72eacf5aeeb7d85066205db7abf904122025d5feb933c833852888d8f67769de

Analysis

max time kernel
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260715-nlhmpaev21
SHA256 72eacf5aeeb7d85066205db7abf904122025d5feb933c833852888d8f67769de
MD5 b90bcda9eb19fc8291af264f39ca325c
SHA1 f1adf99310dae9aa9fb83a1ad5951408f57e901a
SHA512 c386ba0b8efdc81505ef30c70c4c522550db0d509f5ac1f37aabaa7bd4a4a8f13efe3295e9d3aa924ee703825a590c676c7e76084e8c7677a7adcd7bd0a3bf0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstj:A3k03kHRJS
TLSH
T11415AF03E79400E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1532-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c53f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1532-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/940-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-688.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c53f-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-444.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-578.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-621.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-688.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-737.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-786.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-855.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-875.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-894.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-901.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-920.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-933.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-952.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1007.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1099.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1138.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1169.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1213.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1322.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1366.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
940	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1532	2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
940	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b90bcda9eb19fc8291af264f39ca325c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1532

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 72eacf5aeeb7d85066205db7abf904122025d5feb933c833852888d8f67769de
MD5 b90bcda9eb19fc8291af264f39ca325c
SHA1 f1adf99310dae9aa9fb83a1ad5951408f57e901a
SHA512 c386ba0b8efdc81505ef30c70c4c522550db0d509f5ac1f37aabaa7bd4a4a8f13efe3295e9d3aa924ee703825a590c676c7e76084e8c7677a7adcd7bd0a3bf0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstj:A3k03kHRJS
TLSH
T11415AF03E79400E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 1891a8dfc9c4a73af05db58a6da99f79927694feb5df2bc2075f66f0595f5602
MD5 514e269ba660eb29cec549b851ad2afb
SHA1 c6b7a07055fa818822eba993a1f53fe9992dbc40
SHA512 efee82a9b9a109881b1481c8fd8f2ec9e95fcd465dd919bf0687e9f1ecbf76acfa20bb4d211b277ce566761173523cb9f17ca0a48c3a21e5efe2251075fb719d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstf0Le5ji0hmxNrM:A3k03kHRJSPji0Aj
TLSH
T13E658C17F6A402B5D067C0B9C5E69A5AFA713842173086CF1398C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 3fade30e82ffa5e73a986a45e8f3c28a3b58f0e511e81eb0f666e01607a01ada
MD5 7b21b975e1fd96f3aaf4b56acf4fb99a
SHA1 e6e17c5493dfb880908f5e6c77472a7e295b023b
SHA512 33dedeccf22b8ea412b7d81c1cb3d76c452a67b507d23e1f5fb8f81f737c3b551c719a2bbe91301172d21dff11ec49a08b02b6b6d7c219790fedee1251b3a888
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstBa:A3k03kHRJ
TLSH
T1F925AF03E79400E9E10AC1749AE69A23FB75BC52176097DF1368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 5736d0e5415d43db2d83bef3040a97a661a71323d5d29758f609c831a54a71cc
MD5 1304926a00d48bc9143371326ab7012f
SHA1 890727063e13bb93b6c0d77a793e98def59cc4a8
SHA512 64af9638e8a08ab7d8c5313ccb44c4593a693d3ecdf7aeeb7a59d5427fbff4af732ec977f36a05970cbcfb3f4f671ef9af9e852dfc0be942f28c7ede63a93857
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst46:A3k03kHRJ8
TLSH
T1ED25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 29d3619df9c09c6d3618cce00a25f1f8a6e7b06d806dab1751633b67b13c61bc
MD5 35817bd50e71724f3df7ef10ef7ca809
SHA1 cac120a0c1c6d273ec8acc037e9d1a72193b41b2
SHA512 d4183a938726b6c79eac55904bd864f3b52f2c806747d34bfe1936e04b3e2f73cfcfa0ee33092cc1a3593422b2eb900fae03ac12d074295892ff82b72bed74cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstcN:A3k03kHRJh
TLSH
T10525AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 ba432784efdcede1aaa8b1e45da8626735e78cf6bc3ad7db3c3f5fd0709e6b35
MD5 ad58d18659f297a5aba291b38e8dddfe
SHA1 249c9625493b86a24b913e1598396260a434b836
SHA512 3b3869827dbb5610f3155198f39da6e182a4206006b2af892749774abad259e01069957e7b961e0ad23250a8a5d026748a90180111f6a9f16cb5b9e01b975500
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstSf:A3k03kHRJB
TLSH
T1ED25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 e01e35fad30cefe7ee2f662dd3f7c7882e9d1d1c66c0d58d01102721487d0541
MD5 11ab7c6cf787a7893dd45ff87e66ae5e
SHA1 e3ae8887325f0fca257f73389c6d591262c20e01
SHA512 b2b661dbfef874c973106f30b5f7372a3dc651eb0e273ce7c343fe45a0b88e2a5b4193eb2f1c7f9311dedb3e0cc4e8e78ef92d5f4afa81e17eb432a22a65156a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstso:A3k03kHRJU
TLSH
T13425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 98a41955e68e2b6a56ea9e6aec5c262e3514168056887e3ee1405fd6a6637ad5
MD5 db208377a7bf4c9a44b6e37123b4c4e2
SHA1 dc85820b10a8b20ced3a63c44dd08a562a9e0437
SHA512 334168ea001163e236fb2ee19333168e99b80dd10401882186ca31067fc3a54faccdfb5a31706b29279ba4eea675a8cd0260539289ea0b6f2a02fdde4e5dab7b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstMu:A3k03kHRJm
TLSH
T13525AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 2ed2ea2d03292a83caf52c431769ee636919a28cf680bbea1bcaedae612d8049
MD5 df726e6c9926006268addc0993f45277
SHA1 1f913652673f998156a67a59f9f7f0cb52aace80
SHA512 a55c9cc8fa2e255e19aa2ab7a12ef98829bf1dd5f75778f392023cdad468b5beab20c06428131c0086a0ce5233438f3a610383850eb28d672e583c7c4601200e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstQ9:A3k03kHRJn
TLSH
T1EA25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 037ab31eb60393fcc26c3772378b57122988b7e7ef1fff69dc8ed389c6a54158
MD5 1f2ee3ffea13904022ef9375b6cb3087
SHA1 4a19e88b46b5fcc3aaefd2a5f54d35cce3cb7d4b
SHA512 3cf569bae0f0df2e75c41f99d8d16140ed3b1df45d19517fd33e5ec78874ad7ef3202df3b5d4ba79fa8e6e581c4bd557f76b5fe7570419dbf187b552972707af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstYc:A3k03kHRJ2
TLSH
T1BB25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 a651dc7fa7fdf9d0db6cf1a89f4eac84964bd7c356dd3a4a1e1d137adbe4a695
MD5 524561a3d107bbbe0d663d2b6125888c
SHA1 8d3fae92542cb1f94cd861c1291b2b240f4e6871
SHA512 af6c2a14f03cd5a23bb69e203993598636b239606a658943e4e8b80d76546134af0a925b4585dc6af5a073152d31b8b0c6eac8cdd1decd7adca7aee092ee3e5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstxp:A3k03kHRJk
TLSH
T19925AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 b907299f1ef53c81b5004860bc908fe5c0cc57aa9eba6ab9a01ca67eaf7b5a21
MD5 15ff0100631d5ba22d9c80cf7c171b40
SHA1 b62c8b780e5911c4dfc7253bebb38de3f19a1b2a
SHA512 fe9f5637162cd3a8b9f04f3967d2b9b6d1022078b006b06f01e8bec8a807d5847fed1ea235fa94910645777405cfa5f06e61418056e77ee9bf671e81f57e849c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstGN:A3k03kHRJT
TLSH
T17725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 c29853f668e8b947dfd30fc87d1d7f1a688157c726437874bfe78fbb5f416a7a
MD5 beb5282bb04594f747ab9eb477729ab7
SHA1 e64a57c9d8d1ae2f732a9ceed2f2cd3ff1b3b722
SHA512 a95c3cb570bd13bc0b813bd1c5b1b0705b61aa082353b404ad4838b603d0a40e34fada670b9249608bc9d600128576de706a5be6f86d070713cf5cbce3eb2889
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstKF:A3k03kHRJl
TLSH
T1A725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 e4496664d1a65dbdffce495631aa7086ae11c54efa707ae42163752a074c6dd3
MD5 6c3904a77ff5789d8e3693f601210000
SHA1 f6fe2e1f918769ae6f3064b42a207afb55ad001b
SHA512 033a7ccc7c954dc65f7454f34283120156dcfa9800557dd3b1302c0c2da3d510fd84b39c4088f35b5104f2b683ec5be298d611458acfa3b092d49549a6d42213
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstfC:A3k03kHRJJ
TLSH
T11925AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 57c844e40341051aeef08790eedf09a71c7158988fb7b0f78168a353f3035a5b
MD5 2163041df9ddd67d44149d16bc0a863d
SHA1 8be38b43e71a9a51ba68b2215c90b0f408c73bea
SHA512 305bf36301c62e6e00c3a19819fe478fbca9a2743d0c08a49903e11c155b47ccfb21b9fd0a1465ea2b1ddce9f1aba5d90383e904ac9c93cd185ebe2993eba861
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstgw:A3k03kHRJ0
TLSH
T13925AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 32fcb1b2f1f9e4bbde215d377d4ea97eed37de2354c5b36beafd66f5071ff18d
MD5 f9f0ed978eab431774f5090f77d1bbf4
SHA1 908c7d7f4fd3f6708ab76f28686e3ec3c84083c8
SHA512 f5126b6399d1edc327f897656988033edbc946c029381704ebf76b970ac781a64a8344f3521da494048080d6a55b861ce8aa6c26db7a6e1b7fca7c79e5832b92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst/T:A3k03kHRJc
TLSH
T16125AF03EB9500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 35e07784e753c5a698a4cba4ecdccf7f055cb6e4cda13eecfdd411502960b666
MD5 bed419a91f652fff8e596d7616357b5a
SHA1 05113fe97711094f5c7dc4a71532e06c81486233
SHA512 35dab881b2db6bb454dccf7807e54cc86cc128e87d7d5e8c5871732011e633b08f8139ae5e33ecbc7eb3c4d09a18fc46d81086ed2372a1cc28445975e1839fdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst5u:A3k03kHRJ7
TLSH
T18F25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 2a9386b242ff91b81adf24390c90c094eb19a5f707c534b5e5fc4893f47fb6b8
MD5 d51fd50c86dd3dff07d2f2027d1db07a
SHA1 b333c49a3bde151bedafa0f1f8b85eee4c20a40c
SHA512 3496ac7e45581a2131074ceac0cd4cc87bbe83e1aec39fd9324df4c89985f7d54969b137bbb61deb0f404924315f1a0d7f8c262dbda3e0e980ea811017d647ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstxb:A3k03kHRJS
TLSH
T12725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 0d08e6fcb15167ec11deac06b0915f76e6880cdcf09f2be4539a9008ca6e2fac
MD5 6702c4869d3a22448382ccae0193a510
SHA1 99f0d723b6fa25824549f694be05766ee8184958
SHA512 6bf39f5b5331c50752677ecd6a9affc01bfeae8c0bee5fe6cf381d4628f113ff550c07e227909287fd098a1c4709ab102148f32babd1255dfa702ecaee66cef6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst5f:A3k03kHRJy
TLSH
T17B25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 056116ce97eea918f449a52c146bff3135c694db7ded68360ac5f6a9474276c0
MD5 156640d9bbb189570dc132c42f4b022a
SHA1 2415fb90fba2b959eedd6f6b9d99583ed154f58e
SHA512 601a1060df1d4c90d9c2c49d2bef98d6d894c439ee2e59235c26c2ef4c33ecf7cd6d185737b000392ef65ec2d65c2c92d3771264467042e58693830037739c74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstCK:A3k03kHRJS
TLSH
T16425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 6815f214c1219213fd287ab331aed97a15160340f226334943ab0bd5dfc70b5f
MD5 b22cda1d84c7ade9bf24376858b94a62
SHA1 9dfc3e1df9578b239254740a0ce4052a7af89d10
SHA512 616463eefda04361bbd91157932883008ca81d4e593b459a19cb8a7fbe59edfd5cf9b65567bfaf390a1ae318de3a5877a4cdd35c7c9cb725730be471c760a1a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstnk:A3k03kHRJn
TLSH
T14225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 753cfcc65a66e9d75eb9ff2aa6d2f4c71b48b31cd2d85939dcd62eddd8fe9f2f
MD5 1cef9dc908a2be68c36f1304f26d22ec
SHA1 c550b6e08d9c8787093bffa5d4b94c77458c6ad8
SHA512 2df5a244524f0d8fc5b149da492c2b1f6f7e6e2f32c5b65cb00d15bbe7dfed94982efe49b14227a3850f16dd9efd1def9bebfaefebaf920aad51e3845242ce75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstQ0:A3k03kHRJm
TLSH
T18425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 51ef28f96046bdf9c50783ef9f01fab897f87894f2b231dc038abb03bdd7fea5
MD5 2d1d5dac96d2cddcadc911c8d5cefaac
SHA1 924eb298cf0ce87ea5499b65cbc542bfb5d94a0b
SHA512 fbcd7e09f7a9942dd513b91aa7f39d42180b8832a70c56f4aa7edf059d31ece574e90142e3a31a22998c85f0a18e4ed79c3795f1780f8c57b35ef4cccbbf7b67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstrg:A3k03kHRJf
TLSH
T16025AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 14053882d7e7b36a8d709f5f1c901d2911830952a6125f228cfdd42f3e46443b
MD5 8e94181650fc224f9866993ee81435b6
SHA1 27525efce4647c5a0489a049380fa52155823976
SHA512 5bca8cbddb0d3e2900259181be5be6f6cd2a1c812f94a50b1a2a64680494ee9f08f08b961f10665d9c54c7ae04fa19e3c346b58f668a12f9185f48828d3c0c72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstmr:A3k03kHRJ5
TLSH
T1F225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 6c9f9a1c9d33c5cd277c844657ac97159232c77b11815524db377079b2dad8fe
MD5 4037488a08c24b4d716dd0e91a7ee0c3
SHA1 bed0df4385e82699d7e7c5e6d478cbfeb3da6ac0
SHA512 adea56b126c7498f01d8db29d8a553fadf5d74bbe699ce6caeade2d908a562198c3ef6f2d56646003f9c9df6cf5b7de337ab5d5e524feca788767c19f6739e4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstMn:A3k03kHRJz
TLSH
T19B25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 446f7cff46561df0de6affe08f8fa0a485d2ac7ad979701023f2f4f9d24dda8c
MD5 579f8ed4b7210170c2db0b1f885fb133
SHA1 e1d915d937920c709dae59d3ca09ea9dfe3c9c2a
SHA512 00d64bc90cb29b959fc73f8c7178bfe7132577cd2eaed4e4e33c9c406d9bd62373b9f6d1cca293a2ca0b2b6fbf609c972c707fd3cfc04baebaca883d84796553
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstqx:A3k03kHRJx
TLSH
T16E25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 8f5e6001941cc8dee062dcaaaff00fe4bd38b934904afe7b82989ee918cba74e
MD5 372fcd63bde45f2448ec5a12a2f0e0fa
SHA1 881a58c2860c810943b53450592f4772ea845389
SHA512 b31d6b21bc0f5e6e52bfb1289c5112e4a454f0a2d1ec76eea4c047bf1c05599cf486712bd4fe1e61b23d496c3725721154b378766e786296500551072febdce6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstsA:A3k03kHRJe
TLSH
T14125AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 31659feae90b6e01c5d48f059b523a89146a81c0e494fb2be064687f1cea4baf
MD5 f53d87ac10d8ec1dbd28576f27387537
SHA1 35512d0c96e3e2ef510986a66bef3c2b8b536513
SHA512 3c22b5454bee26e9160f5a5c82fe567fcf8090dc8a2d8fdca23d135f6e76e5fe7faa4506abcbf2c0b86843ebe137757d3a8efcc5b426f493f3bbfad43348692c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst19Q:A3k03kHRJD
TLSH
T12F25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 f656f4b2b5386d380626d5f157c3bab802db85641d9aab130af2ac8cadf02f66
MD5 cf491bd0dde06deb1e273ae7a30e711a
SHA1 ee468321267dc33b037c55791776f1b5c40dd703
SHA512 4d3f9305683927a7dcac618a89c7c6f4694d4636e43278cee5e827bbda77b94eaf45bdd2931ab3de48ca855becbed570119b4c00a254a45f037b77c8fb89dc59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstA4:A3k03kHRJk
TLSH
T1D525AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 d7e76a74bc5b1d00e466f18b69645c14cdb2492be9111b518110587131aa0569
MD5 f18ab782085cbff4cd8c59af949bb327
SHA1 4bf2751419643898c9a038116f377214231c4c9e
SHA512 6a6ab14cfd6740d04d1b721ccb1b78dfcd0e67768b76996e10498431d506e373c1fe3be4edce8a4cfe0fa4d4310b506ebe6c96a564a41a2af82d20e247cafe4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstju:A3k03kHRJV
TLSH
T1DC25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 76d781f344e3ecaa28f256fde6e8a78bd8c207c1038d955147b5b6cbac767b5d
MD5 0ebcae2ed8425794d21dd245b7097359
SHA1 3f07a82ad0dd304bc1e9eca76fadb315c399d94c
SHA512 b0c7c2a842e0b657062cb40c5164689705046512a99a9f78dc6723a0514e22716085e4d9883156885e56c385fb2e50644645dddc048b78ec7cda421ad8d3ed1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst+j:A3k03kHRJ3
TLSH
T11225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 92fa2ae122c4c6c72a49c26928c9691618b9fe92f79cc724a00c25a2b0013872
MD5 7721926124dd547f73e36e684d13ec12
SHA1 b7d8c0b0f9bb4fcc2e11401fdba8e712f7549f0e
SHA512 c429d082e7296b7fa7edaea18f3fb5192333af33933363e452db904d0c79ced031c128983373ec54e0b2a885864cd48478fe4da8bb7258ffc55151738b5afa93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstLg:A3k03kHRJf
TLSH
T16A25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 556a5432c9771da3b8b6c8824679c71ced75d5914b0d2a0d9ac5d4a4fe5819b3
MD5 9a9aebed2090570e899fd7d33b65ca78
SHA1 2d87bf066dddf8df2e47696da5ba7bcefad3f91a
SHA512 513258e3d368dd8ef11fb01b3928b744beda2890d6ae7e64cea5cb25594e333f935df8ec6dea99f8750f38a07619a92f3a0159b30c7756c0cc462b4431c64754
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstWI:A3k03kHRJO
TLSH
T18B25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 43fcde0c75a86efb4e75a9e853d8c4d4f8f9446e84820ae89b2a5392e456f683
MD5 1620939b8cc5875a404029a8d249ed69
SHA1 17e390ee2a468e8df507ad9243de89c596535dbd
SHA512 0dab4be97be894a0c096a7c897b30a9e8c557b5293b55c5cadf71a8effe2c9c901764ee3126570065acec80d63e47b4c6d6ff29cc318cd418fd92804ae692ef5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstEo:A3k03kHRJM
TLSH
T14425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 96bdd180fa1747daa94b858aab1b76d0b9ebd24eafed91fa4c0b3e3bc80b6f17
MD5 f0546c93274711a79893c544774e1082
SHA1 e00db1bc7b6fe85586dff9dbded9508416942f1f
SHA512 041132c597e8004685ea5118f519eeea2d33322d92425d96178d632c1d97c9f6b81f97fa390b1f1ad800bcab4057f8d6bef56fa6f87777cb194eb48999a7a523
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstn+:A3k03kHRJh
TLSH
T1CD25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 642d8117e247c2d6541909c9226290cd52d633b5d9f9c97719023b82d1c27be2
MD5 1b1a172c810acf448a4f4807427d14ba
SHA1 83f993939ea33c5a0e42e6ba0252af1b30db8ed5
SHA512 9bde3f6e5f387f12323db684a4fd9d18629f4f1e2127ef21bb5037f28059a66583632e2c19c531ef98ba61c431770a946f4aae31679b99a9e9cda79f81d1c1c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst9Q:A3k03kHRJh
TLSH
T19225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 c2e85ef7792ecb7045a21d4d64c2b6079388d92245c29d9b517782bc58443929
MD5 bea57cbfe4419c983a7bc7e6d2331e85
SHA1 3b1442e9f1493be65c60c3c07faa2165fe8900f1
SHA512 9ba9afb3eafc0e1c3525b2b22a8996c6b239e7a945e959e9d581f747d11dd5b032f22489189954b62e2873fef49564ae05f2d9b6654541f20409fd088f106353
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstyX:A3k03kHRJN
TLSH
T1FC25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 a6c5bc198718c5588c4accdf2d6a25fc7a90024aa481172bb31c5a1247ffe3df
MD5 4ce85710bc234f45df45f10aebab138f
SHA1 32874107d370f80ce7821bd1c42f452d41ac4a58
SHA512 036c8fea1ec306913ab41cd46aa4f48891b5ef7c706e4c25f314def59e1765cc6f396b140ded417dcac2fd0760404569a2aad4888751ed9c0c2463939dc6edad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjst0L:A3k03kHRJP
TLSH
T14E25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 84aba41c3debeaad2d6486048a9cbe21ae317c1adb2a0b5385d49e9a57ceac26
MD5 017f6352191e3b42d3e6943d756e4d37
SHA1 659232b3390f4ef18725d83d28c40784c8ae76db
SHA512 f957792b18bc460a673f0beabb8aae031851ede6f71544f1571d183c7373b5940b5cc2502a3a1ac648e5053a293e6b9f5dc9b0c7e3430630a50668dfdbb6906a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstQM:A3k03kHRJ6
TLSH
T13225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 237d5f0665db07a7756e37855e4469579bb20c79ef0ad872b7d3929509c10321
MD5 35752c8d3fa5bb46488f7cb9a9c9e5c7
SHA1 2e38c2d28812977d358ab72a7cf5c99061df1528
SHA512 e7d053f77cada23b0f1f76c26d5010b3c31403451244da7646d250c104bce126e6c575fc06f78c9e806d1fa420fdacc99b8e7c65e6afc88d1dab48bbf3cc5a64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjstRh:A3k03kHRJ0
TLSH
T1B125AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1532-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1532-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads