5a65f300cb27690e001480c254255f0729dac1daf850fcd689efafe38df4cb10

Analysis

max time kernel
99s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Size 946KB
Sample260801-s7cqsazcpg
SHA256 5a65f300cb27690e001480c254255f0729dac1daf850fcd689efafe38df4cb10
MD5 d320d007fc4303c1313d931e1397e747
SHA1 b95cb1bf23db0c02ef59c6294c226a8960551740
SHA512 ac0e4b2aed4259ac111b210621ea8f4110a15c1d615f8745251eed3b301a3d0c5198a2ee32005159bcbb0f995d12c83dd083ba09b77753be5db7ae0a42c2eb3c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlc:J/sCv7iUIxc3EEg+QLb8NVPhPlc
TLSH
T1E1253A1366948F71D56F053059A94261DA3BFC295F2087DF16ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5848-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b809-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016ca8-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-232.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a66-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-700.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-780.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-817.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-998.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1158.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1311.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5848-1973-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4820-1986-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4820	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5848	2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
4820	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_d320d007fc4303c1313d931e1397e747_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5848

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 5a65f300cb27690e001480c254255f0729dac1daf850fcd689efafe38df4cb10
MD5 d320d007fc4303c1313d931e1397e747
SHA1 b95cb1bf23db0c02ef59c6294c226a8960551740
SHA512 ac0e4b2aed4259ac111b210621ea8f4110a15c1d615f8745251eed3b301a3d0c5198a2ee32005159bcbb0f995d12c83dd083ba09b77753be5db7ae0a42c2eb3c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlc:J/sCv7iUIxc3EEg+QLb8NVPhPlc
TLSH
T1E1253A1366948F71D56F053059A94261DA3BFC295F2087DF16ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 cf366e779823cd35d2b62660048987e2ea3949438cb68f7291d9999e9d9f684a
MD5 46430aa1887184fce5bcbec6c30f5f64
SHA1 85d3599a86471a25cba85f54fdfa58f91447a26e
SHA512 3123f4257e1c102ac91a2654242eed73038efcfe4b0681edbfb789eded338356f69a78c2298a1fce6b2e1e77b75177e929c4503291bf1ad43dd5571186a578d4
SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPlk0Le5ji0hmxNrM:NG3n+C8NVoPji0Aj
TLSH
T18C655B17B6A48B71D07B8074C5E59656EA337C150F3087CB12A9AF283E327E1A939737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 961KB
SHA256 f7dda15694d9bb1672d119d80c729d84777df0f59a8b2795d1c3c23c1640f77d
MD5 94d8364f5d682a880e501e8c7a114544
SHA1 b9ed7df3a8055f19ce8ec54a0a709f3cb8c45af1
SHA512 3a9eeae046375e003ebc853c8af8207ebcc1cbcd6c49459d4cf43c254cd1d919faeb3a95873be5e40d63b1979dee4ab1303ad51b52c5f5bbc151ed156f1e8428
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlOa:J/sCv7iUIxc3EEg+QLb8NVPhPlOa
TLSH
T163253A1366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 1b312f8cede5d3e95415e679220c2bc1e28fadab030b2ee1dc4af4e843ff29fa
MD5 ab94300fb78964eba349d6e880ebc546
SHA1 397a412231f82e65ac9c1c0b49dbc954cf4a7091
SHA512 5c9d30dd6f47447198d2b07b1b5b2fe92fb6b57dc726fa69dd330bd0a8db6a23e7ee5d56e37cf3a5ca30b24c097fa41477cd3e7e0b3ea9c3c70bbd4f35ab08c4
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlv6:J/sCv7iUIxc3EEg+QLb8NVPhPlv6
TLSH
T10925391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 970KB
SHA256 6fec71ad1d20dbf2fb7dcf1203196b0100ddc53add81eeae3e8da445afeece84
MD5 d4391ef6bf2da20eea84bbf993ed6a8b
SHA1 91214390f950366b9eb45b005c038bc54f00a20e
SHA512 4900d082d9f78ed71cb3bb296248713fb4fffad71f7c5850144dda0a604c8ac9279bb391025b040b0a953e4ee506a257f7703e9b4b1c7370426ab46911d4c74c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlxN:J/sCv7iUIxc3EEg+QLb8NVPhPlxN
TLSH
T1A4253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 970KB
SHA256 b1e8b341d3078f93cfb06f294231821af6806241642bd2dd5d3729fa8e2f7946
MD5 8ef9602b6768a4f76750a9208e767f52
SHA1 4b339bf33a614fab73d89f6e2f9ba3364e266172
SHA512 1e0ffdcd437924fae505d1ae1052f43a890e898c9082bcb355757aeba26551f7260a4251b972ab9c1e5549887c270d7fb98e5b4b0b0013bf6355f351e470c477
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlnf:J/sCv7iUIxc3EEg+QLb8NVPhPlnf
TLSH
T1A325391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 2818274f8a2cd3d4568fa22123a8787f86e75099fe462c1ab70827901fa8844e
MD5 15352afd717404a857318da365bc86b3
SHA1 02c7309485219c7d5305a41532adbe6bef8e3cd6
SHA512 d1b52a3c0738dfc7b00b0928b2956d744bbe92912c0cc7d93785f7c3f4a535a1c304326decf13f9bbc57591fc157f6ecf3be432ca76a1da291233b06afa998b6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlpo:J/sCv7iUIxc3EEg+QLb8NVPhPlpo
TLSH
T1B8253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 93325c7e5124aa4afe1870a9ced7bcc64b05e7fd8d258155f993b93c7c7a0030
MD5 60fb87b921aa7b24252b34b200fc9268
SHA1 48b012e3f3d215680e8f01b3a8f0d244c730a0f4
SHA512 dda7cc81f68fab5622bcf8ffe41e9078f71e0813087c950bd4af36dcf3f0b9667a6deb1b5fa63aa5e2a14247abd5ea869d546e0b88d457fabdff746318aa8604
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlZu:J/sCv7iUIxc3EEg+QLb8NVPhPlZu
TLSH
T19F253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 34506a95609dd9a922bdb07412967b1779ebe35335b3a2e57a0f52d473539dc0
MD5 acb49b51f2105d7d54a58f543ff1bea7
SHA1 263e3e2cfebc8c8a2ea7a2a00b12e014e4faea12
SHA512 a3f319ff4b8ab5368847cca77fcfef36b4d4fc492ca2ce00eb7a27ab488cb315d18462ea6271d3e1ee73a94f11eadd7b87519b2d8f418a9288d3a4bee0350903
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl/9:J/sCv7iUIxc3EEg+QLb8NVPhPl/9
TLSH
T1E3253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 2a3efc57f25744d603da0cad1438c6de1cf7b142edb6a23fed8702788f4df458
MD5 3f29fdf1d15c0c60030d47ce458b2c2c
SHA1 bdd134478c99a93e58f9aded477d2846f7daa7e5
SHA512 342f07999f903741d5fe8ab6a53242aa66b4b24a25306c35a708b98d3a6fc32f187ddfc509b1e277ca36434a2ceab696624949ebef1fb2a713b354f9ba419796
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlbc:J/sCv7iUIxc3EEg+QLb8NVPhPlbc
TLSH
T11D25391366944F71D56F053059A94261DA3BFC295F2087DF22ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 c677c0a2713682953bc089a86d66f9f8a0815e0112f962e8500af30d4bf8ac53
MD5 3eba590c53b8e11e14119f8993982976
SHA1 cbc8f049edd578b7977977efbcc0cb83db389c56
SHA512 28247fe4e044cb6009d52fdd029a5aa5db2d05cc62fc4716eea5512483dbfcc952c680d4fd01b04e50fd024f42de1b5c1e20a8ab60f927ec23b70866f6680bb8
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlEp:J/sCv7iUIxc3EEg+QLb8NVPhPlEp
TLSH
T17C253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 0999d347deed9b8489ed36f374886079a74b773683f28603f59a66c0846700c5
MD5 b6fb017771f2353b1dc03232f48cedef
SHA1 0d1feee3a2d49290243c89a00ca0f84d9d97baad
SHA512 16b2cc51900c92f6ac9fb5eaa7002a45efc543d528eecb3468f052210191daa41baafb634cb2e65bf465077af4e3d96d6766b135f3673113693a77f1644b7c91
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlL0a:J/sCv7iUIxc3EEg+QLb8NVPhPlLN
TLSH
T165253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 fda9e36f7f8055eb8933082a26d5b3bb5f79fed8dafca6795ba028d2acbee748
MD5 7fd17a6151f3f554ee7e3cc8d90e2628
SHA1 9cb13c5ea4e4029defa560c4aaeb392444606aec
SHA512 dfd908d522310727458842a7c5b7ba2f8844e7189ac0ffe8671c7ffcf5fe41277b14ad583e119fd161ee4122e7c117a753b2597d3900a5658a0a9663a13f6d5c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlZF:J/sCv7iUIxc3EEg+QLb8NVPhPlZF
TLSH
T18E253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 88efaf4762c72ff877df825194982f6ac0bc5212e58855a0c075de2a10107bb9
MD5 2577d0d65417b6162ed28fce40ead6e3
SHA1 58632ee9b990b045a92d66397cb19146fbe0d145
SHA512 a7cf03974fe8c27c13a417cdc0699f6c55af368c19ab89f6eec6a43bb9a191c8c0ad3c483e560f895884290a4b7914c83a201ed049e7ac40c854302a9d949c09
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlyC:J/sCv7iUIxc3EEg+QLb8NVPhPlyC
TLSH
T1C425391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 1a1726242686d06ca3d9406a46f72943a49e350a5ce5f8fe340d58a76a7d8671
MD5 00fbf1a400518ba631e75b368ad722b6
SHA1 f8afc571957dfda7fc261178854f2dc93525c376
SHA512 b9f5bd32c8aa98cd3bb3e83f6116ea4e8cb15b21f005d2e567e31ccd1e52d935256e242664cd6012f0e223cde0cfebd0cdfa8155ce5fe7a5c213a0000c89ee55
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPltw:J/sCv7iUIxc3EEg+QLb8NVPhPltw
TLSH
T198253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 695eeb64d49a55edb657d12681529b2454915f327c88d523a84ffdec8a815754
MD5 90391c825ed39ed94dae9cafda28fca7
SHA1 777da7d5c1db882f0cc4fa3e77abe129c83755de
SHA512 411253dbcb178ecdf72239901314c8d044d52fb7d380f6375b3d16b96d9bc672745909302381df7901777479b849d73ba04fa77f8cebea85e8981390dbe6002e
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlcT:J/sCv7iUIxc3EEg+QLb8NVPhPlcT
TLSH
T14A25391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 653b6bb72a23533b00f0573fed104cae4644f57e9876a316c7948bf87e0eaa95
MD5 8f83e5c2e3aec08d12b2afc2074f0f31
SHA1 08fbca1f2deaa485cf049fc470aa917445f27028
SHA512 ee8dc6c45ce11248755faf1b1694722046c193f74828abd5ef46f0c27f62e666450b394cf647ac0d71dd98820e20b24a2645e823fe48210f4bdd769a02077c92
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlwu:J/sCv7iUIxc3EEg+QLb8NVPhPlwu
TLSH
T18E253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 d686fd5cf46d320a66ce23389596d90ada07db27f9769c464750c5009d154ff3
MD5 711fc1fca0a812019c135457884bce78
SHA1 7d857b1c8e926440c8ed363bd8117aad65d05bb7
SHA512 eef87350702c28587c5afb85870c11650b8d2121358ff340fc0a791b965a4491f92bd2759d8a1ea3ab5ab7cd60a858206d2c6fd550e36902f016745e1e74a935
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlOb:J/sCv7iUIxc3EEg+QLb8NVPhPlOb
TLSH
T143253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 264e21e7068a6ad9dfa9f7aedb8c45f83a9234b458fa1a75cd69315fa2bb789c
MD5 d0d68f6aff981dad84a9294972fb2a7a
SHA1 20bc917a668f7112cfac93e3d8c1331e02c20c3d
SHA512 d016a5c4bd7db4ee6f6b267ab0e78c5f605a731a19ade3cfdd92e9f59386803f3b780b8b0268af31f61f3d645f1516a2c9d783666498af9a056f8ff65d803f02
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl4f:J/sCv7iUIxc3EEg+QLb8NVPhPl4f
TLSH
T18125391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 97c17b54e252ba2b2afd0601f3860adb0385af055183bb1d9db92867ed068769
MD5 302280460ab697510b82632f1da3432d
SHA1 42bd51f24b3815040a59b6572efb38aee822df6a
SHA512 b635a920819664aaeddf4634c88a32116f4c5cc0be69164d8a95d3bab393bc79842390bcef33092332fa3db983f1e59d2b9d744baf2a17d2fec993f01dfeeebb
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl1K:J/sCv7iUIxc3EEg+QLb8NVPhPl1K
TLSH
T1F725391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 b545f47fc0002559fd9ca1910d060c40bbc16721bf0c65441582b20038797097
MD5 2180bdea843984688474f01d203b2454
SHA1 b5039e83fec41c42fdca393dfebb8d4355b894a7
SHA512 43ccb9f25ec2d99decf7d293111c5b1ab3ccabcd01c1dcae3eb52a1573a14742ed50c09ce40030d0388d202aa23188a35ce20f3aab9681b31472dc0ddf768ae2
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl2k:J/sCv7iUIxc3EEg+QLb8NVPhPl2k
TLSH
T1D2253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 74c0262871797aa301202c8a7cbc3f63c7087698fb4526774f6fbd813fb3cc8e
MD5 22bfc30afb65d6a27185dd62ae95070e
SHA1 053257bb5958b4fc4cf50b9e4ef90898998464a7
SHA512 e02cff03dc1af2b8159d8884236e3c8c8366cbd726fde4b7255ad63b0fdf37283e5e4417735b0227883409a81e21d9bb69a799369b4dd0ee75fc3272077d1083
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlT0:J/sCv7iUIxc3EEg+QLb8NVPhPlT0
TLSH
T1B5253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 05971f8c9a21382e6da1b9b02b3476c0012777b3ab54365ce1a517593f283b0c
MD5 94b72b71b807e7752c799077d6145090
SHA1 3354d26e047706ba6a264d71a8ae3a31bcd38303
SHA512 b0c5535082d27beaa7d628ace6447abb84cbe9be446fed5b67d3c82b07674b1e3ab4249f6442da9282969467e3019cf201cfc859ad3e6ad1aa4af3b8bf8420fc
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPli70:J/sCv7iUIxc3EEg+QLb8NVPhPlig
TLSH
T11D253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 72d595f421c247afecca1afb7169f8c4078fa04c36de1e5d2244da8dfddc6893
MD5 5452cbba5ea14184874a8194416a7c6a
SHA1 c5773b50dfa823d66eed2eb6387206514251b5fb
SHA512 cbfafd01d3d52ba75bcd4fdacbc534f51ac1a9c55da2cb00efe59890f00bb4db18ea1d1188518e8f136d69ad88fbabaf1abf993f4481b1acfb7404adfddfb5b8
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlDr:J/sCv7iUIxc3EEg+QLb8NVPhPlDr
TLSH
T118253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 35ec69c7891306c21065a5b47e01d4ed6bf09f67125aba5b61c03c28cdf2a2f5
MD5 8a1abd94e9a3aad8797705a7ad774c60
SHA1 5179eb66dfb3585a89dccd65d21ace46a008a9db
SHA512 019e2bf002659b2a9111280d9350ab2980108189dddbc616852d1e16ffa3beceb99f8514ac952d42f1470fc1f34cc1e88a9d2bea561437581e003b42c8b032c8
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlln:J/sCv7iUIxc3EEg+QLb8NVPhPlln
TLSH
T10C253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 0c1505b00a747ce44143e785d56a4aecf058f29a8925280472c392da27a76bd8
MD5 753394dee13f498b94a81f0be846cafd
SHA1 10650cca21b56828f87269f83b9ad05ff374c745
SHA512 197013427156e9015c2ce325974bc888f682df75fc6db4cda560eff3d71c9229e6104b53207cc6196f07da2c7c496079fee1c5ea2bfed93766c96ee5fe20306d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlRx:J/sCv7iUIxc3EEg+QLb8NVPhPlRx
TLSH
T14B253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 92fb2507fe94e70d65f932ef4f46c2748f8a5a3c45a968f8db0119e4d451c49f
MD5 4c68346374bda4ddc2974c3e2301420b
SHA1 6c0e0cc066f4656e9049e9b940be8ed4b3e952e9
SHA512 5d2cde3fb7be5d7c201b30c8f486be43bc8afa5bce2a33dedf3eb14c4408a93215f8c69a1cd18e75a3fdbc57bc0be708123542fb4f77e3944c999d9c4ca47ead
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl/A:J/sCv7iUIxc3EEg+QLb8NVPhPl/A
TLSH
T104253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 1766863944cb047132510cdec3d8c6e7293cbaccbd7b31bd039d53398d2799f1
MD5 d0a225d6fa091ba9f70376cc5dfbd4cb
SHA1 174ca04a89c7504a16b593f7d73ceb2e8bb1099a
SHA512 2beb6a22b737afc64dc8a02d8a06456ef06f701e303ca6f093ee5937c3e82aa8f4e728292e2fe92876e85cdd57bfc73c3e30eec337410dc88cee5097ae4dfb7d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlQ9Q:J/sCv7iUIxc3EEg+QLb8NVPhPlQ9Q
TLSH
T1C9253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 40481914772f6e601660ea9b1e3e00bea4bcb6c7d13971258ba3ded02c93db5e
MD5 faf523c38e4395659e0cfe968d505eee
SHA1 199e6fce59594d2df4457619b0edddc0dbfcc443
SHA512 0164576fecdd9569beebd0aa52de24f5b3a3a4ff74a0127949d93a024f5eeabe9879a2b208af92886ff3a9e21cada355386d7469ab2fa5ac6c82f90fe1719698
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlx4:J/sCv7iUIxc3EEg+QLb8NVPhPlx4
TLSH
T13B25391366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 b3aa169d3f2b22ec19b7db6f8ad8ea25b91e1c5ceae74f9b3ced1929e2e84d5b
MD5 9d332a8652728227042a5b39cd0bfd49
SHA1 9cd7b1d8c43f868442e86c0d55d14a3c0db45a38
SHA512 755867ef1298c1fcadaed6f87e0e8b5c15f87fbc7f608222a54f15b637eb4e2d80e0c2f1ed3227203bf6ba2c93de2d54afaa0591d7c1bcd0f308ce5c5d73ea78
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl0u:J/sCv7iUIxc3EEg+QLb8NVPhPl0u
TLSH
T17A253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 b61772442e14b99aec3803cf9fc0272fba6104783cb0a3eb2dfdebb3b001448f
MD5 1877eb9d672e7b9fbd50e11028c39b0f
SHA1 da7dd984af9f97fda5dcb43bd3f1ab5d54039126
SHA512 b378a8a64aaa08064bfa7cfc30029c520563306c93df9276247e713b268760d8011678c541764b3c23e9695fe33b74167a761363cb0ee557907b57b7cd58a863
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlFj:J/sCv7iUIxc3EEg+QLb8NVPhPlFj
TLSH
T1D3253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 88faddf4a212df34ac23b44a73a788e28dee55e91eaef0c7b0244abadbe3d662
MD5 2191d8d92dd584d451aabfdf939b3b47
SHA1 f9452bd3377d2208a1c497b66621c2819da0aef3
SHA512 23b41426852466f423fd5be72fc7423c70bc17e7b2a06631a5376d8468677a3c742879166e94ec0354ae12cd586ab855ffe1611c3eededf9d44b87665112adaa
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlMg:J/sCv7iUIxc3EEg+QLb8NVPhPlMg
TLSH
T15F253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 5dd6960bc03587d5592d8764ca2441ad18d2e96305c8d10d699fe9736a6aae5f
MD5 e5ac3e93c7832ea9bb5ce6a820525630
SHA1 6b5eee5d5925fd472b95abfd5c910f33e9643766
SHA512 9dd349bf70a2a74bf78e393058d7562242f8d6b03e42ed48a8413fc22a3d55df7b1b47be0ce5a3118d58943fb02f59d8fdce3100388cd1deaa577c3b3364a0ca
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlTI:J/sCv7iUIxc3EEg+QLb8NVPhPlTI
TLSH
T16C253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 939dbbdaeb384906b62479542a82a9330c48451b06c56702fc9f5d415068ef9c
MD5 c4026aad5dc38c4c67621210c295d741
SHA1 5ca2325743e736d0c9a1e3180f7204b1905b1e55
SHA512 6d811cccfae8284d2c4f3dead1674024105827f3f85542a0c0e3abf0c6e9065279d78254659c56912f016df4de72582c8df1b462ce6237d0829fdd6b5aa3b554
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlpo:J/sCv7iUIxc3EEg+QLb8NVPhPlpo
TLSH
T116253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 f0fcdb71559e3b366ddbc9f12ae9684b31e0dff2ee5d415d92f98d650fd6e4ab
MD5 00fa94ce51816d97ca5c0d8716d8eecb
SHA1 c00f390500facbd9f7773a95cdbe71b26ef03701
SHA512 b5f37a2b555ea9631cb63e0ff79fce3d8263edb33fdc2fd5c64669b81323b8fde263b59d774479641ed75d37099afa0d154b7e554c3e594ef905c48c64654e02
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPla+:J/sCv7iUIxc3EEg+QLb8NVPhPla+
TLSH
T12C25391366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 8b2cc3a274d3aea77d64b09155495c2437e3e7815fe6b6c3979ab879a8ceda58
MD5 7f8fecf30513f17a8cad9eefae1ecafb
SHA1 ec5ca7e5b05409efc471511765c3a5ffee459441
SHA512 6f7954696802b5252b6e75ad72dbf7e124e8ab4bc6422b87588333b8f60bf6ec3959824356316d56768f38b7787ba0f229878217b50a25eeb4c7e30745a3eba6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlaQ:J/sCv7iUIxc3EEg+QLb8NVPhPlaQ
TLSH
T109253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 19b4703aa9f26656747cdae5d54d43d7d823c37b6d19b41bf4dcb3cc69134e81
MD5 145d4a5958e662c88a71b93b3802a824
SHA1 0e77f3dc0d225e0919b42cf71b108bc917d2b238
SHA512 423d02c0c447f0baafa54deffddc95ad5817c1ef8ee6e41a8ae311fdbaf98a441805d0772bc1267c18e12c717073200bad88bd904d40d122c3d759a5d0f45637
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlrX:J/sCv7iUIxc3EEg+QLb8NVPhPlrX
TLSH
T120253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 a088bda8ec2972e5a78727955b2fe80acf1dd91090259ac441ad8045c8027d95
MD5 74a39b438de0d643105842b1981eec17
SHA1 678296199d7096430d18f43dd63c9c175a94ef69
SHA512 67f58ec355b277d3333558dd331f9b9dd4bc9c9f15629da3fd4684d3441df99371a71a2baaf5c5b7463e7cd1c8f5ad2c9b3f3e2e0274e5cde2eb4dd11bdcea0c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPl5L:J/sCv7iUIxc3EEg+QLb8NVPhPl5L
TLSH
T184253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 f934949a13238f8effdec8e47835bfe2a772280c6750eea96094fed494f8045e
MD5 f60bfa53160b0a0a5475fec1d5052e04
SHA1 8b9a8c7b858b48c6035d102f18596e09face092d
SHA512 1a0dc710b42fd31ed7870a84d2e900db790f83a5a65006b677fd69f9517bfbd9bfb061f50fe5ac9fa83ab951683b9e693f388fcc684750989f220b248703b3a5
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlnFC:J/sCv7iUIxc3EEg+QLb8NVPhPlnM
TLSH
T1DC253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 003f0f1768522e8d429c62486dcdb2faa34509d6a4c0d23f5a1060c0c113016d
MD5 4f1ab71a760490a1fc83b83880c50d24
SHA1 c4c3d514e14afe4ad220d097f57b6422c6992024
SHA512 b42b253a9ffc298d8f22fdcd0da6e5d75eea22a29e5be6470f008e6a22d8244b0713913d8f0b52568dc3429108215baebf6e2f312174e1ecd77b59e08f9a6d58
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPlQh:J/sCv7iUIxc3EEg+QLb8NVPhPlQh
TLSH
T1AA253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4820-1986-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5848-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5848-1973-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads