833b50bb06236d80c09192c8955b75934e9982ff5ff8ca73dcddd930592243a6

Analysis

max time kernel
101s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
Size 765KB
Sample260802-qs772aag58
SHA256 833b50bb06236d80c09192c8955b75934e9982ff5ff8ca73dcddd930592243a6
MD5 dcba1688afcc8ebd6e36693aac8ca7b6
SHA1 cefbbb8857edc3ce9fd1edac4f4399cab22ddeb6
SHA512 0cf7bc27ec098a4ad133ca71f6c3f1dad58f84870df67b3dbb66c1f5af53e1151c8ecfa3f7d28f35fee91b7eccca8792247fb3c7847421ac789637bfd5f6dc77
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQMrc:KIifqFu1//IifqFuyDA54GX79lSzQMrc
TLSH
T194F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c651-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001849e-205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198ba-400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-595.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-693.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1193.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1302.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1892-1898-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5552-1989-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
5552	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1892	2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
5552	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_dcba1688afcc8ebd6e36693aac8ca7b6_cobalt-strike_conti_elex_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1892

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 765KB
SHA256 833b50bb06236d80c09192c8955b75934e9982ff5ff8ca73dcddd930592243a6
MD5 dcba1688afcc8ebd6e36693aac8ca7b6
SHA1 cefbbb8857edc3ce9fd1edac4f4399cab22ddeb6
SHA512 0cf7bc27ec098a4ad133ca71f6c3f1dad58f84870df67b3dbb66c1f5af53e1151c8ecfa3f7d28f35fee91b7eccca8792247fb3c7847421ac789637bfd5f6dc77
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQMrc:KIifqFu1//IifqFuyDA54GX79lSzQMrc
TLSH
T194F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 5526e961f31fdff8c74ce2eb04dcbd4406f9bc1074b202131ffbb6feebb080a5
MD5 a4eeb90c3d9411a14b2accb3f5fc5c79
SHA1 b80bdf361d5752ceea161f004fff52c543ac0eb0
SHA512 6e8fda84324e89a6cef63771e8040ee181fed14a4b1f25448485a471990d73bdffdc07742b406f3c2728ebf9a61692cff7341014568405aa814f8ce990652948
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrk0Le5ji0hmxNrM:WqFgqFUHLPji0Aj
TLSH
T152556A16F6B04679D023C075C5E2A3B6EA71784217309BDF1399D7383F22BE59A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 780KB
SHA256 cf14959b4a160fe6ef4b989e8122177c9942b9e1975701df9f05c504b8a54c4e
MD5 9a07218016fd4eef4e73e1e65d275314
SHA1 8c61ab66505c9c60b1523af181a7d52ea2ce5966
SHA512 cb36b57de3fe140ea4714d4f75eae6a461069575ee9c9619acde8f8f4212704ba4e13d7677e383b1070dab070063b5b5dcccdce48cdf8a9251a16f09ca829bf7
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrOa:WqFgqFUH
TLSH
T16E059E07E6E244FCD557C17089E69372EA71FC225620AB7F2368E6212F20F906F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 789KB
SHA256 070e584ec3a78a491f6e56ce614f209b35d6210fa691b1687195479cade2f69f
MD5 55c5fe6c1ac52ccfcf8f983c75fecec2
SHA1 369b5e5f780465a83491484607961b51589851ca
SHA512 8f505861df58d893e7758130c183e9c30484b576d7b1316469d82b6567d5adde0d7ebcce12fadcf6207c0192131ff21adc2226014e821d7d6332a0422e7d1640
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrv6:WqFgqFUHT
TLSH
T1E0058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe$

Path C:\Program Files\Java\jdk-1.8\bin\java.exe$
Size 1.0MB
SHA256 ef3732d68284ea1685dd6a2723e9ea62196428394e10c6ba88e3c4a874a0a05b
MD5 06933610ee4ebf0ad01cd27b85fd1c69
SHA1 6a629b9f284d274f8fa0bb72196a07a78e3caaf1
SHA512 0e655ddfaf4d1f70513363c6052974c543ae10b8435717ea962f787f8bf4b49ce9fdb25e429eaefae465d9fb0d2a91fa0803b06de9c97a4c944650de1277cb76
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMreZM9zFVSOS:WqFgqFUHpZM9zfu
TLSH
T11735AF56F2A204FCD917C13489A69332EA71FC265630D76F13A8E6212F33B906E3E755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 789KB
SHA256 2bdc4e8a1017a66906ea80fbfc742157e030cbfc3d9d4248329de1cffaa1ad7d
MD5 d65f607329d6cc1a8d30402652d318f7
SHA1 fc1a7499363348857b649f00d9259c528f91deb6
SHA512 5d120826b3535b4ce45cf4cf78878fd26fb38e31d2a3e6d3c0a8f55bb9e9b95793055268af18b7804193009e5bcdeeff549cd7afd2e5477958e9d3a26fd7c087
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrpo:WqFgqFUHL
TLSH
T120058E07E6E244FCD517C17089E69372EE71FC225620ABBF2358E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 789KB
SHA256 6c693f7ec74f05e14355265defe92af6aa3d2c40d05010dae1fcd6aec4f32bda
MD5 54a86b234d3c2ee956c77b1dc9ff8f48
SHA1 3d77e61f66b67efe48fc6833c93b307d52872587
SHA512 5228a90d78bebd86e2f06fa1aac604df300598ffa07c10cc577a0301f4d70b242290f741bb72e2a23493ec7739a17634cba388fe3003bb76a8742a0c3e6626da
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrZu:WqFgqFUHt
TLSH
T115058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 927KB
SHA256 cffff259da38106ec540aaa23a5187f807250af828285b8c49f3e14ae8291850
MD5 b676592b5cc17c605c995df4e8ea72e4
SHA1 8cfb1ca0477a298ada36a497e056f754d45fc04b
SHA512 c08a65c9f3b64924129fa10edb0c68d172f7683ad6e43c01f16324c8572d2187492fb02c6a10255b0a6b2150a69bc48a6afcf19eb853c8c72391667dc6d67947
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrLzy8:WqFgqFUHET
TLSH
T198158E07F6A214FDD517813089E65372EB71FC225720ABAF2368E6352F21B906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 789KB
SHA256 fc7d81d9be37c5120634954dd436a5d7e69bf09ba9dda00d80209bc044c6cb29
MD5 6302942af0afa544ec57651edba59353
SHA1 dddfefb721d091fb3499277a24c664bf00ccc56f
SHA512 7a6d630fea4683369cfabb4b397e18b6e399620519edad8502267a182ba0f9ceb5714fac243b2ac1142f931a680238f11be71d05d44a9536529afc9c9c26ee37
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr/9:WqFgqFUHY
TLSH
T136058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 789KB
SHA256 8226c8c4a9e939dbc1f2d080324c28fb28f5705bec4ef2e461161767d6d0398f
MD5 f716af4cb390c46f5ddb1ea3a5e7d4f1
SHA1 166419f1124e8f3e7f2b5f228d813d33090c74ad
SHA512 b163361047a2856b3ed4548351384fe369b46f5373bf9d2d152b392c8551ad240f429f18505d69a27eae7612a1ca6188d63e3d48a5139224129d4ddb39dbf9c5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrbc:WqFgqFUHZ
TLSH
T1D9058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 789KB
SHA256 8ef0bda2e245712cdb6ac0644dd1aad861893cd4776b69d63a9cf03d06ed86c7
MD5 4e21e242c2adf86e14bc43057543bc01
SHA1 e2b8fafeda819e019b18e09dcdc3dbbd021bb652
SHA512 575f59d534918b98c7abca673d49f8ba81c202c17ae3d60419ba774aee7c1a7e369019e205d0d7498319a19455e83534d0415250b174c186c2fdc4b6aaaa9372
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrEp:WqFgqFUHX
TLSH
T100058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 789KB
SHA256 07c16894121de337a276257f9ed9d534f8b7f90c8ec9068d2af843c0ec6dd15e
MD5 403be9f5d357d4fad39dd7c3e9f52555
SHA1 744d44b849e8cc2432a768b5ebe29749fa1fe531
SHA512 353283cc798a70e5b3dce3e42b2de965bd3cff01eca95b496ffa224f7c614081e7b1284910c9d2a620a0a725e9c1df96bc6dd9a87fd3c862a486d510092e3d25
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrLN:WqFgqFUH8
TLSH
T1C1058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 789KB
SHA256 427b21cf461445236eebd39da82385d397ebbfb23170ecd490f3ac6046758439
MD5 d3b0d1f477e639e9c2a35c30e358ce47
SHA1 a810bb50e62f35b32d705da14fff7fa03775550e
SHA512 6b6ea1fc1fb2f5919ecda1356930c7fa7035cd55a26bea8395b650dd68b6b12f73e21175148963a43be3a0d175758869b23afd5e079e4f3d9d024c774c386709
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrZF:WqFgqFUHK
TLSH
T154058E07E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 789KB
SHA256 6384d4498dc8a2b4f4a48a254a94bd40d0c6b96771b14093004daa240b451480
MD5 f023aa5389ef7bf3aac3a1ff37eeb0c0
SHA1 dc328ecb49a67b589b91da94b4a7e9394cbe4034
SHA512 7eba42fc71b9b3f143fe9bbe2e822aa9b67e43617659d624e8525ba42c1c5eba3d25cd9413f687e97dc6b23f7ee0e09aa6522d4d7933ebefec4df62b82fae0d0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMryC:WqFgqFUHe
TLSH
T14A058E17E6E244FCD517C17089E69372EE71FC225620ABBF2358E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 789KB
SHA256 0a750102c5ad82df6dc7139c5a6d2175261daf0f16a5e3802b3d476809bef839
MD5 7b391d3e8f2343668cd24f14aba40adf
SHA1 1253143e62ded78744866f467f7c7731e4b5f712
SHA512 882cde825b5f9a35609873eda1606c4801ab7e143511bfaa8240eadb5e5b65cc08d40cdeba8eab6da741283b82028197c757fe22150e6470e9f9dc570afe79c2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrtw:WqFgqFUHr
TLSH
T16B058E07E6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 789KB
SHA256 3455a0f16f0e446f51b106527281c56108bd76dcbe037d0bc1cecdf0921561a9
MD5 2be67df235f02f818432fd3e57b9ccb5
SHA1 dfe9966571794eb8a252b22a4486faa14a40676f
SHA512 c1518cc93755be5091456a45dc7391396103b908422f5b6222ea942de4a5093c57c465653c8836d3639dfe5868ce17162d59b2ef93dc90686f2eb6b8e026ce4d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrcT:WqFgqFUHX
TLSH
T1E0058E17E6E244FCD517C17089E69372EE71FC225620AB7F2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 789KB
SHA256 186936d9342a8363137d3db64ec4dd3db4c07a25ea281a7a356eac2d299e4f4a
MD5 2a1e60e83bf5ff2b6aa94a6b0a5bed6b
SHA1 573de130b5afb2ef408cbd896c93056c929b1a78
SHA512 f39bd7a3cbc8a416ba7ed8a9226458fc5e977a6b265265e506db47c6b1b8f8c811ef85d78e5fe265d0cedc4dac7dd2ee983a04a21d9125ccfeaf5533a6bc82d5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrwu:WqFgqFUHY
TLSH
T1C7058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 789KB
SHA256 4ddcc78ced156485a60842f2484c1b2d104820fc2650c3fe429123271df16de0
MD5 b39b47b97715fc1fb886e5e1d13fa6a1
SHA1 3b829e66b4f4f717699e5cb4b0c063cb28e34c0b
SHA512 a6e7f518daf56ab6afc7898565a7a7873dc77093f3333d3c13e102044b22aff66f6a7453b04e26cfa39a40b02ea14b808dd550ea36ee97ca6ae55cadc4717a8e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrOb:WqFgqFUHB
TLSH
T1A5058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 789KB
SHA256 02e2adbe7fa186ee7ac2347684ca82782bbb1d1ffe9cace7b4a392dfce335b1d
MD5 2a36882df91e1556fb3fe1d56252d78c
SHA1 557690060098d53507a8a945577161512c09d317
SHA512 34cd967ad547e687a6e1b0a5c0404e3726490ab71a48f1742be72cafa1a5858899db00513e9ade84ed2fa89581a28f06d1c5b3bc8bec0f0a2a88446cac6cb5eb
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr4f:WqFgqFUHB
TLSH
T122058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 789KB
SHA256 3ab6369789ea63c8f9e2be04281c74ab961e3894ad806a9064a61d4ae88843d6
MD5 cd5808bd0ed3a26bf7e76a0340902208
SHA1 69fdbadd0bc2bf16e596222043975a26fd96af79
SHA512 9ab55713dac4d26984a91b9484857653575470a8eb3fe3bf631c80a67dc8291732337213d22a05c4d738bd020b1a86be30f9363eed5fa8011f464a058fcf6b1c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr1K:WqFgqFUHZ
TLSH
T1A3058E17E6E244FCD517C17089E69372EE71FC225620ABBF2358E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 789KB
SHA256 46209cca2ac1893f03904a096de806073d1e3439f7ac6486407b9a79a982afaa
MD5 c1b138cb533c50c7d2aa37bb6e6c46e3
SHA1 846609a6039515d8a94c2840198dc91e937cdb12
SHA512 88844cbdc8a77e8fdb5c53c0278ab8cabfb1476c771146b80b3901fd3256a53a0c5e2d29898c18d3076638922cddaa2857a3ea8a13a07c019e9068dc814c18f3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr2k:WqFgqFUHQ
TLSH
T1E4058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 789KB
SHA256 304090a0cbe6e7e7a3d81d39eaf5aa44bdb885a9f1016473482e8a74aefa5260
MD5 acbe3211c064b12331c40f147a8f2c43
SHA1 f9dc9c9bee9a1bd5a9b2ece37e945dde9358963b
SHA512 6aa39a9ba0f0ae04aad870cdec06d5b2eaa454e2a96fdc52c54a1cd25eb2fe82d3235372715e766a5df7d5dfcc2abb9623dd844ac01ee5108fdb45a0e7db13ff
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrT0:WqFgqFUH5
TLSH
T1F7058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 789KB
SHA256 a0dfbc96ad07b9f689d1ce2f90879fbcaeb53b583a287e2d7f7ec3dd2b11b4c2
MD5 9e6faa46f951f6c6d04d9e4e9326a3c9
SHA1 f5482c41ff30775899b24d0770428549bdc68bcb
SHA512 6c79e2eaa12a926568fd756fa0fbfa1ca7dd837d4a4731b9e4381abff7c37551f33e60fe058f00e1a6dda789f8b2d06074c785890fb648245d86b057b64494a8
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrig:WqFgqFUHo
TLSH
T1F7058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 789KB
SHA256 5f1830fbb1e4dbc6ea678b441229d1dac16bd3f6bd1e852719b33a379ac7b32e
MD5 7b10f6bd43f2f692c2c565d56ef1d673
SHA1 af292636931055fac76ce3a20889525a3a02126d
SHA512 85e56b4e9722b0158b8761e60fb1cfa5e9ca9dd3eb1150ebd0b873b6393549e43863892d7538049198215626668e45527b24981192b88ca30afa10b6e3ec2727
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrDr:WqFgqFUHS
TLSH
T17D058E07E6E244FCD517C17089E69372EA71FC265620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 789KB
SHA256 8d975c5d0f2c4de9d0788c8aa16c3d2ba5fe4301c55edf770b82dbe15dcaffef
MD5 6aabf5f18f143a79358f05c12fc1412d
SHA1 379e323c18395302cc83428e42474f2d8699697b
SHA512 6d06eac9a3585521572c60e1b5af226f57e1a65fe7d3da697b10101d6f1e0fcf9d2252ea473da15ffbd1ec9788c26e26317417cf0db19817a7e5457ee1685280
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrln:WqFgqFUHE
TLSH
T1BD058E07E6E244FCD517C17089E69372EA71FC265620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 789KB
SHA256 3357799297eba1f3d59632e847a97dd6ccdc0a2f1369089386d97cf058b11ac2
MD5 26d8818392bfd9ac1ed5bd6b7a538927
SHA1 29620bc2102e89212838c26f0288e26e877aba27
SHA512 5b0f39acb1b7dde1ba7e296d70fee2ce0a0ca918b56eab8ab5a392f334829c58b64f6c2ac531acd2c2d70e0801a7e2d73c2b724695656ff3b33748c6845bac35
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrRx:WqFgqFUHi
TLSH
T150058E07E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 789KB
SHA256 d9254747b6e90dd2bc8fbc74c40157203665ac5cbe3525fb2476e8101b343dd4
MD5 7aa0187ae3c36bfbabcfc77ee21c072a
SHA1 9ec6cb3d4d3527a28a4439e579a68237cbaee138
SHA512 6884288743a24327141e8712bc375591a6f75b67ac86a68d33b58b6b5fd82a3650bd5c2947b490988e673e9d8769b836a8590fb4266f416af7668127b768ffa8
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr/A:WqFgqFUHB
TLSH
T12A059E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 789KB
SHA256 4891f644b68be551d1a2fbb8a6d57e45144b29717ee7447fe7a549cdcbf48cec
MD5 a38e70456120cbcf900e0c7c7553ea86
SHA1 b57735572ba9b56dfe6512c05f002cbfc511f854
SHA512 c3184477677336e44ef99096d0c6c577ba45c10f7d142fd09e6d5972068f53b1b7e8c122844db6b641fc2b3e56cda2763d433fd1f634ff0e8e286c14e62fc45c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrQ9Q:WqFgqFUH4
TLSH
T151058E17E6E244FCD517C17089E69372EE71FC225620AB7F2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 789KB
SHA256 72ea361b59f425a543d091637f22e3e1839cf45210fb5e68aa3853e53de22f6d
MD5 ef999a8772e4da577ae2e3cf6d1d3fba
SHA1 a5ee80aa257d047475010a10bf3351cae822681a
SHA512 cd487791e03f27bb9c3dc59a74b8f54b00d20910bbd7503ffd7ffeba7898c196c7cf02dbe5dac0e2fe57cbf2815569ed3f053246b8db5c07b9c1f0ae98eca5b1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrx4:WqFgqFUHD
TLSH
T197058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 789KB
SHA256 806c1e748c777c2041c8a8a155412b072f1fe03e92d8b193e856e1c5814efbfb
MD5 f357df43275a5f6c9c5f25dd5a478069
SHA1 7429cd7ad5ad65fef1bf949a1bbc3c8bbf392fe2
SHA512 487e164b26a3162de96d62fb2e85f1b25bfb63d54ea5c490313672a51fe50d95b0ea712cb64b590fce245dd7893340e0cd3f8335bde782b2a3fc7d2abf2a1e1c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr0u:WqFgqFUHm
TLSH
T1E2058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 789KB
SHA256 34c30d74aa6f5d3131f3616f537ead7d262b645a6aa52cee61632f05b77254bb
MD5 648085b3fb6e6ae4d8aaa6cf6f81823f
SHA1 5b886ec24aeee87ef65a8bfb29a65b966c2e6c7d
SHA512 2abe171592491298aa708a315ffbcea0939a9337699248447edf4b8e322c0f31f53508dcbc1dbb5fd9475fed08b6804013df5652e40ed8757ec465167d0bdc06
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrFj:WqFgqFUHY
TLSH
T16C058E07E6E244FDD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 789KB
SHA256 1c9cde286b00fce0ec5aade09ed57b8a298f62d19ec0af56a03c68d5f68028e4
MD5 ede75cbaa5dc7304abb11d118ba3ecb7
SHA1 ea757f4bc604961a6b52539672536562830c5cd7
SHA512 ad0d9d8f83f1bf43692b0995e96ed9caab1f55a83644056ceb2b454aea3eda0d449b408d52c17f9ff907ab21439f298e31648da752b189d1afc12a850f71cb8e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrMg:WqFgqFUHg
TLSH
T174058E07E6E244FCD517C17089E69372EA71FC265620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 789KB
SHA256 cac0b4a1cba91ead0683160c9b5d690faec0a2b4856d5684b35715d8ef07e0d8
MD5 fbf0e5d979961590d3c9095915c58f6e
SHA1 33df637b4bbda13ed4417fb0e130d794c9d18025
SHA512 0795878d3f6c3d53afd5681830d0b22365e37e641d075cf2895c1360a6077021a3a095462410643d16c999bdcc4abd648d149d2541dc459debe1611e0447e9c0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrTI:WqFgqFUHh
TLSH
T17E059E07E6E244FDD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 789KB
SHA256 8265bf052ed4a40725b2a93cc81fc9f9e3c0cff07dbf42ba3ee98b47a94e2b92
MD5 75063a703be134e7abc58464fabed3fb
SHA1 ba40ff3f37802a809292f3912217039e30384982
SHA512 ab01d0e8a50f63264faf2e739a30bcf706b5993056a87ec4c6ec0b101421380dc91246aff20de418b1d749943b907e672e59df1f1ef89a184c82aad05e975f7d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrpo:WqFgqFUH/
TLSH
T16A058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 789KB
SHA256 23108372cda21d29a46d69aa89415e3bb7c4362894a85080ed0f54f5bcdb75de
MD5 209f618537965214b53a88261c7ad2df
SHA1 af85d91baa7993e3253ea73365a14751e41c9991
SHA512 4b19070063a5599a0df1b9c18ec38324b6b15d4c270539bb9ed704713f1cff66173394c82ba4e1a9d5bb3e4ed0891c1c794ebd4d13e4e6db3a7c866bbbbba21a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMra+:WqFgqFUHK
TLSH
T171058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 789KB
SHA256 a8dab1825dc549ea5f2076b6c8070a72a2c21200bbb47bdae0f201dee6f8245d
MD5 7ac0e7d5f636113dc29171ac8cb961a2
SHA1 7b899b10d28148d62b978a3e83fa05e655978179
SHA512 15eef08d846271a05cd737ed8f931fef5d2cbef483b562219862c96bb8ac900233cd97b665c27dc3d3f603f5636cedbf9f0578c44b52c53720a62fc0f7646b22
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMraQ:WqFgqFUHO
TLSH
T12C058E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 789KB
SHA256 d910b7c8a32cc7759433e4afe009e23dea9dbe6d1142a2a2a4b953e9419b9759
MD5 b356e782c34bb737c835b52a4e519087
SHA1 c12f94abef198f4ce3cca363b975d10c031cfe26
SHA512 2b1994e5000e1ed920271d25910d6fd171be97045a1524f13ce42abe0b6ecae369e5f6f00d8b38c176ae50e8f65ede380d73b6e12ba47e492fc387d6bbd654c7
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrrX:WqFgqFUHO
TLSH
T152058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 789KB
SHA256 1a7f418fac419c76ba652ace2e13d45ada6c7cdfa9d7299a980cdc7d3dd0f0c8
MD5 c5939f34d8c34f3948f8a77b457599f7
SHA1 ad38624e0f3a4cf86ee7a43e10f9d547437f5577
SHA512 0b5c78a84af3a35600e8eb4a5abba9160c16138fb120e84cccb0fbe649849e7d73e322467cfe07b2a1e43c40d2ae4107b3621fa9efd4e692c658d8edf60ddc0d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMr5L:WqFgqFUHg
TLSH
T155058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 789KB
SHA256 938304e20f4c612a61a9d0b28256d0c6fb1ca19dbd9d9e8d2a2fb7e01e540079
MD5 c4822ebb65d46d835e122891a092f557
SHA1 c7a3c824bcb66dfa48b7a5921b8cd4ed4917d98f
SHA512 2845378cbe4eeb71bea827b2f0b5ce921b98409d66db369a871bfe43da24d648be93abcee8642b2d87942ff5cbf4d24d83e22bd3bb675dd03c28dcae7a0c2d7a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrnM:WqFgqFUHx
TLSH
T1DE058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 789KB
SHA256 214b306a1d72178c73541aec21ddb9144be0e8c6fb397b110402d6928f8f0610
MD5 8a75ef07252e93ab1f5e0887099c056c
SHA1 1a10af0defec9171d2c2e4255525e9e8239979f7
SHA512 907074d08f2074b3f974b7d3fdd784aaf9435b15814a3829f27caec38046ec9e7965fe0f41f36e8a50d432fcf7008779bcc15ea58a22d0804e4134810cc1ab1f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQMrQh:WqFgqFUHD
TLSH
T152058E17E6E244FCD517C17089E69372EA71FC225620ABBF2358E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1892-1898-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5552-1989-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads