603de619cab3c7ed5c539d50444da2ba8fb28e6c7dcd843d236486ace7b9acd9

Analysis

max time kernel
106s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260804-xaamdaxerd
SHA256 603de619cab3c7ed5c539d50444da2ba8fb28e6c7dcd843d236486ace7b9acd9
MD5 b6017c85b1c494366f0a3cc54a09ae4a
SHA1 03928f45ae71ec596fceaffd615d7574b722363e
SHA512 3eac4b7376538645a04f4618518d32b25855ddfc482959efc09d36d93d6104be4f9953f2b04ca35a580be85f71dc1f0d31e7ffb77b9d03fa735d87f5df4304d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yC:A3k03kB56rC
TLSH
T116157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2300-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c523-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2300-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/940-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-650.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-805.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c523-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-491.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-650.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-805.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1087.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1205.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
940	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2300	2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
940	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b6017c85b1c494366f0a3cc54a09ae4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2300

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 603de619cab3c7ed5c539d50444da2ba8fb28e6c7dcd843d236486ace7b9acd9
MD5 b6017c85b1c494366f0a3cc54a09ae4a
SHA1 03928f45ae71ec596fceaffd615d7574b722363e
SHA512 3eac4b7376538645a04f4618518d32b25855ddfc482959efc09d36d93d6104be4f9953f2b04ca35a580be85f71dc1f0d31e7ffb77b9d03fa735d87f5df4304d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yC:A3k03kB56rC
TLSH
T116157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f718b7d35afb0aa2f484a4916f2540f5a7ecea65e45041f89a89cdd4e4cfde12
MD5 a78529b83050b2c0ee5fbab5334c65ab
SHA1 ff7d5d358fda8e0effd88c1b906e8f36a4b442fd
SHA512 79ae172cfe27baa1364fcc2a32af3c08ee0e30681d88d014b9af58ac3d214ce141dd2109ceb23b05f884addda06ffd02570b749a8884d24b790635b77ef226e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yC0Le5ji0hmxNrM:A3k03kB56rCPji0Aj
TLSH
T14B654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 80f039274d42687f203f52b4aab66bc9cd3162b91ee2c3cf303a0556d92f0408
MD5 42852afef5d18f233fa2cfd719ed5398
SHA1 001fe0be39762542fea9c9c597634cbffa01112d
SHA512 632b2e530b4f2d1e8f965e28414789540f0b1f992c07380aedb41077dfe19a814d27a0bd620151ac70511570a88318b42c4cffb160e3fcff56be6b5c9a9aca79
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yMa:A3k03kB56r
TLSH
T1E2157B03E6940FA4D10FC1749A964662EA777C025F2097DF2358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 7b20f944ec0eca5a60d350f5c0c010bed52e6b26bc0def49b1bbb7f2532e40d7
MD5 18b75dc6a329ed26ca88cd6cf39bcda2
SHA1 43c6ff044599e776b60be44ea9f702374af5f99d
SHA512 7ac081caa0f8755104a6c1fac70f6ecfaa0fef1ca20671cdc8df3a5a2d6f6ade9962953af12775592c06968377174d2a14ce2ba38a53da79d634377a78dbf4f0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yl6:A3k03kB56rs
TLSH
T193157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 1ecd8a9a86862045f9fbbf30c7d969810adb6363bba859c4163c0ec9e6a429ba
MD5 efe805d9945c890f89d26a6454052274
SHA1 3fef0b5f5973be0832257a5b22d084c397b1841f
SHA512 e57d6efc276abda409b264870c5d6f03cc8cc0629b8605947d00b98fd4d1300769ace2afcd5d15a84f057e8858f6dffc201fe391222e8de34857ffc0fb1562d9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y7N:A3k03kB56rR
TLSH
T1C6157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 f86830c7f91a2220ab542b778a9c19e8bf2edf68184e8810f532a2ab4f2196ba
MD5 d4bddd6e883b671726edafbf87316f8f
SHA1 fef2a7cfeaad4af8af95aa888dbebc9c78d107da
SHA512 2796b4994177535c94b37a6d5549bf99d26c346589d0aa7b671a5bed094d2e169a7b783f4ff94fd7fcf4c7d80025d18a675d4d8541c7e77329923ea6d2fb019d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yZf:A3k03kB56rR
TLSH
T174157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 a9e5e8e8fbec907277a78916d66faa829a2d7a38f8f166aa45a99fd397b8459c
MD5 f8aec9ed674b4ccd00cea1c400daba3e
SHA1 2fa06f383fa1871bb6cbeead31ac9b344350da40
SHA512 4e436734cc4acbfc997465be79e52cb16031246fc7628709b6a769559de829517b42212d4f68103ffa0c8e4498510c3f0d1b503c930f9a3c30d9f25b8a33c0a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5ybo:A3k03kB56rk
TLSH
T10B157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 3b412936e1f2a0ae1b02b7f65988cb3530896811aca7421c6f5dc3bc036f1f3a
MD5 00ec759c79239a4830e0c3c0ecc44de6
SHA1 5fc17bf0b619caa7f17e34725308e0bc2bf1c10b
SHA512 2daedccdfd1e6f20bf0abf0c3c8ce2a80f710439c9dbf374580ea11aaed7e04a0a9db3cd2248eebeb569b65868fd5d227d00392766fabbb3ea1de66c23a11094
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yPu:A3k03kB56rW
TLSH
T147157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 9e05709012d51116329dbf94790612d3a976d73e0310d7c24e985ea52610f4a4
MD5 d56e250fce4fb54847792ef28de08b19
SHA1 2998f253e2d23029ba2932ce9c4eaa4c630e05b6
SHA512 08ee8b9d369144bddf3436b52daba9a06d1dfe2a9f1d692aa5bb1ea919d92ab8b957ba6e827e2770ef63261fb009256be60ec7e8c6d77de237db2cdd5a43230f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yd9:A3k03kB56r3
TLSH
T164157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 478b447a8461fdf55455ddf61e3732c3c5946d9715520077d3ad4c0fc40a280d
MD5 508e9fccc8a6a035ec3008868947c027
SHA1 f0c3347b98da2678c62a06be402ab1c635ea5719
SHA512 18533347bf3e0ecb6fa27d4a933a1956ed3753d9fd39be0a04927bdced2cd0967b0ae809220b1ff2fc00eff2033ed71d635f45a24ffc7cd81d23f40e4a9a2385
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y5c:A3k03kB56rG
TLSH
T1C9157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 29ad0542b43f591b21d8929710d48a3e71c82479631d39b5adedc0abfbee6267
MD5 0f097cc3c2b72b237f26e89ee609ed81
SHA1 dcc0bdd76bdcbdb0cb9cb71330488aa1db6e3ada
SHA512 2a620208a6114a2a67a8de197f56658b406abedaebce96732d07fe66f083e0e4079cb665bd8d4d526722b30a48418cb730f067a5e4c69a27e32ce0a22636bf97
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yyp:A3k03kB56rU
TLSH
T159157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 fd1f537209b82849fa29a2fb0ad306d5b926138201556f0cc9b4ee2f0d7e2b9f
MD5 9fddb9677ea924d08d8a9fe23ff06c7b
SHA1 e7cea4f3546885f4c58c630b4ac6583c09c2543a
SHA512 f7f1343d438ec147a7e15c6721f2da9134a5d995f976382a5f5ed34f6c4481386957a920b6dc20940d90c2c2d46306a2fbc2e99fff3a7066f674da931b99bf6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yFN:A3k03kB56rj
TLSH
T128157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 fa4829d2d1a4e64742c2f5215a4b241258bc458c79a1e77e48434084fdf7311c
MD5 60233fdae010757e51e85256d0fd04e2
SHA1 873d8f99f5ecfda7c4b3116f764dd9897a4bb669
SHA512 08600119bab48d995b0a59cf8f65a4169a0c73d2646b3235411769a9546ba2c83f4a84401adbc1c8c5a4ebbea265e78fe9f7f5e3ec65f245df7ff90ed3dafe63
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yXF:A3k03kB56r1
TLSH
T112157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 a0cacbfbb29a52527b94af036c21df50cb120e50d01c3e9f42797c9024dd8353
MD5 ec2d29f3a780bf4f25d3e8ca237311fb
SHA1 92e75b05599e4236a089fa61d2e9cec4ad731a49
SHA512 c3a81a24e2b4adf8ad115693aabcf1c85abe9fb7b641ddab7e9787a0d175316deed3243b24ec3ef7d8a49cb29846d6f6e69150a1ee07a776bf4e1de533e9892f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yoC:A3k03kB56rZ
TLSH
T17B157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 8dcb34a3b073610aefa16f399aad51118f9c545c95d3f36de3dea1e214c4d9fd
MD5 dd008cb107ca0f46729234be98034da3
SHA1 da9e89c2aa790520235eed967cb3617fe70a4ecb
SHA512 51f5e8c84526ec52186b959e3d82b26c462c9ac67c5d27cd4e5ac0f0ab6bf58ff0dabd2349597035fb241a7c134d1e3608167bb0bba60caacbc372b8285066c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y7w:A3k03kB56rE
TLSH
T165157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 d0b8e9fc6e742d58c0b0c25a448e3fdf696042ff65b651d4742fb1f1826b7048
MD5 2c1a94ee18c05e35ae80b9ef8488f864
SHA1 0a475c1d022711de55683f1f08f842c998f729bc
SHA512 c424632685eb91c1213a1022bf1dcc6df8fafd5b7c9102d1663e77bc3db78c192fb18b97506c18ec784b80d7243fb1e04670d44a7ccf9381afbdbf88d5d2de8d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yCT:A3k03kB56rs
TLSH
T1E9157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 6b0983e7dce963cd98212f8cd7eec12af516bccf3cd7b14ad14a550d204dcc59
MD5 93177fc817e1e9ce5d7ffc64b868d9f5
SHA1 f4f8017a58acf0d85547350fa5646eae24ec089e
SHA512 115026c577f64c10bcb6a3df2f9773f879d07a28077f3ab1a0d34364794b50dac5f91625237e101404f27f8ba9bd9be9cf6783a4cb43e9b26fafe29a15230db2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5ySu:A3k03kB56rL
TLSH
T117157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 0f36bdf04ca4832727211c6eed6906e724bf3cf48386f45df3a6b9d723aa3459
MD5 3b9abe6b5fe5d41d27aeb69f79744c0d
SHA1 55c97ae73148def1588954ab8500ac889f504b1c
SHA512 5cf6623cfad4ecbb7d16ff2ccae7bbd685277cb1ef7f72ba902e0474209da14767c41db609794c011e37429db3b123866888efc2772a041be021f130258f4a22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yMb:A3k03kB56ri
TLSH
T148157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 7ac5211cc1967370c9b1357f9ff545b00bdcfd0d52eab9d047262dafb45fb10f
MD5 1e08c57540b304166a966bbd1c2ea2cd
SHA1 79e47fca157bbda2395ec3fe79a7c5854f21bb16
SHA512 81f7fc9415c2e76dfcbe0dbeeb033e2d89d535272b601cf38520be55c161225e2d9ad171169d5f31889ec741d446e024ea5b15ded81b0aa2c058b3b2954d318f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yyf:A3k03kB56rC
TLSH
T1E9157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 933483f2fa7c7111ec058bddd51c6b0c5e2b3f7f719f2a8177ac9aeea1993736
MD5 5f16c2c0b7901cc40e34f2b4facf8fab
SHA1 a855cff311eaf76b21f7eb89d63a8fe9c2788938
SHA512 2187c034ba3ce1e7c8d2dd90f39b0aad91518325b47cac8bc0e6836f1297e0360c9015e23cd9ae7cac669ef5f9df6fe578a061f420769988fe4c82b66a015f8f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yfK:A3k03kB56ri
TLSH
T1C2157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 087565f6b087e544572b8aadb8da2749fe816efd933712383056d1ca1933016b
MD5 a402d829b28e9c27f92d1ce7132c84aa
SHA1 2ea8cb7b662b00374220b72c5fd38185021f6533
SHA512 09c469d2443d6237efb1b84179eb756ec9605e8f51e3b4e00e8e9e5cd05b7525d9222a4fbebc650e63d615c36bb4c5d39d4f1a6b11846ea721dc4dc4efd1c7fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y4k:A3k03kB56r3
TLSH
T117157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 7f99c8b2dcd4464f0ee5b24e7390a4fe60c6cdbdd72c122c53e899164cfcea7b
MD5 a081947b9f9a39221fd84fc5d7888906
SHA1 e4e416757bc2c6723951539350a8545665f8f0fa
SHA512 4220fa3d22925f248f2d0d696b8de14907ad4e538685c865e5d4c245d5c5e4abff6964e070c122b861d520315266e85e04c03395e50e6d2893d24e3a2c085a59
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y50:A3k03kB56rW
TLSH
T16F157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 061122c8463cc9bc8fb1165620f8a1f239a8f8d26278a14fac77cbbc5bbd3516
MD5 0785edd43926c0bf885fd96944b7db53
SHA1 e868feadcd42de0a4eb94aa2f55699cad99a4a49
SHA512 737a46a16732aca15291e6ea99534271a13409da9faa19ec148d5c6b5d2118f7b44fd49b4b336af3775b8ee9ef6d5cc869479ae2065ee3047d16160d95675d8c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5ysg:A3k03kB56rv
TLSH
T172157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 82ad6b413e28440bdb9471f7c3e65a60988c904c5966fab3c961f6ca7d2b254a
MD5 b3e75d61dc9dad543aef910874a46ef6
SHA1 cd83711acecd8f2b6de89358a9b233cae13b14ce
SHA512 23009dc1a50aacc62c4724e92ced6fa0e0169a7e24a2a3fa54977bec3fa79cbece4a9e8841ec22ff6640e4298ced17beceed646a6864b8f082c33a1a7a3fdfd9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yJr:A3k03kB56rJ
TLSH
T123157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 b79a3f780e1db40f5f81ecc69584953ba8197a696add444d72798ff9702433f2
MD5 842eef108464118246f6f1e4ce227c56
SHA1 fc5543398f0cb8ff3df93769098999d5564403c4
SHA512 2fb87ec9e0e2f1208387a93db0ebb04d1db66dea791beadbd3f67147d9d72e97b0b38a876b4ffb4108e2468baedc13a62394c93b2daa10bbdf7f3adc39380f07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yrn:A3k03kB56rj
TLSH
T1BA157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 d728311a4b0da31d9bcad2704bb38dc727cdd5826d3450df98575f5e8c1bf929
MD5 b8ce9d3801c69b53d787326862076733
SHA1 0f2d554953e61466ba9ea7d90d360ff63085f4e8
SHA512 bd893897ba17e961217537bfea30c9cfca302378f0a4f7be12ebc3cd7c35ff3985a7860de2cb3f811050ce837650992d2890775d4f32a9c281e64f307e461022
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y3x:A3k03kB56rB
TLSH
T1CC157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 8bee288b3d6537adbc961802091ea90190e1ba793917e64d3de0b60d4ad57e03
MD5 a2bfb4dae5c92fb2858b4537499a3026
SHA1 409542d762b9f0915eb78d00acc7ebd68f5ad68a
SHA512 6c61fbcd171d8da7566ae382b7e9da42ceb07e750447dc702c09dafc212b17a6ef9c0efb3b82cedbdb083a1b38fa71555b874d5270953957f6ab241de301561a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5ytA:A3k03kB56ru
TLSH
T1BB157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 82f5f1d917dd072bbb8d86484807f192e38a523b238391604236d46be48c7491
MD5 57fbe0e43c50d95a3b0e411b98bb14a5
SHA1 5ed26291dbde005195a6c4431e907c9c1dc53e34
SHA512 a7d50549908ab885a527f9e5bb4e854bf90e969ee8ae490591ae89f301f8d398cf95b0b2f730e806464eac461532989db83b3bb1aefe72b28f536bb9d611a948
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5ym9Q:A3k03kB56rz
TLSH
T17F157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 6fc72f0a12bfad6b8bc14156291c53f7a9e13dcbfbae890245033b289685fdd0
MD5 96aeb9c7205f299b4dd2e5006f39ee5b
SHA1 beadb2d59b04f2b5820b921d48c16caa6807d9da
SHA512 d2ad3b54ad6368d8d59f0ac5861d68dd58ec5283b9c4943bf8eed8b660d851e6285e3b536b2c73913c712e98691e6f78eac8216df94314e03462fd69e6e04269
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yD4:A3k03kB56r0
TLSH
T1C4157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 f8ba92e70c12e1b87752c9f6d6c92d57ceaa3ae2aeb7e733ad22011c3be9ba71
MD5 a99aa090c521ed2ece5e8f71e17ef3a2
SHA1 3246f6dab544a627490f5040cb41d83c6333a5f3
SHA512 6630afbfba6d64b1c66a52248e38984bc2ac53a64ea1349e7780cf90002a356dc25e35fd470f2c727365331ccbc9e8bc94b93f8f7681a25f5398d7026a42169a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yqu:A3k03kB56rl
TLSH
T109157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 59188715918289720a6887f439111e0c2f2b84412f504fd3d10305a27aaa3c19
MD5 69c1d2c4e9728678fb3ff4b5ed3bacd9
SHA1 796a845a773260e9be84e194e5dc472fdd5b55d2
SHA512 4c547071412deb80f4d0effa596d855a8dcd8005c645c53240d1db4cd12853b27c1c8e669f27ac46ec1d9fe32e2c904061802d36d5117991a7a27d01470f8b25
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y7j:A3k03kB56rn
TLSH
T1AF157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 b924c2f4893f5f88180be7a577becc75308080e7bce922784c1bae4eab3356e8
MD5 cf22c999f2b76d0203bf21cf18572077
SHA1 afb7c05e9602f9b21a04e46afb3183534b5e5915
SHA512 ca0b214fc67f083132c290bc8685bef18afe8145481486695cb1984f744fbdd35437a55671bb2f55344edbb5f8e81e715e35ae0f6f3df6bbfd18d43bee6435c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yGg:A3k03kB56rP
TLSH
T1E3157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 2c1a41359e67a4a0c4469904edf276bca6aecc06cfc3facf9f96066ba351e77f
MD5 fd0b9ff3792a19146b23add72adaf30b
SHA1 5ef1456170d61dddb6dbad25f23fe814ca9eb022
SHA512 756f64931922f0250c64fbd945f4fc48ff42c0f2eef50eb553e571266382b60fb4507052ffcca9e420f7f4c8657d18e9df97806642faff933210299e210091b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5ypI:A3k03kB56re
TLSH
T105157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 d1b7a8136ef12825d6e8a17cc8c35ee750aeaec69dc954a9a9521806248026e5
MD5 2d95b5d5aea7c8a5255123af0eb6d565
SHA1 ce007bdf10aa174c7c4e3c07449bb389593d6e2e
SHA512 0bdb3c571f58c04aedb75acec548af74ac1bcaf4676a4c80ad573132c1e24446b07307590a21271f6e8fb0baa71d8751d9e7f21745c57587292ec4aed0ae72aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yLo:A3k03kB56rc
TLSH
T1C2157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 753bd7dee3e21434e513e865abceadc22faba52893641d3d25aaab8968d87885
MD5 0d7996d1604c6b1380c3eadbf64c3964
SHA1 b8f0d754bcd50c7092e37700d2ed9bbf957909f2
SHA512 eb0f8cc737ebf1b0317b996beedbe8dd6aabcf728d1d9a984351be6d24085cd1e01c19dfe69a9c4aeb827a8dfee33b944a0a3b6b4a69f8308cd5bf55d6c3e748
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yw+:A3k03kB56rR
TLSH
T1C3157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 a72599f373f81c2927eaf3491d1ef35697479973cf62a7e6539b3ce3eb543aed
MD5 c5d0cda640b56de3e8df41680a45dd5e
SHA1 67df926401c2c0f5a8318721f670305d7e50a83e
SHA512 e0b836e04be753b608252456d31313fa42b78ef9f9cdceee9f0d2e832214ea598a0f5a0599bbd6ad7193c5fe56f6b7930fe2d1e00ebb3d4f428197cded8af4ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yIQ:A3k03kB56rR
TLSH
T11C157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 8f7ed5f5a3f51309e84651311dd4a86699327a28981ba8336d7e17f21f626aff
MD5 004723b22b53efae5f4b362cbf22f9ef
SHA1 4edb82d6baa4fb957ad23dbbc995c3a5da64e9b1
SHA512 80e9219f676a9b6edf422aafa7bc2d7e4609978007f6f5eaac800db9e50e7a796d6a5f9c1a8e719d56f9449eb086001e043e3a0d48dded60d9a6148d2516c843
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yBX:A3k03kB56rd
TLSH
T1EB157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 b29d42ad5d7d2e19ad735348ecf79cf800db7755fbf02f403629f7cbe85efa01
MD5 2591d95ff6682b58d82068b3fbcdfb03
SHA1 9e49df5037f9c0053e0a70662d60fddc88e866cd
SHA512 72d667dfb11348d51afd33e314b5d71c2759962e0429c5f13cc8e5006d5e072bc42d753996c86cc4b299ac69b02c6ae2f1cbe9bada1bcecc554ba1e815e9aa6a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5y7L:A3k03kB56rf
TLSH
T1B6157B13E6940FA4D10FC1749A968662EA777C025F6093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 cb48ab639fb8896e1f59f6b6694e16da7673015a17e342bc88d63e6ded498471
MD5 5b23bd28463bef187eac0840cb3f8872
SHA1 aa0dc6bf39fb8ba6de29a0111f6b7fe884d0ab6f
SHA512 584fa9ff6cbb5f94be416566c4b9747eb5cbcd738ba954afa5f8fb76adcd64ecd498be21263e406f236390c07ea24a34fac555ec593a8cfa15c6c3561393dbe4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yBM:A3k03kB56rq
TLSH
T1C1157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 e7a1a27e162c4fa2713daa131042477126dee3c99f479de581a6f87e8d98ec7e
MD5 611762e61d9a2856ec2a9a16376aa5ff
SHA1 41e88a2f0ebf2161eee925aee44c5ec4f60c635f
SHA512 05de72ce1b97c6237f55dc5ab64521c6923db3027e7d717cd9d67838e6e81d19c6ad69b9f1455834a12b074905505439a6a78c385f0831c11ea02662b6fadc33
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5yqh:A3k03kB56rk
TLSH
T128157B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2300-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2300-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads