334c2a0d1fb344013be7b64879d9b57d033f6884c37812203672f8a40c519792

Analysis

max time kernel
126s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 937KB
Sample260707-2faxjsfs4v
SHA256 334c2a0d1fb344013be7b64879d9b57d033f6884c37812203672f8a40c519792
MD5 e260287fa2795a94e358bd451f77e1a0
SHA1 8c67ba050c007c7b46a62417221dd975c074d4d0
SHA512 3cdb73082fee520fdb45760f2ee312c2342995177eea7862ce1d005574e2544f81236dc313ade6833b3cb86962ce4af0fd5a630a9ee587ac88960dc4aec1a02d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqw:A3kMr56rm
TLSH
T136150506E6940AA4D11F8174DB954662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/5164-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4f2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5164-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5468-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b2fa-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018985-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a5f-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019851-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-249.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a61-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-283.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-302.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-418.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-437.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-456.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-463.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-528.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-650.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-815.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001891a-1489.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4f2-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e6-11.dat	aspack_v212_v242
behavioral2/files/0x000500000001b2fa-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000018985-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a5f-209.dat	aspack_v212_v242
behavioral2/files/0x0004000000019851-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-247.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-249.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-263.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a61-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-283.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-302.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-359.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-418.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-437.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-456.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-463.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-497.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-528.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-650.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-815.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-852.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-883.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-902.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-922.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-936.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-949.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-980.dat	aspack_v212_v242
behavioral2/files/0x000800000001891a-1489.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5468	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5164	2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5468	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_e260287fa2795a94e358bd451f77e1a0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5164

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 937KB
SHA256 334c2a0d1fb344013be7b64879d9b57d033f6884c37812203672f8a40c519792
MD5 e260287fa2795a94e358bd451f77e1a0
SHA1 8c67ba050c007c7b46a62417221dd975c074d4d0
SHA512 3cdb73082fee520fdb45760f2ee312c2342995177eea7862ce1d005574e2544f81236dc313ade6833b3cb86962ce4af0fd5a630a9ee587ac88960dc4aec1a02d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqw:A3kMr56rm
TLSH
T136150506E6940AA4D11F8174DB954662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 966KB
SHA256 b0bd79e2bccd7624e6c713fc00ed0e4352734f02acc98dff690deff6f98f9909
MD5 fbba4687f663404058a06b2015c5c332
SHA1 49bf858853e49e7d8c7a4e4d2ab3ed3d893461ac
SHA512 79e1ded2de188deaeb3cb4cc737fae1322d3090302f58b189aa793c922c1a34a3a132c69a14c4a578caf60a399736f56b7d17cd3be4342a71c6bc71f53d33602
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqCP:A3kMr56rm
TLSH
T114250506E6940AA4D11F8174DB954662F6737C225FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 0e78729152bc413a4d56cca21ad8ebe75c7f6fd52681bc06e6d786e81284bc80
MD5 58b4af7ee8ee630927f006394d0d6791
SHA1 b80b37cf9c5920f53df20f387bb0244b39f3d54b
SHA512 65b8d614a44797285af25a9c1e39d0ee6cfe1ffc99481fb2e05d248a838ef23a5ca999fdb2bbf187c0f42ff52553774bbc399ee842bc49323aee402255c47745
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqI0Le5ji0hmxNrM:A3kMr56rmPji0Aj
TLSH
T105651816E6644BA5D02FC074C7925656FA733C424FA087CB13D4EA3C3F266D19ABA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 952KB
SHA256 2d98cd5fbbd6934cffb7ede9538dbd01b3a7b13f6b20ff9bfd9ccce7d914cf6e
MD5 05ee12712e5ac9f9bf6718ad068a324c
SHA1 1171ab8913d88692e8f66aeb909dd9f6d1c583af
SHA512 9edbae1f2da10d96f60513814b2e548623dc208e9095d0930bb16b155655820e900057b661c1249643e9d7120f69cfd3ada6432b2ab7f9a13771b56cf2c8fd36
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqya:A3kMr56r
TLSH
T10B250506E6940AA4D11F8134DB964662F6737C125FE097CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 961KB
SHA256 02b2ccfabab9ffd997efa6f8e327f87a804c04c2c1e887482f82aa51c4cbf01c
MD5 18f9140058fc2c2620a74df23ad96f73
SHA1 6d58149ab4ed1746c599e1057716ce2b8c5783a0
SHA512 5da167eeb07b1fe9e03874784beefc71362089b116314ef27e2c608bad62c257185604605048bf8aed39c866e18119fbfe5189c7fa2ece221e25b3126c3ab192
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqsZ:A3kMr56rE
TLSH
T19E250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 961KB
SHA256 0837cd7aea278e33cba63c9f84125749fd5c16fd1aa4ef08814fe1316016aeba
MD5 9160a54fe23667df4068f1a9b0db34a9
SHA1 8447aa1f17a6f06bbcf1a49c12f2ab02369410ed
SHA512 2553db12552bc5e38b61696cfea824c7a21da8963c8145a793063abc75f7091d7e2680fea6e84c922e6867a543fd1c822be07f22476f6378859195e7c0094776
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqj1:A3kMr56rb
TLSH
T17C250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 961KB
SHA256 c1818bec6ece028b87832a63c4f6188333c9249e385eb519d327a6c8db789e8a
MD5 0a71557515e89a427c6cd5ae3661d0d9
SHA1 917f02b6cbdaac4f40fe175af1002da42999c177
SHA512 a01dc3fd74b54122506628771b418d1ab7ca77dfee1d10dbb0542076405752edab1a5e533cee753b1cf86d24abada947b00d73935fb81db634ed6f02892c194c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqD6:A3kMr56rQ
TLSH
T19F250506E6940EA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 961KB
SHA256 d49be34f4017b88d0a909316670b534e1527a74d178f88d5a1ae1fd42b191f92
MD5 8f25e36be6f6839eb2abdec7b0e0aaab
SHA1 9def3e6508674d3b01fcbf7e9bc7c0e3f3fc10fc
SHA512 49e4a0e246d7ff17d64975dca822f96611f6178b5adcf0cf4d3020aa043a2ef0bee97efb9f93d99a82dab239514c3612d35f56641253ae700122ac7d5e1287c8
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqtN:A3kMr56rN
TLSH
T1CC250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 961KB
SHA256 e35dba9a37196efa12ddc3941917e53423fa70593eda06187c5136eff1d36558
MD5 b8cf6626af0aee5520584328cdd0c484
SHA1 b3af984c40a4220455e6bfa7a371aafc42c44bc9
SHA512 3bbd46869373cc7a456138762d706c4522c59bb523145f61fa11a2490ae5d6a5a52490c3c6d54947f42646d75763ae04ebe726a0fdeba3c094c24f10d7d4bf23
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqbf:A3kMr56rl
TLSH
T1F7250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 961KB
SHA256 11611045bdb24cc11de4b6a209c7880562269f5e3311c91a025194ce25cb4743
MD5 9850c7a1d2196628a776b94cf3c1c3a7
SHA1 a33b71c1e9acba9c43ca078356bf132cf5163c59
SHA512 173abd7c846b4eb33d0bd62ed4f1e27771ff5e3435a396f4373a77eba365c381347ee5b1ec2ff96757ffa54daee8f0ba81c89c9055713e23b61c28b89e16592c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqNo:A3kMr56rw
TLSH
T140250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 961KB
SHA256 26d282cff5638d88e20d8daec07871fac152825c8e03ff95b39636d38f9ee419
MD5 56e02e02d6b65019e63bba1d457bae1b
SHA1 7bd1a420633cd055fae80c851e9f949baf4302cc
SHA512 13746c607cc52866d7b4afbb2f212b4c31a3a68dac8216bde771a4ad15476000d1b5f0d36f36c17092144f2dcfa343d9c696380cdc8c1ab9fbdb8d3c59ceda7b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqNu:A3kMr56ry
TLSH
T19A250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 961KB
SHA256 8831bb727175cccae132ff37f5c5fb906a4283b58aca78ccc40152f3c4f87229
MD5 5997349cc61ae54979a9d1b2fdf9e393
SHA1 f7307aa6fa17c3aef0a234afadae5b7b98a5973c
SHA512 ccede94992ff6e25786e909caf52cbc4fbd88671d41688bcc81586b061717db9f745552c01378b1a5cf6bf4d414942a8530b5e89ca20f2d620ac75630831fcfe
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqj9:A3kMr56rz
TLSH
T1AE250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 961KB
SHA256 9154b1174621d7b52601d85fd106b8ed7b0fdcba2d8a47ac3815b98f897e602a
MD5 989cadcdd3a1387e15095c975dd81690
SHA1 cea2d8a694b44279c6e883c0da7ca2101de13bfe
SHA512 12b13995b07c8040048c006863534af59a63a5966fe4776250107e10ea7fa39c8c825b0a2bfd59096d0cd71d3b50de8759d146a5fa0beac9e2ee48f405849751
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqPc:A3kMr56ra
TLSH
T19F250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 961KB
SHA256 9ab982569916c6f27990721f30393aeb58a1806373febf2ebc36871d4f21f942
MD5 b4384ed04c4ecaf3ccba8cedf0b19247
SHA1 11f484da09422caa486ab77a43e8f41bceb68c68
SHA512 1bc3076cd1f081a25252e86a1f0f7fbea8f99d869c8135666b8f477321d8069a9359c8d9356b23e5efd14c6a01007472687bb5cd85b10b4478d3237de0ce9ff5
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqIp:A3kMr56rA
TLSH
T1C7250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 961KB
SHA256 eb428e9b61809c053c7a4b1ee963783f0b12764fd72aa46bd656fc1da411b212
MD5 d96f1f811c1755915495885245b6c56f
SHA1 ae9fa24ad011d3bdcd411c429f2f593ff990dede
SHA512 ae1071c34db472a6292b041f694d845fde1b0678a439fca79f0fe32c9c847f9011e7554f48b85491a65c6c9897d933d0e79bee181c05bbfdddecc8ac6c22e888
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqfN:A3kMr56r/
TLSH
T12B250506E6940EA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 961KB
SHA256 df20e49fc17de2f2546771099804207576b6255204524717351278d3331e3a44
MD5 70d5539a5fcc70c8e6b04965948771b5
SHA1 03f89ea4588ad0f61766d506815dd7e4a7fdb46c
SHA512 f945b95422c8080e848e3405f0c5a5df4dfa8490818b61a7ae4f1746400c5f13c855add0ce7f0f8625e8ecaf4c72c6b30304919ab2bac47ab421bddeec234e0b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqdF:A3kMr56rZ
TLSH
T184250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 961KB
SHA256 79b15374c803d30e30ed697b7ee30fb04c77171e2da4f33a8aae649da817395c
MD5 4a55b0588bb946994136d6f31bc6ccc6
SHA1 240beb9e0119486bdba9ae003e53f65c7f7a788a
SHA512 49be618ef48612dae888093a61e2dcb5537a6817503ca2f720c041f275d94e021af38f703c9aba1041956b0d6900650db687a7ee8cce67b337f61c30fc1fb3dc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xquC:A3kMr56rl
TLSH
T152250506E6940AA8D11F8174DB954652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 961KB
SHA256 1809281f330e7e6dbfceddc5cfcaf4401136420378a5f77ffc2153df3fdd9cab
MD5 0b8b8973bd1544add41a5f7758f909ea
SHA1 c42fac0edb742fdab0703ea6c0bbcf945bb92267
SHA512 55cfe4769e88b57424c1b2150d25095ca0d3c5ac8fc270dc5b2bfc84bfb5ba73a9ae51e728af697df83bd446c6e5075190e186eea78089c3788bb245b68df2de
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqxw:A3kMr56rI
TLSH
T125250506E6940AA4D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 961KB
SHA256 95d5e234c4da913918156e1e3bd4afc942a5fbde8657d0b386c36b16e14d9f3f
MD5 d6cac4d28a665fb4806518ca695ec979
SHA1 5ee224275071696241fe7a1bdb758c512c140d1a
SHA512 31cf14a62801c453e095337226b9d9d61b96d69d75829bfa97669522e47eea748d7296fb30541d351e448048f61df76592d76689e236b918fd9f4a4c5a6303c9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqYT:A3kMr56rA
TLSH
T164250506E6940AA8D11F8174DB954662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 961KB
SHA256 5ff95b48dfc0cdbb684d524e279687e31fc7a3c772c38336def97bbf4320ea74
MD5 30bded17d4bf1962f3724894c902ef85
SHA1 575b2ce8235881ca6703defe38a7c762ac54bd9d
SHA512 3ebc1d1dd173bed750e5dd7947747ad0a43df7085cdc87ef7e7ff360ef4962f9a7349abc04e4f26b03d5f7392d3763af95aa786da66612a7dd4efa2fdfaa2361
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xq0u:A3kMr56r/
TLSH
T15E250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 961KB
SHA256 3514729e5aeaaafb39ac6e6d93fe85b0dfec2d99932381223558ddae07b33768
MD5 03190ed594dc597283da69ccd3e2b2e3
SHA1 f860918daad457d5369b19c8b84f8974cafd5a76
SHA512 c16765979954764b3cf3f09e10e37a748196a4d05f6cb2a5649c870edebe418391e4589f2b4b453fb6a49879365179e2b700dc6e1e45407d85d54598de067d99
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqib:A3kMr56rm
TLSH
T18B250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 961KB
SHA256 c9dd39f463da0f8ab1b2dd72002892eb3858c1281d3df5415754e9360a89086f
MD5 fed3727601265d4f6c34c488565d1773
SHA1 6171b83f814b0b3438a2a329e055127ced5b5e7d
SHA512 23d00bb8900b7133dbe29a47094d6dea86f812a36d26fda2223556a8f46ce3e766652758a844b4140fb716a1258c20d290830260995120f6dfcb8845fc169579
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqkf:A3kMr56r2
TLSH
T109250506E6940AA8D11F8174DB954652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 961KB
SHA256 15fbb4b4f425788b12146d6e3a1e5f708e1566945df038d7cab4d0470565631d
MD5 184237ae703403296621c96609b220e9
SHA1 81429e3258d537d7165ddf706c820c3f7534bf03
SHA512 5e944b5ba3f29bea8c2ecf6ab070eac233e71d424ee0e70c2fc400c8767d03a16783f2560122f908598639c6684ac09871fff4d7583fb431a80426f8a96c873b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqBK:A3kMr56rW
TLSH
T13A250506E6940EA8D11F8174DB954662F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 961KB
SHA256 a0f60a0cec438af4927695c64ea89f1f7c19cb31d8f2391216c486a7f882f124
MD5 c6f91faee27eb8f00cb4dbe720c06713
SHA1 644600988a5dbe6a50682b288f414a87a5399a28
SHA512 598a98dd397911de2940cdc25995f522658d577fb5f8532ac4762698f0ce585df88a9adec59a8dd23f0cad0f5e9e42f1c9496c8bcdbccf1b48d6734676a0eecf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xq6k:A3kMr56rL
TLSH
T1E6250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 961KB
SHA256 9afaf013058bae89a0c316dcd298c4bfa80eaef2dacdaa71b375ad5291740056
MD5 e8e1b68c1722bc5fad16c6b08272c5e9
SHA1 40358c66bed07074a84ee41e6e60c37b068c8c20
SHA512 4490bad03f0862b08d65ca4857f2ecb0a056fad6ae206e73fc0ae7b4a8340e2525c9cc4901341d1e059467191346ee394ad3f289778da87f9b4474108049b740
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqf0:A3kMr56ra
TLSH
T1C0250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 961KB
SHA256 399142ef9c15790a064f2b9cefc1ba0c44e958fa6a9fb9c54248cfc3505d8759
MD5 d4cb980209a568c348866c30925dc5bc
SHA1 0783ac5c9fae2e90cc395516e21bd28fc25253f2
SHA512 53dedf6065f7996cf626842403309f763241904a895e40c35cf92a1c0f9061f4efe61fd0dab18965aa2911299ca374a4fab3a393e5dc26538cc52dae3ae9b3bd
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqug:A3kMr56rj
TLSH
T101250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 961KB
SHA256 172e80fa58c399794ac3e5207b3b0fd002848478cfcab740c3cfe64f47deda8e
MD5 bcda8a12c3b5e937113f24772b8942d7
SHA1 eb41d0edd4ec91987031d31a4a1823ce56a85925
SHA512 68c270e224e4a249311a1a8db4520e1b18e582ab048e350a4837f9fe50de062f12e120526257577390034666c70e942896815c758d097ed5719d33fc772c5ffe
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xq3r:A3kMr56r1
TLSH
T1BB250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 961KB
SHA256 1fff3751caddb239f10fddfee6b9c2e688d0c93f9d6482ae051d70d6f4e0a378
MD5 8949b31f9c1abe1fbaa8416b59821136
SHA1 d408fc498140b2d5b35f02b1c46c24ef15d2f855
SHA512 93d57e382579628a54e858ee2f08c2862825f65b2d402bf8246cd3f8ac0de78669d720ba3dd836ce9341362f8c82dff0ea4dfad6041fcc2ddf7d4ff2fe370973
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqBn:A3kMr56rn
TLSH
T1CD250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 961KB
SHA256 c28ba1060cc43a459fe9c4d20d5ed51434f1a5338c0f2d3cada59b578e5f0daa
MD5 23b75147a07ea3fae0f21b87ec5a66d9
SHA1 6d6a82e210a88abb1f51f83c48dce80fa9ffafb8
SHA512 270b4a5be8131c048652c6b467c58601ce916356de53ab349b056ece1c7dfc9959a38b0cc811f23b0f5a4169fdaeb3bebfe0a20db6e7558ba9f89a288edeeecc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqtx:A3kMr56r9
TLSH
T126250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 961KB
SHA256 617701f292f0e131352ff33433655c755c1d2398ee9928d5a3d8240a14d56884
MD5 d0bd612291937375c4a34637716da9b5
SHA1 51bd79dc47b8420027abd7a2f7f938bed00fb68b
SHA512 153bf7df58a8c01d571409f0a3a9bfbb2d86473a23a31bb8a1ac0aee6ed0daabed1690c41d9b651067ccfdbbfd994ac1d0ba49b4c9fb24d903ec0f27e663398d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqzA:A3kMr56ri
TLSH
T155250506E6940EA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 961KB
SHA256 0175c02a251255a0c4e0a7aca04567908663f77e1c2e379b53c89342a958ca13
MD5 f2de68dd24bc8e2f952a0186cd695d22
SHA1 7181c5ba5a7b85a8e6bd6efaf7fcd6eaa6371fb1
SHA512 8d9467a0f9ed74f247360b5d78993545a77d544ee62de473a87dcac47b51160ecd3f539b895b21b5a49d009288131a30607da1c8331f831b20517cb9f6015559
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqE9Q:A3kMr56r/
TLSH
T116250506E6940EA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 961KB
SHA256 370a370e597ea53ba64c42a221f962df6874f668ac5c2635c663b056304194f4
MD5 b710aec7a750cd8b1f956c803663e5d3
SHA1 36b23252f34b713c8122044ad589069cba0dedd6
SHA512 c4f5687aecbff005de66f33653d8187b2b327f198a5fcadc28fd222556a0bb706a2977bba5f8d381879baf2ccb7408de8e50c4fe949659672b41a5023a11f735
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqd4:A3kMr56rA
TLSH
T118250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 961KB
SHA256 7564f5e5c2cfa136f0dacafc4e02a9c57bdbb449a93e60710f727b68d9cea036
MD5 585b00ec888f5f9b22890a0900f436b6
SHA1 1968c1dd440df38129cb21122ad2b61f99d0d50b
SHA512 12df0920356c372b6a45c854238df8aec40926eb6930aff86ad71702c867b579e918785c50db3518e0befa49205cb418d7657bb80716ec90053c48b8cfd8a6b4
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xq4u:A3kMr56rh
TLSH
T1EF250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 961KB
SHA256 d634992eb310babce419565eb48b16b749d493ab3b34a9593930dc4cf82e71c8
MD5 1de4a9110da55af5a8c24372c3cb8be6
SHA1 18ce2d61208beff0554e3626d9163abf903ddcf4
SHA512 707902b6091527638eac57e43ca90f1bd82c65eea79d6eaf71ad2311a825ee003d2e0a25bab517075e1fd3639cde66e7ea81322d051b6a1f1263f18b0765616b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqZj:A3kMr56rL
TLSH
T1C3250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 961KB
SHA256 bbfa9ca463b1a5f17896d6dfb9f129c86d85781236c7e7d6c3f01914d35e747e
MD5 818c52825764b30e2aeb771baa1e0c22
SHA1 3805797ff1d1acb6c3f508144fbad636dd226a61
SHA512 f386b8a5706d947be67ccd8a1c1052dbe1aec79877fec26693d665ab8eac6a609b8c561447d3a55400a5fbcd00d042979bce6614c4fc65bf15a5258b0e07c480
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqAg:A3kMr56rD
TLSH
T1A9250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 961KB
SHA256 c7946c8dcf22c2e9c56ac8ac2e1be9ed660d1321f3202648300b6e7ceda5213a
MD5 ccfbc0db686ae032346298c3088b52d5
SHA1 c2d2824208711ed4b8c1c129c4b42ad5c6a56d80
SHA512 c49029019b47be4532fcf3712e1e65e11d93f5218e498d31d4f5a86834082f0f4b7e3a894cadae9962d09f22b76efb41a88fd5a3c563ffb82e3dd376262dc713
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqvI:A3kMr56rK
TLSH
T1D9250506E6940EA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 961KB
SHA256 9ad2c47139741ca92621e2f00cea0f6a693fbb71f936f93897c70577ce466195
MD5 83a49d5b5cb89a34ef327a6b43fa16d1
SHA1 1ddebae2fc36904013485e3dbbf212ba92da6341
SHA512 f05b6c79ba695fbe755854670433ce82b17c79d62e8471c4f9c74fdbf49068fa9eb367087bdb8db680ca491d0f03a0792adcef8f301bf724f0664d2970adff00
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqVo:A3kMr56rY
TLSH
T1CB250506E6940AA8D11F8174DB954662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 961KB
SHA256 7b14deca3757df82cc8afdbe1d2fb3ae0fde5d71a811f9cc5e85113d121729eb
MD5 b11d373f5affdd8953cddc41a547111b
SHA1 aa8e7495533c9b93c73697be359a13a662bdc5de
SHA512 e3104b607e01dfdea0ec61689025869e6ca783161153a6a50bfa43688ad8111ff81ad07954abc60e27b1c476b9f14cd7153bd4521843d4565faece86c4c5c9c2
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqG+:A3kMr56rl
TLSH
T168250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 961KB
SHA256 b53023e9d0e451043868b7ff42de7c90522eb5c273e2c9b525013d345aaefb87
MD5 9c3fc5255348654ef7ceb0f4d1219285
SHA1 708f0c85bdd55c8ee3fd79674d282a0bb36058b5
SHA512 1667925838a095560d1b5f04b5d507ba15b6924317a4e7a06ab8224e095b8378d56a8d339f8fd51a1a6d467d4da1b49ac84dfbb8bd236513e06c4c05c63f7ed2
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqGQ:A3kMr56rt
TLSH
T178250506E6940EA8D11F8174DB954662F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 961KB
SHA256 7d638e7d53108b53d460d427f3c672b57d209f64cba063386ca24e9463d0888a
MD5 6fd475a48b0c5a8c320a423241c192c1
SHA1 36bf61b93def8ccc339d559d5cbbc9a528cb44d6
SHA512 8d78dd7ed2b9ce9de34358ae7b5247bdd76a9e17ed84e4b3b738dc609119f1fb60f9d0ccf73299ad14a54602123bbf4412e78179b8ac3d544a72602d15c7c985
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqXX:A3kMr56rZ
TLSH
T1DD250506E6940EA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AAEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 961KB
SHA256 fbe7db1eb959deb8054b214d900da95590c552b82ddc4f0c26a6476e184d0209
MD5 6ede499883eed30bbd2343ca97b9311b
SHA1 4fe78271806b7c58d596dd7e75149959a990cabd
SHA512 ee4ccfc4df29ae61c1a2bca0be65e6ef709f36c5cf9842f0bf7dfcd49a50f39bfc31ba64811f1507e84089a9adfcc052b4a4237fb059df0df3ebe48a4bcfe953
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqNL:A3kMr56rT
TLSH
T1AE250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 961KB
SHA256 325aa95c0f55c16c06a68641c514597458993fe8a81bb53775389ec36be475ed
MD5 9eb28d101d8bea91c8ee8f528eb67098
SHA1 f08f91c9a4d6b7d2d390a9fd1517ed15330cdf6e
SHA512 cabfdf35f992f4294aa8a3087caf8689b1ee93a9e2b4d608ce34efcc5ecf2b3272cb5ab0aa20e1730bb5daec0de964990965be8fe8e7b5a83f6a732ca50d0d86
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqLM:A3kMr56re
TLSH
T1E3250506E6940AA4D11F8174DB964662F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 961KB
SHA256 d5b87004c4c90e2567f49ff5d68bd0216c3e26ca1536a3cd263f062d33e359cb
MD5 2d7cc954faa26cce97d581fb60a8ea65
SHA1 c30dbf8b083eaf2363473b00b2466d5b6b19f720
SHA512 23547e6ea54e50e4936f7103451a94d98582caa53cb7942297a88d3ae7d13168536f9ed850588e26620360a2edd9aca43916dd807fa5dd778c1a92520bf420bc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiicD5Tvinrm5xqMh:A3kMr56rw
TLSH
T16C250506E6940AA8D11F8174DB964652F6737C125FE087CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5164-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5164-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5468-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads