08dd0b8a2f1ac254f9a6c25493ffa1d5b98751f184b0920f31e25df33ee7e213

Analysis

max time kernel
104s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
Size 742KB
Sample260801-frj4pseb42
SHA256 08dd0b8a2f1ac254f9a6c25493ffa1d5b98751f184b0920f31e25df33ee7e213
MD5 7bcc460b38efbccdabaeafddb5f8cb0e
SHA1 15a56cee7b684cb71c99620d7ff60f8b4898bda7
SHA512 be7fe5f954878193888e46123426ea56d51e27c7b4fa317b445d2a260a6cece5eb3506e56e46e6c1c0b7811fca80202766df3ddc1c91431492b9b7ae7a63748a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGa:KIifqFu1//IifqFuyDA54GX79lSzQGa
TLSH
T1F8F48D07F6A244FCD517C17089E69372EA71FC225620AB7F2768E6213F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/3280-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c50a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000170cb-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c96-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-469.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-573.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-720.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1077.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1126.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1145.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3280-1556-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5060-1665-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
5060	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3280	2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
5060	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_7bcc460b38efbccdabaeafddb5f8cb0e_cobalt-strike_conti_elex_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3280

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 742KB
SHA256 08dd0b8a2f1ac254f9a6c25493ffa1d5b98751f184b0920f31e25df33ee7e213
MD5 7bcc460b38efbccdabaeafddb5f8cb0e
SHA1 15a56cee7b684cb71c99620d7ff60f8b4898bda7
SHA512 be7fe5f954878193888e46123426ea56d51e27c7b4fa317b445d2a260a6cece5eb3506e56e46e6c1c0b7811fca80202766df3ddc1c91431492b9b7ae7a63748a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGa:KIifqFu1//IifqFuyDA54GX79lSzQGa
TLSH
T1F8F48D07F6A244FCD517C17089E69372EA71FC225620AB7F2768E6213F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 33a15a462c54d4b7d3b8af5053af1bc8177a6a75f3cc0feb60d2676fcb530e95
MD5 ff34838617ef3b3b651e5909872d1de8
SHA1 7b5274663c430fe1dc35f817c0538d206eb89250
SHA512 9e5f8bd1943ec71e16514f20eec1e8898648e72a9ebba11ee5e662081202a4c5f29d4554c0dba5666c5e378348656eb94bd33e7b493815149008175e20ef300c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGq0Le5ji0hmxNrM:WqFgqFUHjPji0Aj
TLSH
T176556A16F6B44279D023C075C5E2A3B6EA71784217309BDF1399D7383F22BE59A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 790KB
SHA256 1dad08466850066006c8b4bdcb9eb59a18c0aa8701d7bd62ce78fe5f3a1298d3
MD5 cbdb76015d4f58a45fc5fbcb04f648de
SHA1 6b9de95c442620ff4729b3528772d6f2a7eab162
SHA512 f1b5342b9338a21a8108b42b925dcc9678e79381d9c1063e839f5c1008d86e3ab937c66d21bf8c74884af867fe5ecc0473847eccb26d8a288c2b4e765103f79e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGvb:KIifqFu1//IifqFuyDA54GX79lSzQGvb
TLSH
T18E059E07F6E244BCD517C13089E69372AA71FC225630AB7F2758E6213F21F906F2A759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 765KB
SHA256 a3f63d2d9c88f9421d167a4844fa81c129b6d3246cef1683509b4fdb644448ea
MD5 5b486adbdf9e6f98f514ffd4af74c7a3
SHA1 d8bc3aee896cfd94c29aa40bcd4b94a95f285c00
SHA512 2709f013136f9f63b67f28a14b5c6a4a105263652cf985f07ccc8fe890bfaa70ac0177935cd858d79416d3feee21586324a486e875d209d81a855f7e4cb1140f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGd6:KIifqFu1//IifqFuyDA54GX79lSzQGd6
TLSH
T162F48E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 765KB
SHA256 293dd3e332e15b630360184af379bc78bc833f228c197d6466b431acf14fc9fb
MD5 631383968c5842dba1714c62795ac63b
SHA1 087c07ee1fc4879cc745c9107e28725be877f7d2
SHA512 440678c1bad6c16d0a70cb2632b74f084e3c93ecd3f81117835542f0976d6c3810f40dc297906b02b21a8c1162590d025cd5a6353039a00d55ab639577712887
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGzN:KIifqFu1//IifqFuyDA54GX79lSzQGzN
TLSH
T1BAF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 765KB
SHA256 27d3ad0c6f0712a14c89e804545fd2d738cc88467ae9ce796f881f6849640f34
MD5 092432bb015edaebcc6c3c96c151ad5b
SHA1 df9bc9434a0f7691e5ce32626b6f2fb9c469520d
SHA512 237c29c08bd45c8b702e47c633e19f14a3b22978e74846031ba164f3185aa0948fed308f5c4ca1419c6abbefed54be0e3d143d624ed91b56ddfa29194d207542
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGBf:KIifqFu1//IifqFuyDA54GX79lSzQGBf
TLSH
T1D6F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 903KB
SHA256 33b973ecbb245396b39d353ad77f54f9008b122b71947b2d3f0b63d2422feb64
MD5 2c84957e6b5ae36fea567e7fc166e850
SHA1 486d030c11b0de82c8465db5085b2d0724235099
SHA512 17f86cfc1b74b2c43abefeac38dd0f968dc8daba3e0cf7467dd9679056b4791b322ea1bc4409523496be2597a748741fd2368a71efa6e7bfe3c2d888f09ad9e4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGMzy7:WqFgqFUHts
TLSH
T157157D07F6A214FCD517813089E65372EB71FC225720ABAF2768E6352F21B906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 765KB
SHA256 68871a8b7ed06e6765989ee8e476535b4aa1733bfeab37898edf1b510b21d160
MD5 9fac1225bf3ca63634cce0a7812a9139
SHA1 8f7f17626046b39f37814c2ebedb002c5af255e0
SHA512 e14324bc526fc68427ddb197d34e60c363257a61e3ec6818722cb174e9d2add408c943a9e0afe5f59970e063061ba293f623852d100553bd247ad893408d447d
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGjo:KIifqFu1//IifqFuyDA54GX79lSzQGjo
TLSH
T137F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 765KB
SHA256 ea401c6b3d38364bf514afceee297b4cb9e4ac36367c644fa78028b4563de87b
MD5 e94422f172bfa930a65d0881d8212178
SHA1 86b3b3d56bae50305fd8da21025ef3b82d2cd2c0
SHA512 5e4d1b397217330476cdeef56e32a78fada04312805c32a5f51eec2d16908f35a7bf3e9acf1d2f12ef331b7d7530e9eb24e4afb70f3712a44f770e4d80e19300
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGXu:KIifqFu1//IifqFuyDA54GX79lSzQGXu
TLSH
T1E4F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 903KB
SHA256 02cadf993b498760ebe79dc1a2433c959d131382ccb9e769592c77296a510dbe
MD5 db1381e0271c17b24812454acc582d6a
SHA1 61cd1af143e3e75e6c3a7ce5f12785fec49b979d
SHA512 563f01428f9929b35f18551b31f4782b0e12511eaf8dcbeb00efadf364f7ff4cb5492a545faa5bca5a28d2ed1ddad385102cda572ab9f70601d9e434fd83e7a2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGdzy8:WqFgqFUH8T
TLSH
T1C5157D07F6A214FCD517813089E65372EB71FC225720ABAF2368E6352F21B906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 765KB
SHA256 6d870cc2cffc4cac93162fec93310abcc3005a8ca9e52b24320086c1e6aefe2f
MD5 feb16cd25824587a5e2762d9728ba480
SHA1 ee6baa5a22fb6337e19e4ff8d2062f74fbb2a809
SHA512 35aa3550cb681aa1d1709abe9296b5173b968efa03c902b91c3d35c475dc6208545732f8a347047811cff6c181f9e341dd773b404f4225c2a3aec187fad7a4a4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGl9:KIifqFu1//IifqFuyDA54GX79lSzQGl9
TLSH
T1C8F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 765KB
SHA256 682f1138a52ba3be3f274a27ea95a1e1b450235aefb591def6803c3607a58a64
MD5 3aa7a8de79e6f52713c3f89b26e445ed
SHA1 6a4af2f3bbb2d7bfa7e4adc42d96f52c4c67b602
SHA512 da55b11d22164d473fe080a92826d5e5b5788e72a10cb77e0beaf8d188de133fe305ab04a4a799333d5a49a772ea42aed09123bdf9302bc49b85c1e9ca482a44
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGBc:KIifqFu1//IifqFuyDA54GX79lSzQGBc
TLSH
T16DF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 765KB
SHA256 a2fa6ec13a9090b2a3ac03139ea289d931e2a76b8a724443e2fe695c8a5b9640
MD5 f829abf7b726a0bafc1dcf0366f4e9db
SHA1 d7e7e32762689830a1318f0b0c6192849c7fbcec
SHA512 7628ec3afed29c0a5f16c91761cfa62f6cd7f5a148889b5299c888e04d624c014bb82a003f6ee875826d5d5c926d708e0ee2814c0e5763b3b3f20ab4682dda51
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGqp:KIifqFu1//IifqFuyDA54GX79lSzQGqp
TLSH
T1DAF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 765KB
SHA256 b3369528e96961bc8ce7f3a753aeba77e5b5c46b40d98c78b5cbdf3ea6fbc310
MD5 a1eca29d8678a038a564fa9d2072387d
SHA1 91252fa0f9126aa0297c02cde459bd2b3d3b6c94
SHA512 d05fa073522174c729681a21b93e0933ea948d3757e5b35747356dadbb8e4464d7c6d8224b6131b6d05851d52bdeb0c59ae4403279c0f4170f9188a049301b34
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGN0a:KIifqFu1//IifqFuyDA54GX79lSzQGNN
TLSH
T1B9F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 765KB
SHA256 22c8bee816985dbf542500a55eebfa34213a3000c1c3cb537703689a738a80f1
MD5 8e3fb6f82c33f02b91bdfa3b20fe1c3a
SHA1 eb7218f32d3d89c0e1a45c0b218509fda3b2fe56
SHA512 44a5285546466215b1baf4d992379561b682ea1c64526979ead75d8f14053cbf527f4d834892c82208bec019c38b59928a1290b8bd207363174acf268791665c
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG/F:KIifqFu1//IifqFuyDA54GX79lSzQG/F
TLSH
T1DFF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 765KB
SHA256 09994cc85cd6daf38620fa51560584074c530042103a591507186862693e43c3
MD5 e969eccf5e564a87670401b25babf007
SHA1 c3dd6b6a53473ec8ec9555c88609e6ba0d397ba5
SHA512 87da5739131ed78b8b9b70b3822a7212383e6519b7cddccb6dc56f05bcd801993b3c0dfaca00443b9816d063d5b9d360abe1a7318e01eb18b2e6b9ebf202e2ff
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGgC:KIifqFu1//IifqFuyDA54GX79lSzQGgC
TLSH
T1BEF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 765KB
SHA256 6bc151ef3a7973b493632a5135a4155bea47a05e0e100a08c5e9f315c152c258
MD5 12ff27ae1c87469bfc9655ce3217d590
SHA1 a8a34adf69559728691f713aa612dad721e7084b
SHA512 c801735665200dc8991eb99d4989f027e64e3a9f26575c1635152bf00b55086bce2aff57ec48adcd7a3e4d0b1be78c4fff58bd5fa594771bdb5797ec0a1fdcc4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGzw:KIifqFu1//IifqFuyDA54GX79lSzQGzw
TLSH
T151F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 765KB
SHA256 179f9d6b2cf9040a163afe6ca9447dd8da9fdb4c7291c33cefcfe4854f1eb2fd
MD5 f64dd84cdb11516dffa7539d68b9177e
SHA1 1fd057ed9675c95a02658bb261ef953999025dae
SHA512 08e51e194650cfc5d1257939c916e9727ce2db1f106e3e1f4cc3e3ca96c7a409f8bf83f1b86302a890169622fc3a298f26f2609f519f8f16ecb433ba57b4ebd9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG6T:KIifqFu1//IifqFuyDA54GX79lSzQG6T
TLSH
T10FF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 765KB
SHA256 90f86ca35ed3b34e770b8c14ed429fb918dd5403a774fd39cefacfd9b3ee4bcd
MD5 87a25eabd2f4398ad5bed5fb4799ec10
SHA1 63bfbef83aa4b639b8c587aa37278b325594c63b
SHA512 a43b90a2b2129676b472019c6c4f9f094b4df873399b7aadd80979da0d737571f400ae9681fdc9bc5678443f9d168c3743f56db8e3dc9f6a0a320a96e56e7bb9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGau:KIifqFu1//IifqFuyDA54GX79lSzQGau
TLSH
T1D1F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 765KB
SHA256 d1a4e572ba8fe3e9d4524a16845849a0602f6c55b2e2e6ab50feb2af97cb3281
MD5 8eb37859b61e272de8e37b00dd5a3ea8
SHA1 c6bc840a257ad5a25a851b7d98dd5a422e58ebbd
SHA512 c86e752289451e770b6f52a68e1b575a4a34070262a9e874afa708e1d151538e0e32695919315dd52d738de41171a0642e26ae7ffddf0001e66e34743565cb66
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGkb:KIifqFu1//IifqFuyDA54GX79lSzQGkb
TLSH
T15AF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 765KB
SHA256 33204a8c697802d73eeb27bff72c88abca21038076f749854139e343f9070ad0
MD5 c36d7ca6f4c94965047d4fb338b39f61
SHA1 a272d4006601ccab34c759827108555847ae4034
SHA512 867618f688b775df3e3428dcd6cfff455bbaa835746698afbd3b8f0776a1ec2f8e546e6dc0434bd97379ec87232d9c2bd5670ebffdea34a80fdd3047fd338dd0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGqf:KIifqFu1//IifqFuyDA54GX79lSzQGqf
TLSH
T1A0F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 765KB
SHA256 d8e80ba44089e6426fe7f2743c98d278d0d80e67489b205907c56ddeee2f37cd
MD5 e3695380732ba6aa8270704396a9f54e
SHA1 fe3169b711c636819cbc3f4cafb0538fee1f17a4
SHA512 2cf7f62241001e8a85c91114b6a91c57160d9034b566ab4c8b304f5f154191f34789289e2045df42b9f61a72e016943b47ebf80f6a7455c95cf9ad6b9006479c
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG3K:KIifqFu1//IifqFuyDA54GX79lSzQG3K
TLSH
T1ACF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 765KB
SHA256 a1fc591e28acdc25776545c00be11f7c4fff049e7657806923958371e49d6d88
MD5 abd72cca9c538a5993c5ab1b0d5a617c
SHA1 cf2e7bdb5f294fae222db478f2ae76e2f0fbd2a2
SHA512 624bcc0d0aa551163c4a10b181a79566f35249643450d0e4357ae6a929f3e5d87bcb9d4a8aa41a7262ec77490c5f301dab7d2c28769100555170c183380ce5a9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGAk:KIifqFu1//IifqFuyDA54GX79lSzQGAk
TLSH
T159F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 765KB
SHA256 d43e02da2a6ef8e1d4d2e7e112bcc7242e117dd033f6843612e0f4c7be51487c
MD5 a81ae5373e59a30b401a824d93735ad7
SHA1 393e35aba20ba37cea9d0fdf5639b85a4fa3c03b
SHA512 7a33601c53a4d87e77f4e07f8b2c3290062688a516a0ad818d4d0c28b164089582ac78beb60dc716353842491d184009a4e5530dc9bfc646fb1de5506dd4244f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGx0:KIifqFu1//IifqFuyDA54GX79lSzQGx0
TLSH
T1A3F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 765KB
SHA256 c41d6ab00cf68c602423abf73c95239932ef49551d865c75aafa7ff3010f395c
MD5 e868b8f2e2aa334dcff2f89a5985d35e
SHA1 00f1cd250eaa4d3388d101dc9f40ec83c9facae0
SHA512 4b16e4d9a00e3793ee8080774047b9d93c5f066741c395ba9829eb429c11457be80f9673761463911c7384a25800ab2b69f8eea9b7e8c72b4c93205f213972a1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGk70:KIifqFu1//IifqFuyDA54GX79lSzQGkg
TLSH
T1CCF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 765KB
SHA256 aa433c28134e33e00450b935c66e7e579360065f21c4e90c69e43cd229bf4d09
MD5 fa31923c36a0d44225467553fdf31c40
SHA1 f97a576adee7a586030701e99e36f3c3ca58db25
SHA512 99981d6f649ae18bb7b69f33bd26b05384153abf57f90cca6a0e756389035d4d69ed575f5d5ce7ab1147c4f04031abb47ac12d0c11e7f7cf03bfc8204ca9f46c
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGBr:KIifqFu1//IifqFuyDA54GX79lSzQGBr
TLSH
T138F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 765KB
SHA256 706e53f01add82dc56a28510220043ee131a4a4197838094c9d3aa15362ffbda
MD5 c0e78e7fda75144977f15498aad398b5
SHA1 9dbd581f3399536997f0682d0583f51148e68881
SHA512 e14c8a561d1e1f41c5508a751feddd4f8ed9431dd9c2f132d54948f90d64f2a4317cfad04c21ceade32f174abd6fcf7c1a5f1fa554be0361bb7cefaf3259c05f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGDn:KIifqFu1//IifqFuyDA54GX79lSzQGDn
TLSH
T12FF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 765KB
SHA256 6b8481c264789ce36858cd327321c7e2062902aa49c24cd0c6073ab6ddcc270e
MD5 5f018b5b3f2a7f6c7248d231c0b884dc
SHA1 ddef4cd0ca5f5ca31f9a8eaee9166c66ca12a26f
SHA512 dec59a2b0e0d4f51d502b79a6ab12a2bc678490bba46e3815867f91996641177dfbcf79960b2fc6c6de5361f16da66878dc53719c08b4411c6631f70076a9383
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGfx:KIifqFu1//IifqFuyDA54GX79lSzQGfx
TLSH
T14DF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 765KB
SHA256 a6b901643be3ef7c5ff5d0ef7924ce3103d15faf68c5a1930eedac166b78a4eb
MD5 f7d0499b24aecf70557ede9a852fcc97
SHA1 2d3590176af4943a6e1744aa7b6a493c6c565ce5
SHA512 e36ecc7819e1c9649f12eca6ca3e84ebcbaffb1a1cd9b246aa7c570b0d41665fd90042980e927c2fc5b54fe852dce5699e58b8a433c72130e25c73d6b4507733
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGFA:KIifqFu1//IifqFuyDA54GX79lSzQGFA
TLSH
T126F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 765KB
SHA256 9e9e563642992a9a5366d43f09b37006d8214eab57a1d612516c0c182886519d
MD5 52a8776125d27ec6240193ab814ca4eb
SHA1 ec56cdcac358259d872dbc3fc7650d6f3519ccfa
SHA512 58f89e6d105dc4fd0fd4fdd8da5621e2733e413ddb1ed7617d80af98cd3398db5f894be23fd11370fc8d831cc2a988da8382422a5abd1c933920b8416b7a28a9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG+9Q:KIifqFu1//IifqFuyDA54GX79lSzQG+C
TLSH
T15FF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 765KB
SHA256 667a3aec90909fb3e2f45985b61233ce2c0bf2468249f66104acf3d9e6734e21
MD5 835390f5f205e1e8793575869c4da8e4
SHA1 e0d3361c8ed5ed2b5ca321aed41d2374ae1f35e3
SHA512 1f1e0d06733632729c3e02450070f7a3434b33dff3fd291ea3550366bf9c4ace9e148d4daa75c165e60297c06219f1af182ff526c5ce977bd25651cf5a3bab16
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGr4:KIifqFu1//IifqFuyDA54GX79lSzQGr4
TLSH
T1F0F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 765KB
SHA256 35a73a3bb9e340a270e1854fc89d2c302319ffe35e80eed7c5433f396a80f957
MD5 ba8339e3518dce4f75b225b93dec1cc5
SHA1 2d06282b4d35c206d303432852bea56cd57cbf1e
SHA512 54a4169ee8ca11c2de6e3197647bbdaa4bc5eb40a1be832a7726845d3781b63520c1cdf37efee6cae1521086259e7412a0ec611b508badd7d09664f1712b6b13
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGiu:KIifqFu1//IifqFuyDA54GX79lSzQGiu
TLSH
T145F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 765KB
SHA256 6eccdbbe9670e7e6703142f451087dc544968b3fedd986fc7b8e717711ee80bd
MD5 4c29bf987080ad04d9c9e45d10b7df5f
SHA1 26f172a807faf6c32d2f57619b694ae3228bfd0b
SHA512 32441d5a12196cba1f81106d70d52688dde310721d104f7c6c7f5195d5c22d38498b80cb5e49223d575bc40f5c06c416ce268b135d610532228e1f7c464a28ac
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGzj:KIifqFu1//IifqFuyDA54GX79lSzQGzj
TLSH
T15BF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 765KB
SHA256 1ec3b4c9edf17e711c16c5913708b690b261bffbc07abc0362068308bdccefef
MD5 e51bb09fc41d69cb06949bfa1acb2545
SHA1 5015f8d04b96454c6765f6bcc353893751de008d
SHA512 e453235d054530e23ff1fddef808eee5d6ad87af4225ae71f30d97cadfd97a03540827a0663d3954cbe0aa8284d5d25e42de81a0b03bc9a9f5f52dee51d1b536
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG+g:KIifqFu1//IifqFuyDA54GX79lSzQG+g
TLSH
T13EF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 765KB
SHA256 1457a855a5450722a81fc0d49f1861d8bb43a4a144571f47aefb8ad5c4a60f57
MD5 0e46e726d8f1362026ebfa452a8e06c1
SHA1 f32757d91342f11b5824b68a6cb7fb585e50653f
SHA512 48ba63b9bf4b24c40efae7a7a7b87d709c1b9914aad648c83374144112db02f8ca172e90024252aa4c3762e1c5d1580033bd071ad51ad7a74c0530b39560cdcc
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGxI:KIifqFu1//IifqFuyDA54GX79lSzQGxI
TLSH
T1D4F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 765KB
SHA256 482724897ab67018e8886b81e5c5f3747e8a375f1292847a5eef76ecc45a84e0
MD5 171e73083a22f442db69bb6c5a528973
SHA1 86b3c7c5e637e1839d67e49229061bc379216e8b
SHA512 e73d8cbf11a843826e263fa414ce678c2b4f2e64e4d56a706fb7c1fa21c8fe6028f4b2b003aa50e5a31fa5f8eb70762b67da985f812fcfe785d5bf34665739ef
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGzo:KIifqFu1//IifqFuyDA54GX79lSzQGzo
TLSH
T178F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 765KB
SHA256 c589ed316f33b48f620465821845b35848d5ef3dca2cca260c9dae870fbee559
MD5 d2eeed1ee5914a94aced8329c8a785e6
SHA1 36990ae11c6f00832c2a353f29733d6e426e058f
SHA512 38eb89bbc9c10936bc20de1d2b246842e277ea4bd0edf94796743d2830d4894c837696a7860d42d5649bc6d66a86d0cafa6afaa58401e0fa1dff076bee8ed0d5
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG4+:KIifqFu1//IifqFuyDA54GX79lSzQG4+
TLSH
T15DF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 765KB
SHA256 21b1bec34820ddbcc5924118ee1045a3930ea20fd97942d51a98dc6eee15f3d0
MD5 93a3040604108ab2e33baf28884c5bc0
SHA1 bf3a97a2c044aa7a8f4b07278032e064bd9b4bb1
SHA512 f6768ef1cee42e7f2091d7990a6b2d3d393b45fbca54e686c1814a15251aca1ec3e1132b00263f882a650a3dd20634a2f60bc73ffe1cd8c1e9c1d9bb71567ff6
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGQQ:KIifqFu1//IifqFuyDA54GX79lSzQGQQ
TLSH
T15AF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 765KB
SHA256 874f2b16c0abdd4158f91fa78cb26e1ad8ba54ec9b281c6251fe663753a1eca3
MD5 bd0389595dfe10b26777da58bb298dd0
SHA1 ab2e3d0e211d57c5512d630d95e08db042e2bfbc
SHA512 28f62f962d79a66a6139431dbeed4648b8528734dbf4f99e7c4854bf943ef35e647fa146c5b234d2cbfdb90587d00b68567b12157e2144fdc41f0ca7b55baa67
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG5X:KIifqFu1//IifqFuyDA54GX79lSzQG5X
TLSH
T1C8F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 962KB
SHA256 b485735002d0b2968683543ed195cee18b34af56172ad8bfdb9f2e20e49cee9b
MD5 41b62fb79362d12580018430a8004e23
SHA1 0956a74d84aabaed6ecac2c14ede1d382881c671
SHA512 4f0655600ee735a5336083a7f3c045632526aef8c0d000f800fc8e17b4f82b8e330901f3be48e4a9f44ee21110769c1f8677e01b66a28c9ee0ea94cce174b239
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGOjCXF7IwZ:WqFgqFUHpC17IwZ
TLSH
T1D2259F17E6A204FDC567817089E69372EA71FC215320A7EF1398E2212F21FD06F7A759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 765KB
SHA256 148af762c00a44a65c4aa7c9ba41a60c7dac86adfcbc49cf316962562f0f1db4
MD5 38d400fa312abba24514978078e873fe
SHA1 1f9c0b53d66e8b83e6cb6478da77925d90772951
SHA512 38b9cb8ef8fc92554102ab18dc4b2d38ce57b30979599e2f2e713308f5c69b547ed86a662e5c44db03a9419bc9541e1f20f0770c078f2ad5f4c55b0233be79ad
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGTL:KIifqFu1//IifqFuyDA54GX79lSzQGTL
TLSH
T1B7F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 765KB
SHA256 6f065aeada41d437945ed8fe442d2ff3b02da921a70d43a24aeb3061bb4478d2
MD5 a8c2a3781859200688e14488c2e98636
SHA1 3bf550c9fdb9e1f3d6b4f7df7cc50fe4b9715132
SHA512 487cafbc6103700e2cdf7a5c7ff8853ea4fbb6ff182b8e2194709ff35ddbc5a057a82bff75425d72526910f1b997a727e53f16e4bce80953d944af7684d1d8ee
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQG5FC:KIifqFu1//IifqFuyDA54GX79lSzQG5M
TLSH
T181F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 765KB
SHA256 cbd43251ea0f4c20eda375b604afec8b55b3edb62cf56e282d7ba36de1691d61
MD5 679299863c2fe609af74c4a0fdb07296
SHA1 748f45b11935b936b0986b7a3f34e9dc24f54fba
SHA512 e038d3fb00c192b52d760577b5050056984bf25968a66c58ba5d3cbea4e32a73d23551cbc7d67e8eff06a4af47748108d5b3e487e3b26bb1c0ff8eed3ce95a59
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGCh:KIifqFu1//IifqFuyDA54GX79lSzQGCh
TLSH
T1FAF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3280-1556-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5060-1665-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads