a3ded2327430f9b46dc8e275c67855f23942eaf4298de2c4623d80d5e2991104

Analysis

max time kernel
97s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 14:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
Size 937KB
Sample260801-rkr2hsbf93
SHA256 a3ded2327430f9b46dc8e275c67855f23942eaf4298de2c4623d80d5e2991104
MD5 237e280ed458be8935a258bfb0fb3a3d
SHA1 cb602c55d4c5b90da285f5109bbef5ac8d6fce32
SHA512 659b5668216b3270119ed18826fc643a8c7271607eae774b69325c1ce63473e8110f77c1be7b0e28e128040fa1a488bf84ccbdf4bea9ab2659b0cf7e827bc529
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa:J/sCv7iUIxc3EEg+QLb8NVPhPYa
TLSH
T1E915391366948F71D56F053059A942619A3BFC295F2087DF16B8AF287E307F07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/4088-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c629-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-232.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-269.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-462.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-584.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-712.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-780.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-817.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-848.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1035.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1066.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1115.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1312.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4088-1983-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4572-1984-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000000013b-2103.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4572	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4088	2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
4572	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_237e280ed458be8935a258bfb0fb3a3d_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_lu.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4088

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 937KB
SHA256 a3ded2327430f9b46dc8e275c67855f23942eaf4298de2c4623d80d5e2991104
MD5 237e280ed458be8935a258bfb0fb3a3d
SHA1 cb602c55d4c5b90da285f5109bbef5ac8d6fce32
SHA512 659b5668216b3270119ed18826fc643a8c7271607eae774b69325c1ce63473e8110f77c1be7b0e28e128040fa1a488bf84ccbdf4bea9ab2659b0cf7e827bc529
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa:J/sCv7iUIxc3EEg+QLb8NVPhPYa
TLSH
T1E915391366948F71D56F053059A942619A3BFC295F2087DF16B8AF287E307F07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 aa484f92bf325068d9feca236e35448778df0c03d083f528373ecf223bdc1bda
MD5 a69c9be67b38282872f1e3c8509941fd
SHA1 0519f97366e05f8fce36e729a9826622cf2968e3
SHA512 4a660bac5e3d93f186823b931bde62e22c5b307950295a0c79ad96ad5feff4f96f4cf2cf59773cc98142c6611a760dabd0eceada96d09999d0e33a5fd036a36f
SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPYaP0Le5ji0hmxNrM:NG3n+C8NVtPji0Aj
TLSH
T11C654B17B6648B71D07B8074C5E59656EA33BC150F3087CB12A9AF283E327E1A939737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 952KB
SHA256 7867ef5fa814702fc1a16834281cc87731fb9b56e06e0548cbf1f0e1f92e85eb
MD5 dc016c72b57096e8080a37449d4bd7e7
SHA1 ac3823b20cc5149b0c2d6e26852d6232006eed43
SHA512 12ee54406335e8312e4b3ddf53cd32313ff254cab24c6cf65229412e0eb16f2f1b747658a3fc3f3cb7c098543ac9d30f38967293f988df226218a0cda8efdc70
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaRa:J/sCv7iUIxc3EEg+QLb8NVPhPYaRa
TLSH
T1D325391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 961KB
SHA256 10bdfe6b0717ade9140aed39a4753bc826143dcc22dbcf182661b43c04ff5f76
MD5 a43fcbc03b50659f39897d9d26faa528
SHA1 d66aede0b4aba9ae553e4e8a82ffb40e6e853c80
SHA512 d5bbe4cae42929359af88b248339607e69737a0a46d626575c7011177b6f3e8adc611b1d7341e911ea90f2d0a205aa247c25db13d6d209c0aebc4e02fa6df575
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYao6:J/sCv7iUIxc3EEg+QLb8NVPhPYao6
TLSH
T1B625391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 961KB
SHA256 84541850e926b20eba62a6153817c8b6e7f1524eb88ebbfa564bb701bb38d02f
MD5 9b64f3e09ea4814253fb59f43659449f
SHA1 eb4e9d17b20f2d89f996af2ea4bdd83828067e51
SHA512 afa9aee3b06307b4249beed78eecacd0cd8ac90272a46f37da0a9fa6139d9e7e618d4d4923c992b8482087f83afb166172b9a9b6b2b81b4d746e51f54e344bed
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa8o:J/sCv7iUIxc3EEg+QLb8NVPhPYa8o
TLSH
T17725391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 961KB
SHA256 25669c5f5623c5d0673ee07174ce597c28452f61a55d051d80bec98e63766e15
MD5 f602f581d38fa96f11f4a71356ba44a1
SHA1 aeee8e1c7c07c54c86d327dc9631a296e3181dbb
SHA512 d568da4a472f39a97ee016190fc921af769758d6bd857399d932389403ab71b61e3a7de405fb0e006262d25529cdf61413cde8791b93c0ed3a200cd049b36771
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYacu:J/sCv7iUIxc3EEg+QLb8NVPhPYacu
TLSH
T10125391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 961KB
SHA256 bbe23f6f94c6866d37fafe0450645cf211605864e402b5f34042cba3970ce886
MD5 d38a77bee24ef9c7f8eec91d1f3e84fc
SHA1 be6d9b301e0d9d8218950b3bb2a42edd495ad2e3
SHA512 c5440914efd732631f24d2e01519513feecc3e240499a7461dbde9d19632ffd61a267e76db5a909a85bd6acfe61de52b483663acdfd265b2b5da50ebc69afdb9
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYag9:J/sCv7iUIxc3EEg+QLb8NVPhPYag9
TLSH
T1E925391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 961KB
SHA256 2d8399523b15d06faae198d91e93e1afd5351ed0615b1fdf2f35c69fe76b4123
MD5 e101d8dada98e222fc2f74357202098c
SHA1 e044dc65868c8c92dc9bc7ccc4a014f090872bd5
SHA512 6206c4969b4fcb747fe3733c4e03cd7427c37abb2934ca3f3fac75fb3b3d11986a18db7adb2b0dd2aac70f7aa9567d0f9207f83bba15098e5809e2f9b7315e9a
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaoc:J/sCv7iUIxc3EEg+QLb8NVPhPYaoc
TLSH
T1CB253A1366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 961KB
SHA256 908c1c30ee5e8cdd0e4f8a8adb2c8bdc8f2d9c17b14d28f940b1985989e28bfa
MD5 d559203f66259fdf3a00996a22a5251b
SHA1 1c0785fb6da9db0e039310939bb85012e1508290
SHA512 716479eed0541cd952763b347b6e40366eca68352225c8392236fc4b872ce65a5a94dbe96f540a105e603daf0b0bdb241eae704ae006f1be3d9f416d18937e9c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaBp:J/sCv7iUIxc3EEg+QLb8NVPhPYaBp
TLSH
T10825391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 961KB
SHA256 05f680e7729d1b95b91bb589ed0f3f2464c252b83eee7ccd33eb9842525c222c
MD5 6ce876562b3ecfb4f98f01f068520cf2
SHA1 7f410e8781df1d4e73f3f0265a1755f6edd610db
SHA512 b2e24521fa837b8403ae6861bae7c514e1daab0c0a49ebc43c16fb5f0e2242fb883e5630a74f4ed9c723ba8a15978c1c57e1fe58d7c67c5598f06feea8aaa942
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaW0a:J/sCv7iUIxc3EEg+QLb8NVPhPYaWN
TLSH
T15625391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 961KB
SHA256 8a2f935097bec3d8c6123a96640d683fd5f45e3a8c945e647ef2bd2b330677b5
MD5 dcee44f7f15b37dc62040b81f7f60cac
SHA1 b2e4b717ff979abff2d656a3414700cf5eeeb718
SHA512 5160f22109490f913c47f33b48f71c91c800c1b718d1cb1645b50e4e5961f8f1a5ba4aa0ef5b2dbefdd6dccc914d2b49be810b65d15f069db1181f37dd7a354d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaaF:J/sCv7iUIxc3EEg+QLb8NVPhPYaaF
TLSH
T1D825391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 961KB
SHA256 277b586579ef007054b97c63a48e52d41c21ad5d9432c07590d5b439ea029ccf
MD5 eb4e3bfc7f0149004ed36955687d654d
SHA1 c6d2c791c475182b03473e9c446a3b97d7c0522f
SHA512 a6dc311c773220385cb9df26d57c5bafb74939d06ff46c99aa46ad6ad422491771b5415d24408c5fba04c25a72a89dcef4be1e3fd0316723a913665c515d6a7f
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYavC:J/sCv7iUIxc3EEg+QLb8NVPhPYavC
TLSH
T13225391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 961KB
SHA256 c0c46aedf9d94d9f544b369d3a85f81d93d963de897d3a8cec28dd63fb9ddab1
MD5 b5ce492fd08bfc8f5f49fb58ca3a9699
SHA1 84b93a088a5c22d6bd39d792a4ce8aa8a68ae534
SHA512 21b33d71fceefd97d0cf6c44e4bc5cca93cb24d88fa8012392d78c9c86df6d1713f191a2ea109bd50420158838b53a12bbedffdc726d4493810c6c896748ef0a
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaQw:J/sCv7iUIxc3EEg+QLb8NVPhPYaQw
TLSH
T10225391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 961KB
SHA256 da25f3212c2d3e379cf1205841829497532f649119f289257bea296b91afab07
MD5 ef53e7d311a595f811db1d4914d4d64d
SHA1 ea364afb5bf94524e386b34b6a0306c51a94f686
SHA512 d7a38b1415800cb221874f84764ba6183a651582391e0ab95af36eb76e0abb3e952823b1cf7355bc33e6656fe004712d078627562b5353830c98a7f908df2a4e
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYavT:J/sCv7iUIxc3EEg+QLb8NVPhPYavT
TLSH
T1A225391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 961KB
SHA256 e5ef3ed1e15e50f44a1089f3602ab1a095a562316f2bde3391cf8b7759c8a5cc
MD5 1a9528058dda45f99d7053d1027789d9
SHA1 388a5e974a6fd67778ffa816bd1d848f0903892c
SHA512 800bdbce5f625d7e36143237d07825eb34f5b96cc0602c4beaa4b30ab0c584c201cb5fd5988f9a9898b810878e51959a04cd5b9bfd2a65ab6757e43f3282cfa4
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYapu:J/sCv7iUIxc3EEg+QLb8NVPhPYapu
TLSH
T1B125391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 961KB
SHA256 f41eb19b45ba0b0684a0cf1266cb423911aca3ca33aca5a3ad1ced03925e69ec
MD5 cc98bd151fb19917ed28612e4b2f64ff
SHA1 4644795a4ae377117cc4e253250d6134486a30ac
SHA512 2b2227ba7c8afa82c0423b14a3524000c10abeef31f1216df0df08539376167f74af0e95a57123886843ddf6ed6b93d0ef2162e2d5f2e9b15d1830134ef88b48
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYahb:J/sCv7iUIxc3EEg+QLb8NVPhPYahb
TLSH
T19C25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 961KB
SHA256 1f41f5fbc6c59e424dbb1a52f7d25e84a7fee3e5edab7a2699d6d3058b09dd94
MD5 68c60574aed997545e3d4a73e1972096
SHA1 0eb6b3e15db87bbe3058f6143ff9d0d86c589fa6
SHA512 01ecff048e0b3a1453c50e9199405c74938d56fc1dfaa79aaea42c0e3abf5b7f8238fcca8946cbc1931029dca9fa6970aa3df7b3add63972ee743707b9f1b5ef
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYapf:J/sCv7iUIxc3EEg+QLb8NVPhPYapf
TLSH
T1CE25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 961KB
SHA256 2b4adb9c5ac5e51718949b9e262b8d79567c3b45f6fcaa4cb57143cea7378a8f
MD5 2b0eea4fdeb4f81c85e30d47cd57b2d0
SHA1 c4ecfea0810b6c69351b341fc1ae17d043a0b506
SHA512 97eb487a211e56ad698b6f0ffb34cf8cd2a195825d3af4aff61f2536d93659a1f8b8095b7b1606ddfb019e97113f4e4b7e3183663627a3ea5c3d08932e63dda9
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaSK:J/sCv7iUIxc3EEg+QLb8NVPhPYaSK
TLSH
T13225391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 961KB
SHA256 8268f9385c8bbf23757ba5076ffa09164650cacef6860be096f5ad150e09dc31
MD5 387449255130f2ba0ca8c845a76f74ac
SHA1 d7c251934c517ed47101d07b8a5ad4761a0d0597
SHA512 755830f09b79d31d5e51c2c0ee67d4f3c65d054679a2ca7ed25ff73aac64bb6b72be39361fac5f36a0d730811da8c8ad61233cbefc745c14bfeb9853d91c6e0d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa3k:J/sCv7iUIxc3EEg+QLb8NVPhPYa3k
TLSH
T15D25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 961KB
SHA256 b11ccd700666fcbef3c4fe73bcdd573b24d1bd0be92849602998ddf258eb066b
MD5 7b9a7159301b701812144c4d973b1c98
SHA1 ed1bfca6eb693fa472102dc728e68d095fcfe005
SHA512 e400c41a3d5896f7723d82d0af8764c1dc779ecc92ba48b4b1f4c2228211be94f59d71e1423307b56570e43d8dd264a37b734954f95e1f6a8f69440c08914447
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaA0:J/sCv7iUIxc3EEg+QLb8NVPhPYaA0
TLSH
T1F825391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 961KB
SHA256 927c59c7708b29ca1fd318669c0bf199c8b64325b36b95783e20608091fe8a05
MD5 0ebd479f1c4cde7578ffefc31b0cb513
SHA1 a0c5d0820426a4488dc83effa4f61df5410292c6
SHA512 6a529fb2d841a19e01266b0322d434e06bf31eba236b9e7c483b12d303e9bf1f01a0b335d51184a4eb20c88e6a0a778c9851bdb25394a9cffc9b89ddbc89d8e0
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYab70:J/sCv7iUIxc3EEg+QLb8NVPhPYabg
TLSH
T1D925391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 961KB
SHA256 3481270ec7c9cad125c5d0134805a89aca53d167dd3e5d520dfa642d27a8a118
MD5 4a836855fa64528b29300c95d42d8ed6
SHA1 d0ae46a8e4c766471e8c948e452a829df36d4c37
SHA512 5e8c59b2608db1e7c58c3a0ea4cd7728c74a0423b8288738c0288fb11814078b85dcc90a97f40c190ce3f39974a02c50baa16673eaaaa4b1386ce68359990805
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaWr:J/sCv7iUIxc3EEg+QLb8NVPhPYaWr
TLSH
T1D425391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 961KB
SHA256 55ddc8f32796d129bfdede383495bd848b296c20fc1744a2299dc01fc3cf2a61
MD5 8fac7d4bf99f240141131b93c66c5190
SHA1 6a2e6423be8d0aa07f4ccf44c01e53f82808c0b5
SHA512 5ae9eee0f047ee159f7a6c94f93e1f5198f07b4f8aac4a8843e6cd0fc47d51e3f2b30ce6c9aca80b30384d5bb0a50612bd4a2dd715827d7d16b1b7569fe42164
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa8n:J/sCv7iUIxc3EEg+QLb8NVPhPYa8n
TLSH
T10425391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 961KB
SHA256 bc1f38942fd4acc8578ab84a7e6bb0f0c7b7ec4daeaa5f7ac3b405565fd5df0a
MD5 3455acb6bbe87facbe3b4a9c2095be1c
SHA1 c801fd20f27aeb7f679b8ac402eafe567e986a6c
SHA512 447ac03f6c6109bdf39988695fbe5e76185efebc4585f9f8a91ad1728ad9ef22b6dc46e4b8b61299b1959834f59d7aebddb298ac8c168440f1be337c15f696c8
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa6x:J/sCv7iUIxc3EEg+QLb8NVPhPYa6x
TLSH
T10525391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 961KB
SHA256 0d93105ce9e815446544f07f00f31883deb5d82f29b879d7f9b2eaf5b11646fd
MD5 394e5d144bfec2085ed72be29e339888
SHA1 e1708e18d046b01b701a4f74c808c9e69d75558e
SHA512 891755fac893be9c81d4715c95167486533be57ea3d82ba9e33fef6dfa89defb0a1c0d00d628375fa2e36aa670b146a758250a5fcfc8e439672018d93a9bc981
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa8A:J/sCv7iUIxc3EEg+QLb8NVPhPYa8A
TLSH
T1C725391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 961KB
SHA256 a85d858985b63ec329db6263156184b700a51a026465c0c257498adf9a8883e7
MD5 53bd5206233cc58a1c0763acc2d15a92
SHA1 d04fc49d3fc9fe930141f540bf65c8de71f730f2
SHA512 79206527e81baae2543f118f404ccb7295cea145b51c07114b56b994d67cabc7799a341b1218bcb6191dff06d461c7fb1b9c860867e45a60dd0640699d0b0971
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYal9Q:J/sCv7iUIxc3EEg+QLb8NVPhPYal9Q
TLSH
T1B825391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 961KB
SHA256 1812958fbcc3579426782779b51f9b59a4433b0e51baa6cbe3e9d6eefceeb6bf
MD5 f8d4bcfd9a42d5e2c4a95fe903a84857
SHA1 49d35af0930f6cc11a5b456d2eac3500f2d2d99c
SHA512 c60d7212cc7b85142ccf705a21d503ec36310fe6c1c08ed0c610303ad93f2bbeb2c30cbed45cf1f710ea174f3d045ce6e66671e6b538955d73386ecfa4e845fb
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaQ4:J/sCv7iUIxc3EEg+QLb8NVPhPYaQ4
TLSH
T1C525391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 961KB
SHA256 c7c97ac0e5c3813c41e9fb2135861c2441ab548e87de9f3576ede431f0d4879d
MD5 224ae6b9d72f1c2bd9e3ea20a795e4fc
SHA1 9b492b0c2a6120b534da804443030cc002ca72a5
SHA512 736bef2d3a3215618e72d912723860717844f77c903d81efcb5c6f8b786c0702015268e16022613e0be0818b7a88ce82a4c0eb09f91d057dbb5aecd0cf64f1a3
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaTu:J/sCv7iUIxc3EEg+QLb8NVPhPYaTu
TLSH
T10A25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 961KB
SHA256 58212362d360761c9607519d172dc99a7b90004a135c1eb2be30b6aa96a1b775
MD5 9b1dd306da9e1a41d09f1f9fc3cf38da
SHA1 aea7adb40d40878a53a651767d9b62443e780553
SHA512 76d7f971968d67b8d0f2f83dbe9a7589c03bc71444bde14b9e551711906d46b76a76649491fd5c4e070b006205d07b2d8ea079d1c3a5e849034b6ea22daa38a6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaOj:J/sCv7iUIxc3EEg+QLb8NVPhPYaOj
TLSH
T1B825391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 961KB
SHA256 97f9faea0702ae7deb399ee3e4a7628f9a97586005b2a450c3ac40b39b924d19
MD5 4d4a1e5a767320c14ae8898dcbdb3da3
SHA1 f1a5ba8315bc6eb5b1e3e36f6959c7350bcb13b1
SHA512 b30bebc481a12f54f2c421d5d3f69a479243b4e1e9f0f9c2f0b6ac8d15deff5f611a58570c41e44b66b92641e86db2e9313477cb27dc65b6772d665ba10869e0
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa7g:J/sCv7iUIxc3EEg+QLb8NVPhPYa7g
TLSH
T10A25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 961KB
SHA256 b58c9e24385e6fbc7dcebf5ba4768a470e454fac5858ae3a9c28d931633d17a7
MD5 7bdc2c18dfc70b752c48615dc3d2d5f3
SHA1 7afd6352778830912a0571aa1d6f5913a7b1232c
SHA512 1e0c18124501d862afe6fa5d84b85df778ec9d29e15971eae104cfd0d82aced4a44da1ae8784e4120fbd6aa7c34980e95b15af4ceb6af368ef6d3c131d358b83
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYamI:J/sCv7iUIxc3EEg+QLb8NVPhPYamI
TLSH
T1CE25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 961KB
SHA256 25fc25b3b980827c97236b5541f9eb4f52bc5e66f2c98b8cae00f7cee4368c9f
MD5 f8b7691a673450d1ba0af02ed77450f5
SHA1 63b76972b3b30afd40c0fded23e2939e79925b6a
SHA512 8e82b23832d13989bef07e02d799e41e030b8aa5bba5f4f7cfbdde907253387ceaca422a726829629ccbbcf5c793de58a64efe9cec2ae36833f8383b573b5b9b
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaUo:J/sCv7iUIxc3EEg+QLb8NVPhPYaUo
TLSH
T15025391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 961KB
SHA256 611a3785689d30670876c8325ddf95f2b0e2eeb29ef098844230b195bf4dfacd
MD5 6d95121ca234eca5b1f21c030014d74a
SHA1 a1db47956d44cebaa30d301236b8321fa303535c
SHA512 41bc6c4771c2a5243e67cdecd8f54e847cbe59165a3e580f98b7eea90d4a4cb78be94b83d73dd042c20962cba655b9c49225fc90ce3a5156fe72fa38d3bb2856
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYa3+:J/sCv7iUIxc3EEg+QLb8NVPhPYa3+
TLSH
T13025391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 961KB
SHA256 bc6aa84275f3d6f2aaeaf2e9377f1397a851cda3da5e15eb2fd7d922087263e8
MD5 2afbbfc5400df3d86474aacc127e5285
SHA1 da06aecdd42348083fd96696a0dcd35bcafaac22
SHA512 7ee7e7ef2b1ebbf153d7e4ec7691486c185245de847db23e6fcf35fddaeb2fd81ba461c1cdcc3b76a50d598a95d628361f257231f65ab5c3ec156408e497a4b2
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaNQ:J/sCv7iUIxc3EEg+QLb8NVPhPYaNQ
TLSH
T1AE25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 961KB
SHA256 6237a1ecf3bfe1c0966c5691474d299dd31711ac3643c7b13b946c121a3f0c36
MD5 1d5f210a23ec241eb8d48cfe3f39192d
SHA1 1e38982505aae84a92a9fd2e46048f2a380bfb8d
SHA512 092b9d9d26bd0e35c015b8c7f3beb0ed4069dfee1c0d9cc286644557282d1fc8314f0e7ee088e9b71da1f3ff0cf03b653037165b59dde1568bd1e4d0b40fbd06
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaCX:J/sCv7iUIxc3EEg+QLb8NVPhPYaCX
TLSH
T10825391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 961KB
SHA256 c9d86c53d7be2fef3d16609aaa43a951c8d2501b031044db235980af93bd396c
MD5 8ca0a1d9e5beeeec3c72c6c0a2d6e5e4
SHA1 9bf9b816e6e73737223ecdb7e903fefeb77cee17
SHA512 2e123df3fe2d5b344d9a25338238965c1537bbcc4ad002dc29a2ca4744a0d9208964aea5f564030d48b845090c8a00d56901f837785aa92ecaa139fa6ab34717
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYakL:J/sCv7iUIxc3EEg+QLb8NVPhPYakL
TLSH
T1E925391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 961KB
SHA256 361c16a2567e580bd2568692b1a7a3db74f2a9546bdb29513371258e515fa7a3
MD5 75b4f465e145ef3f2a41d72bd847cc1b
SHA1 8268db7e9c5318639ffa0053b458a80e3d7aff45
SHA512 b7cf1d40addb04cbfbe583399a860e43d985e801c4347bfd14d9b0a7fcda5153fd3b578d1a98917b3edfd0e7c1720213f60612e4f581a3b82b18e380af9dea57
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaAFC:J/sCv7iUIxc3EEg+QLb8NVPhPYaAM
TLSH
T1BE25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 961KB
SHA256 4bc66a5d87227e1d6d69cb810a64cf91d3a9218d10c56e43efe29c6eafee279f
MD5 59a273735c331744836f543e9108df14
SHA1 aa997da72c21089121edd6cbda2cf4681685cf62
SHA512 606a244aa8d3e9fd7ec49816f457114cc7155b838c79f51c09d2b875ea71d42737f6792c76d1b53750ea56846ac037606d452600eca17d54575d5459b1dbc90d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYahh:J/sCv7iUIxc3EEg+QLb8NVPhPYahh
TLSH
T1AF25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe$

Path C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$
Size 1022KB
SHA256 65801e6d4493452d8ce36cba883015a05d815439f0fabcbdcef3e6c91f022726
MD5 09b763c716360542bc7fbd5868a67241
SHA1 8a43e90a5c9538e3dae2c0dc1a4562d1dc2bc27d
SHA512 4ac5c5d4ca5dfdd9b058a6072bafbfb848f790a0ea87c294cb8736aa93bf16f9582928297034e952ecdae203d29b37be81628fb5bdeca78316d6642486255ebe
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPYaTwsB5:J/sCv7iUIxc3EEg+QLb8NVPhPYaTx5
TLSH
T18025391367944F61E56F053059A842619A3BFC255F2087DF36ACAF293F317E06938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4088-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4088-1983-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4572-1984-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads