c9b8e00f272ddadbe60019e97cefca2e6b9c3c090c421705a3787bf2d2499c57d96ccdc0b6f98271a28f3ee50aa38033354d9aa556c630dbbd54a286e00f6
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKT1:N8RFEL8XVav9MkTQfOKT1
TLSH
T18A157D13AE6898E2E57A4AB94B71C6059F357E210B00D7C7D3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
Size 911KB
SHA256 ecda769163679ee8e1d654afb66638c376559ff1ac39b254dac69d67335fa0c1
MD5 37159aa8d4694353323a80812a171f7b
SHA1 dd176e809c20ec7090f20bb74abd1449f738c280
SHA512 f4166a2b7996b3d386d37e4f0b07fc208f1091e916fc5a7b2442bb41eb079c8132e96c18f09a33a0c7d248a1b48b0e31e0838cdb32bfe5c77a23202faf317287
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKwKHkUl:N8RFEL8XVav9MkTQfOKvkUl
TLSH
T108158D13AA2899F1E57A49B84B71C615AF357D210B00E7C7A3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 879KB
SHA256 df16bf0713567922b50a8eb9a30b91bccc4d2bf7fd538a9e9eb31aeeb071801b
MD5 7052f7db94025f5219f6a332ce7e4c2c
SHA1 37ebec424f1a8d2a062f47d81850fa6495aa0e65
SHA512 61fdbd1aff79cfe403a3a19d1eda8319dd0b47a56a0f25931cf87b1ae234327f4fbf3a1831de2d407195c9d00da1610dff2f97dec71b6a436ffdb0b64a0aa7f0
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKHwZi:N8RFEL8XVav9MkTQfOKHwE
TLSH
T182156D13AE6898F2E57A4AB94B71C605AF357E210700D7C793A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msotd.exe

Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
Size 891KB
SHA256 551227fce6dcbfeb1daad12f383d394e612abf773414cad9e0d3a75e486c01f6
MD5 b1b26fbbead080a0249083087a630f63
SHA1 54908fbeb165b1b0029db103b4a131181775455b
SHA512 95d587ad00b164a295191a521b4cecbb9145139c82950237adece19d33e96a11b8cee3ca780acf9db5d03e6a59b90781bb58df46adade54ad4f556e80f2f0d16
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKHa7glV:N8RFEL8XVav9MkTQfOKmglV
TLSH
T1EC158D13AE2898E1D57A49B84B71C605DF35BD250B00D78793B8BB9D8D333E0AE3D625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msouc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
Size 890KB
SHA256 be29c832d3cc00261918e828e7bca992b3ae3a934dfdc60b242915f72c6746eb
MD5 6719f2df36975c442ef4d68696713462
SHA1 cb108e6ec4be302a5f3280223137db7c2ef233d8
SHA512 192d02c16512a2923897a9970b55cf58a32110e7008f09b0e5dae378f98b2bb376ede6957a5c03c2a7c6027b416aa3686d2635cf7dab36c71e51d6dce4e9f28a
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKk2+:N8RFEL8XVav9MkTQfOKk2+
TLSH
T1B4157D13AE6898E2E57A4AB94B71C6059F357D210B00D7C7D3B4B7AD8D333C09E3A625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osmadminicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
Size 896KB
SHA256 ad086ce8dea101352c61c5e6c0fa9e9c2f27465ee9af294639b560544b25a764
MD5 e7a7195a57efa696fe05382d1273121e
SHA1 6f978128fca6ec261932a488df5fd9bbab351f9e
SHA512 b9f140857b6ce696730f8aa00ac3b3889e7ad88894c6b39e0a9388fe78dc22c14dad46af9dee19a4c9d0f0dd707f5a49c655854be1113bf8690d59eab2a444c5
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKi6:N8RFEL8XVav9MkTQfOKL
TLSH
T166157D23EA2898E1D56A55780B698604DB35FD250700D78792BCBFAD8D337F07E3D628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
Size 914KB
SHA256 93788915773793590fc0d132b56e0486b26804f044ee89dbae6e1a3b4157e3aa
MD5 07c7f706cbc2fcda8e74dc8dd0bf1cb4
SHA1 75654b7877aa4ab6c0eb068242ffb8956bdc1824
SHA512 7c40da59bbfaa60187fcced768233d35a28c87630ef7775fe44151fd318b1cea99ff3fd86a0a03f2afe834ee9378a982163ab5aa89ffbbd0bfcb2c9bcf4ee696
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpKkF:N8RFEL8XVav9MkTQfOKkF
TLSH
T175158E13EA6899E2D6BA05788E65C7046F357E610B00D7D793B4B7ADCD333C0AE39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2852-24-0x00000000006A0000-0x00000000006A3000-memory.dmp

Download

memory/2852-1-0x00000000006A0000-0x00000000006A3000-memory.dmp

Download

memory/3600-10-0x0000000002050000-0x0000000002060000-memory.dmp

Download

memory/3600-25-0x0000000002050000-0x0000000002060000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads