d4b671d13508ee2728f9d243c5f26d3fb4435e5f34aa4352f59d50354997d236

Analysis

max time kernel
103s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
Size 858KB
Sample260802-rlj3as1thw
SHA256 d4b671d13508ee2728f9d243c5f26d3fb4435e5f34aa4352f59d50354997d236
MD5 70dc56036407eeb141e72f5df3d9e867
SHA1 1272e3cc440469b4759ec361789e78a8c2fb45ad
SHA512 044872e16fa1bba4e0da51e78b1595954613f0164da676e9f136fa711111e4adee3e6ff516bc4612d5ccdcbbd5c495d4d795edbf0cd0c82bcd26854a567199fb
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK56:N8RFEL8XVav9MkTQfOK56
TLSH
T196157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4288	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
4288	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_70dc56036407eeb141e72f5df3d9e867_cobalt-strike_conti_elex_glassworm_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2776

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 858KB
SHA256 d4b671d13508ee2728f9d243c5f26d3fb4435e5f34aa4352f59d50354997d236
MD5 70dc56036407eeb141e72f5df3d9e867
SHA1 1272e3cc440469b4759ec361789e78a8c2fb45ad
SHA512 044872e16fa1bba4e0da51e78b1595954613f0164da676e9f136fa711111e4adee3e6ff516bc4612d5ccdcbbd5c495d4d795edbf0cd0c82bcd26854a567199fb
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK56:N8RFEL8XVav9MkTQfOK56
TLSH
T196157D13AE6898F2E57A4AB94B7186059F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 887KB
SHA256 f17559be9034a68c5cce028b0d742fff8d3aea5dd4c003d8fd0fc6b3878b9002
MD5 4c0b5864d3e7c829673b0e3f7fada19e
SHA1 f1e0d85784a7f0c70be0e18a472b117acbe4bf85
SHA512 b9e20f99038c4b0e6ea25ec45f8b4bc8baf726ac6dfdf80aaf99637911a71b66b6ba440e9fb68d57c7af65e039ca2b45176bca9f4c6d83e8bd9d27f7d8d9f337
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5MP:N8RFEL8XVav9MkTQfOK5MP
TLSH
T10C157D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 905KB
SHA256 a162786fff632dbd1bc8892b9c93ca5dde504256951c9a95956b25de72bbb0d8
MD5 0162f5a0586ed910c770fd5c3615e747
SHA1 706240a63d2f7cc9710527f98a06d244ac28fc85
SHA512 4b5f5225876d16d8d72c6833fb64c82638442ece3b2c0a42dd30ef5e844ec225d44ff160ee785f4c6dcbb8f87268db07e929e68b7caff994d575064a6af127a9
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5b0:N8RFEL8XVav9MkTQfOK5b0
TLSH
T1B5158D13AE6898F2E57A4AB94B7186059F357E310700D7C7E3A4B79D8D333C09E3A625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 950KB
SHA256 b3b92588d8c48aa93841028cbe599a8de135ee50a6c7c249fc13f3b86b4acc34
MD5 54312427eba9ae071bba2016b0ee86f1
SHA1 2c4adf2ec872ea9d1c6213e5922778a51711409e
SHA512 0196fdc8f7473b5b7ee45bcbb8ff15b1bb5e3fcc9e307e726d7df544529f183422a29649b554b9173715e81626aab3432c8676160eb2e23fc2e26f809c34d113
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5Q:N8RFEL8XVav9MkTQfOK5Q
TLSH
T19F258D13BE6898F2E57A4AB84F7196059B35BD310B00D787A3A4B79D8D333C09E3D625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 943KB
SHA256 3941027969781b5566b0de8ec35a0d2bffda68842db7c1fcb114e46c269fd181
MD5 fafc19411cf22af07e1dee0992997daf
SHA1 7550625c4ebb0f228bcd54c30b042b2cfce46198
SHA512 4612a07ddb827d4457c98179da33b895a27e3fc60ea0114f14d4027f39ce9ad82599d111bcd83adf780d05cc4267fbd39231b285325af7f39d9187adee09c0f2
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5ZYmIjE72:N8RFEL8XVav9MkTQfOK5z72
TLSH
T17E257C13AA6498F2E57A4AB94B61C6059F357D310B00D7C7E3A4B7AD8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 911KB
SHA256 ffed686aa87f5ae535721173b01b11ddf41903482bef95fc4d7127bcbca168b1
MD5 754c129f9a4b8b494f922f7f5cb5e108
SHA1 267a5409cc2b33884052331f14a13966e7cce192
SHA512 9c1b1a0b814b8600a1df2aede7f5ac21e74804a1aea704c10a4525c490277e674d4e19ac341b81b5579c0fe5ebd7e91ef9ab61a93072b6e9e6f5c5a76b5ea0d0
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5/Ffj:N8RFEL8XVav9MkTQfOK5tfj
TLSH
T113158D13AE6898F2E57A4AB94B7187089B757D310B00D7C7D3A4B79D8D333C05E3A629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 966KB
SHA256 1d66fda387083878982d5f78db33190e925382f595709b72506ce332fc4a60c3
MD5 4193a240b8d724f8d4e98c9396caa72b
SHA1 2e6f50f79ab30deeb79d691708524f23b2b77329
SHA512 ad188d9c2b34e873de89e5030d247338a45ee3da261022bd99bcd233bfdf4954292dda6453483c39ec4ec2d7cae1922121536813d31e7e062e3b48e43e8039eb
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5FzQl8Hok:N8RFEL8XVav9MkTQfOK5Ohk
TLSH
T1CB257D13AE6898F1E57A4AB94A7186099F357D310700D7CB93B4B79D8E333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 06b1bc38f69e3c3c93e584f04df046048b0b7e682675234bfd924f687e48f792
MD5 62083753ad971deaae31adf0575a3aa2
SHA1 57a1ad5dddfabf72c68fae1a20e8fa89622121cd
SHA512 5fbb3782512daf8cf5ea5a95614d9c5f899f66230f9bec41e894591f96f74d72cd7b1282cdac1ef98ac2e9411794ca9e1cbd7a79eae77d2921642413dc51deec
SSDEEP 24576:N8RFEL8XVav9MkTQfOK5K0Le5ji0hmxNrM:fv9MNfMPji0Aj
TLSH
T151656B16FA7886B1D076C1B9CAA29649EE313D510720C6C79394F7AC6E337D18E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 873KB
SHA256 09b2e2dd5cf8f4f5c3da2ef1b8dfc16f1cb2d5da48bed17ba83508623168f742
MD5 cdae97eace7f83c0709138579e37cb96
SHA1 b96d9d6e0c213022c54a66e101fd5b67c83d4c0d
SHA512 f173e90423622a7b263200b0255618338f2e7d72d77f5a2e06a85225660cb5968ed6f1ed8b14a359369e94e61fc29764479d87ee9cc09a5780280f243659466c
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5Ea:N8RFEL8XVav9MkTQfOK5Ea
TLSH
T16D157C13AE6898F2E57A4AB94B7186059F357E210700D7C7A3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 906KB
SHA256 b391a742e9242b9b6924bfa9039529497de3836597d9c8ba9b74cf1efbea90e8
MD5 39d1605030b17d1b4a04a307e7beaf7e
SHA1 89a7f3ad35361bad6d8346aabd5fd77b1813880d
SHA512 9abf3cb46ae298b357ac97ec28a0a488f020df57c63af6cb5c8272599eba49272e005e57052bb882b096e7c62b2d276856a463dd441446db46130288fb083cc8
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5Pb:N8RFEL8XVav9MkTQfOK5Pb
TLSH
T1E2158D13AE6898F2E57E4AB95B7186045F357E210B00D7C7E3A4B79D8D333C09E3A625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 882KB
SHA256 ca467334381fe0a929182ff972e9529de8da5529695b390fb62b6e7bad37c06c
MD5 282df8004bc37cb1f312b5e833b0aabc
SHA1 cc0b5f0121d0fa9d5c14fcb3ae2960df7febc71b
SHA512 bd0c76db39393217f73b186d23788db78bd1dc49610549650076c0be668ab632a98b99c2e502df9bb1505813ff4297e9b7e06d16fca515cda0fd94694d9bc658
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5XK:N8RFEL8XVav9MkTQfOK5XK
TLSH
T146158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 882KB
SHA256 0bb8061d579f522db3e77d1c95d82de8458a13d1915830bad05580f4bcd3b764
MD5 b229106c5838df9898d6692ab4df9bd3
SHA1 6c9bac1f4d8e36b36b6df604f81f37db1cb46bcf
SHA512 ec92c1b1c0a3208314b530624361d5f68457332616f7a2934dc935222fdcce8298f819479f5ea567f0e7052561e34c3b76fd9c91f6bd330fac8ace0918060fe3
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5gk:N8RFEL8XVav9MkTQfOK5gk
TLSH
T1BE158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 882KB
SHA256 12fd3975d5762afbfb4d86c73216459add27614352e91fed902e6413401446df
MD5 e044dca8a109f6ea89841112e380f5c4
SHA1 06ea5bda3360d2c7c3333cabefe4f89f57f4ba47
SHA512 0f79ddf3889a808145e0d4ece3be054fbddf2ab491de5c0a51eac584e56b6a5bbb41c07bec61a0a059c861dd3a453f97c7a1ea00130bf6a16d45deec480f4b2e
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5R0:N8RFEL8XVav9MkTQfOK5R0
TLSH
T131157D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 882KB
SHA256 5446efe31e6bcbfd588bf7b9fea6da0212d757737652b1c1af5ac7f9c84afe38
MD5 ca4af6759488eeedbb5c1db3048d7e2e
SHA1 90089a97ee35e86acf1550dbb8d8c553b4f62086
SHA512 6204122fc08592cdebb5270e2ce699c211dd5fc1146e6e7f7fb2e31a1c86b46f97e087c5cba46b127fff7a6ceb9a89159344a3f84cf1541e0486198517714fa1
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5E70:N8RFEL8XVav9MkTQfOK5Eg
TLSH
T1B3157D13AE6898F2E57A4AB95B7186049F357E210700D7C7A3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 882KB
SHA256 e27c93f14a077505f99be294c3ef95541ff4166d4eb36bbb0c5db0d37e8eef6a
MD5 f29c466444c1c57cd1e923ca086e6bb5
SHA1 7863c26d4f625bc6a4a74b1306d884b287d9e879
SHA512 60fcb7907bed504825faac2aff84e730d926d0dfcd385e867b19206ec1101a0f048d738e8ecbca9fa0ac66b21b164089ae58487fc2a035529ec371b70aa8a60e
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5hr:N8RFEL8XVav9MkTQfOK5hr
TLSH
T12F158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 882KB
SHA256 fafdf452d9fdbe6593d9e15c985391dacaf46fdd0ed60d193a48844e55839d1f
MD5 95cf2242669144d1867b6ee5d801cb8e
SHA1 43e7d0d77d0e5d8e514151bf37d8ee80a9b1aefd
SHA512 9038a239cb6c02eb3e6b3643e6726e1aff42994abbe3080146c893911830204e8d8cd5a90e813f1e3689b146b9306c34e8bbe0a00cee9c53da7c37443d75350b
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5jn:N8RFEL8XVav9MkTQfOK5jn
TLSH
T1BB158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 882KB
SHA256 86c01be13735e33b658854c9fc0bc7b7a61ca3bafb680e7590474048d8ed9786
MD5 809ca23b06ed81bc232e7bb582952a5e
SHA1 63432365d2b680c9693a4573af98dd27f40f22f2
SHA512 c7efddb5df096f0d76f816922a9486de1222f81366a6ee07526d14b2d49505a3acc38012e61539e3fb5add5b2c906f420333acaba015fbf7ddc22bc1a1ca70cc
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5/x:N8RFEL8XVav9MkTQfOK5/x
TLSH
T1F3158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 882KB
SHA256 7f544ff02d07235583fc546ea42ea255ff08f7f285e818dba94d8d96e9ebd41e
MD5 c2472a87d1f79cb1a542280dec5518cf
SHA1 4c81ec8f8a8104932491aae7357fb54911f19f6e
SHA512 d53f60ab85bbc194dd3455a9a0d8eb26c162306490b7998b333ee50c18dfdbb206dcc1849bad4f41d59371f34de92677eafa08d82704743a4a16b17aacd6f396
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5lA:N8RFEL8XVav9MkTQfOK5lA
TLSH
T191158D13AE6898F2E57A4AB95B7186049F357E210700D7C7A3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 882KB
SHA256 a09772f3ca2f5caf01afae99017758afce06a5a60615523687560e4d43550405
MD5 de559b506301475b6a7db785cb48d3df
SHA1 e53533d447bff391826e97c0c5b6b48e6c3398cb
SHA512 8ba6526bd9e2732fc8c567ebea59200d3bf10271751bef4c453f7ad3b640a4aab03b5e968ede9c1027bd1ac77a21f02a6842062957928c8aae38e7a83e24a221
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5e9Q:N8RFEL8XVav9MkTQfOK5e9Q
TLSH
T16F158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 882KB
SHA256 4884aec3939b94319cf7b84443dfc8dd2b36fccc8b8df15ba780cab4052f73c7
MD5 7017eb5a781facdf2741594c3810d0e9
SHA1 6928bf990d5074d645462a3bff1f2f08fcce898a
SHA512 859901fdce6ff4b0e9334cd056dc532d19b9bc51c4d728881d465e6fcb5dda4128f312963bee06b11aa50b112e11ec5e5af38aaf2bf8e596fbc5f528085bec3f
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5L4:N8RFEL8XVav9MkTQfOK5L4
TLSH
T134158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 882KB
SHA256 29e94dda4a2e067bbc366fd7146580bf67f2428ea0f4592e7f3de9738e714ae2
MD5 3ad5ab1ae4fd8561cef16a341db74837
SHA1 65d406a72632a09a3ef73a38eb1bec54341e1234
SHA512 f3b3bc4d7b77e1b2c37354d5a13b60d5f042dbeed1c0120b5bba25a5323f9e344d71c249a0c4f32f5b53d4569d1a5a82a93f6ad4fbf4dc18e5344f0eb59fcc95
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5Cu:N8RFEL8XVav9MkTQfOK5Cu
TLSH
T12B158D13AE6898F2E57A4AB95B7186049F357E210700D7C7A3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 882KB
SHA256 607ade8d0cb36f8955a477a3fd6954441bf6f37edb360964a4af253d50e393ce
MD5 48cf5597fb5ecc07222d778b93193be9
SHA1 351efa83895922ae2f4ad49174b2051c7dbf0522
SHA512 a1ec06e413f9bb89249e6ff988f4e120996af04f8a0af5a218cbe1375b5605921cdfcb9e9ed59cd4f071a30cfd00993c8d50117d1a69861cdfdb30536817c3dd
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5Tj:N8RFEL8XVav9MkTQfOK5Tj
TLSH
T137158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 882KB
SHA256 d9f4aa7ebf769f1fcde2be418ca08d14dae834df783f912a8f9ade9af2c51b60
MD5 2cd8367d142f8643b3601d3ebddc4c8a
SHA1 39019856e7692401a85dde8a0dd4211dd3b5a33f
SHA512 c19d1292a0251718fe7c8b6937d3d5860b2493aa73b69e64c6e412d18d25961af6a10b9af177a107897246979379264ed723d0dd8d4144576718ca747f3fffc6
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5eg:N8RFEL8XVav9MkTQfOK5eg
TLSH
T100158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 882KB
SHA256 afbbe62ca192f83be705725b5fef8b8caa1e667c47475d4d0a0fc5f4f9ac523b
MD5 c986423b6496ac9baa3890a3acc7a8c6
SHA1 f99b16402260df946e5bfcbea2a6dca87140973d
SHA512 826ec07ed42659e2e0c9cb8eacc3b13ce64def00b28c11f31f57293b0fa3af8f5ba44517a1c5b51a0f6fd5b54aa4027c0cc32079c09619d8d02ea46529676dde
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5RI:N8RFEL8XVav9MkTQfOK5RI
TLSH
T185158D13AE6898F2E57A4AB94B7186059F357E210700D7C7A3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 882KB
SHA256 fe017850e6e25bc7782f13322bd78a77405abd92826b1ddb9b05436b84eb1022
MD5 774552901219c2c0ff6497d4e8ce627f
SHA1 3e5966b73d1358cbcbdb0ea088fb72d2e629554a
SHA512 37e43590af1af62044f054811acd08ccb3990a8196603f90f55172f0fad729ff82ae28be230b97cbcafbf6f57e9668ca735aebb04b0f22561a5f5422478d3332
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5To:N8RFEL8XVav9MkTQfOK5To
TLSH
T112158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 882KB
SHA256 081ac307fd9953f06935cc23168ee243b355e7a9f3084f4584a0d4003916ef08
MD5 4ff3f9ac0c6d1b5c352d25d1fbb65013
SHA1 279bef5e391e66f95e5ebfbf32858cc8addef5ed
SHA512 13d9d135df23ce2a7d40b24de0b875874128e08a663103975e5c39b5ad72cb1c31a9368d05909fb7406d5699ce74d48f39920bfc4c398acba28ae7ca7823dd35
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5Y+:N8RFEL8XVav9MkTQfOK5Y+
TLSH
T1A5158D13AE6898F2E57A4AB95B7186049F357E210700D7C7A3B4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 882KB
SHA256 8129ea8d4dd8e71d0f1aa4d852c78b5cbfa1c3ca2cd2e32cef1318f7c1be0eb3
MD5 72e95d36aa97094f03d7ac8503906a90
SHA1 ff5509fe84bfc520b10bd4c2d45f34df5bf31316
SHA512 d16e3636a7ea40c133b7d8bfd70c288239c3902cfbb11bab05cb6c9b0e7239803b94d9ca550e62d373e9f1c2aeebc3c04ac31ae25d67337cba19cdc32fc5eece
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5wQ:N8RFEL8XVav9MkTQfOK5wQ
TLSH
T124158D13AE6898F2E57A4AB95B7186049F357E210700D7C7A3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 882KB
SHA256 26857883d83a0336b72772e5cc49068daaa3a3a5f8b6a3bf2be389e9ddf952fe
MD5 0c9416465b69b16429dfca1ccfd39a81
SHA1 f7541a9f4f0470d800f0e7d3c04eda441fc60716
SHA512 e3f6b765b571a72643ae85a05f72ad28e47093aac59631ce44197237a93f0d23164e6517c2024e6974fdd776e9b87f2e4c82f93e5f533c1a1911ab841a1c889e
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5ZX:N8RFEL8XVav9MkTQfOK5ZX
TLSH
T184158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 882KB
SHA256 6cf45c3822a44904511f6b09678eea28eac2dbfb6061439bb9db0cfe7385299e
MD5 254827a2e71e01d550933bc88d84f387
SHA1 f72db7f2a437ca20c0f2c8fd39734452714b65d0
SHA512 bbc005ac5c84dde9f32173fbd96b3f43753997a338afbe39b9c5f4fbf100762fd3a66eb9e74a71f4a77e7b7cad37f2045d092c3a7abe192c40d8cedb6e39f6ae
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5zL:N8RFEL8XVav9MkTQfOK5zL
TLSH
T106158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 882KB
SHA256 96ed27aac11b8a1d6657833cc7e64ffe62b9bb7a841a70c72a2ab661216de7b6
MD5 ef91a52b9c6fd8c69e4c1864354fcd85
SHA1 36dc35e6fdf40a89ceed01bc09a3e54e91980b2d
SHA512 32d4d4e00f10ddc928c922787b339208d59d39816b68caed2fe2a25c5ba6648438339197dfb2c12684ae50cc7022c57536320d31d3a7e63a33822bfd2b3db3f6
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5ZFC:N8RFEL8XVav9MkTQfOK5ZM
TLSH
T11B158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 882KB
SHA256 981fe3645ed3749586f2ed264e5dc5a29744bb72d56edc7f83abc365b9c5bca0
MD5 fd3993097fef9a2b3c0c6be5004256d2
SHA1 8a1d33ee9cbf83e80b696950757c02156267feae
SHA512 551633555438ac5b02fa565a657a2963ad7cf0c35332541328e12a8c42725b53ffb361e78a1509c3da6d904af7da6ce065df900513183a226a07d5de5962350d
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK5ih:N8RFEL8XVav9MkTQfOK5ih
TLSH
T1FE158D13AE6898F2E57A4AB95B7186049F357E210700D7C7E3A4B79D8D333C09E3E625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
Size 938KB
SHA256 d987dab360d141acddc96bdea2cf2f49c3e4417b167d1de70fa4d8f32e955477
MD5 ce33bc2a65b44998db6663c37e8bbfb7
SHA1 0bcf8032046507265089456db493bb3667bf11c7
SHA512 8c3e5d32adffd7dea06e2049235a2747d9adbc62ab653525d2bd599adec5fa8785644510f574de035c0c337dd1f4a3b2147799038ae34442d39aa99e3990ac4e
SSDEEP 12288:N880N2YFShlwU/4YLeVX86avEF8JMkKOj0bidyzNJbT7SpK54F:N8RFEL8XVav9MkTQfOK54F
TLSH
T1D2159E13EA6899E2D6BA05788E65C7046F357E610B00D7D793B4B7ADCD333C0AE39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-1-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/2776-24-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/2776-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4288-25-0x0000000002040000-0x0000000002050000-memory.dmp

Download

memory/4288-10-0x0000000002040000-0x0000000002050000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads