c0a61b63bcd2a4ecfee59f5fb2ac1a6813817df604869b338be28ba8012fef5b

Analysis

max time kernel
116s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 754KB
Sample260807-s6y8ds1whw
SHA256 c0a61b63bcd2a4ecfee59f5fb2ac1a6813817df604869b338be28ba8012fef5b
MD5 91af63326b6ca2e6617858378313bbe8
SHA1 f475bc8ea7a9333437e859ba471abd8fccf41d4d
SHA512 192200f950c40f3690fa7ff4a5b3c7310d4acdf27677c0d0944789db2179c801cf53bfeaa7d60a3dcf0d4652554fa1a18fe40710d338c9737fcdabbe33ca50c1
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE6:qCewdx5tul2Mf0nkxqatgl8bCaiE6
TLSH
T1DCF47D52BB8180B3D55702318CA763A7ABB9B8521F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 51 IoCs

resource	yara_rule
behavioral2/memory/3108-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4fe-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3108-15-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2152-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bb0d-191.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018975-246.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018977-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018979-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a56-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-711.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-779.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-847.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-940.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-959.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1014.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1070.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1408.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1410.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1411.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1412.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 48 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4fe-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x000200000001bb0d-191.dat	aspack_v212_v242
behavioral2/files/0x0005000000018975-246.dat	aspack_v212_v242
behavioral2/files/0x0004000000018977-265.dat	aspack_v212_v242
behavioral2/files/0x0004000000018979-446.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a56-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-632.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-711.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-742.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-779.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-847.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-860.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-879.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-899.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-913.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-940.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-959.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1014.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1070.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1107.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1190.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1363.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1405.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1407.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1408.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1409.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1410.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1411.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1412.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2152	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3108	2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
2152	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_91af63326b6ca2e6617858378313bbe8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3108

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 754KB
SHA256 c0a61b63bcd2a4ecfee59f5fb2ac1a6813817df604869b338be28ba8012fef5b
MD5 91af63326b6ca2e6617858378313bbe8
SHA1 f475bc8ea7a9333437e859ba471abd8fccf41d4d
SHA512 192200f950c40f3690fa7ff4a5b3c7310d4acdf27677c0d0944789db2179c801cf53bfeaa7d60a3dcf0d4652554fa1a18fe40710d338c9737fcdabbe33ca50c1
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE6:qCewdx5tul2Mf0nkxqatgl8bCaiE6
TLSH
T1DCF47D52BB8180B3D55702318CA763A7ABB9B8521F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 d060a550fe2f4bb8c883ab3bfe681a17c1bfe823c43d058d84ed634e047d5cb4
MD5 b94c9b29d2545a6941001d251c06a400
SHA1 579bde127002494468e73974199c522f75fc51d1
SHA512 2c0546a06d9ed481c1a0b4d3623caa671ac02e20e528f8d817aa94324efa77b0f4c0aa34cec16490cbf92d66fbb6a6915f25a1be0303da86efd54666edd04318
SSDEEP 24576:qCewdx5tul2Mf0nkxqatgl8bCaiEK0Le5ji0hmxNrM:QgE2Mf3qatgl3Pji0Aj
TLSH
T15E556B56FAA48272D0738175C8E3A79AEEB174421B3186CB1399937C2F737D19636332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 769KB
SHA256 708ffae439124f82beea2d3841a66696677baf721b77710ab7212d9c5f0afd14
MD5 5facf6bd650213e65a85b1d928bf5ec9
SHA1 ed667dfb324abeae0bb8f6a3721bec6c434f2642
SHA512 2e4771f6a2a8922d940c37eac34791428ff5770a695bc394d4b6d6b905a923965008cba420d4dd8ab213520c252ae93f2e9b424fbc37b015cdd814394002ad33
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEEa:qCewdx5tul2Mf0nkxqatgl8bCaiEEa
TLSH
T1FFF47D52BB8580B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 802KB
SHA256 c34d45d7ed87714c98f034c337dc7d836a99ae495ddd47a7d14428f46e3724dd
MD5 f329d88edb39400cc8ad01c3de370959
SHA1 49445adc00e6df01754bfcaf7cb9e78e50f4cdaa
SHA512 d6418aacf25c119d778202d6158fa147b7f0ec0b4964a670a8a69a7b55f858c9b1b0b52ceb68427da6f0ecc661a5e0f9bb8810564294dbce4c792cedddb0b37b
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEPb:qCewdx5tul2Mf0nkxqatgl8bCaiEPb
TLSH
T165056C52BB8480B3D55703318CA763A76BB9B9521F22934B2398536D5F733C0BB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 778KB
SHA256 a6f1cf1dfa3cdd33d6139fd4d7b0ebf9f37b9f90b822460ebb74fa9fd6164b7f
MD5 9e22233504b8f6d2a2730394298986aa
SHA1 309330965df4efb81ee98fe00594123d79d37cdf
SHA512 30842d02fa9b3011adb0f3d5771d28862a03e3694c814df26f1b12a286f908c00b6f7b91c5677038ecdcaa0a56d6755a024fbb525b59402b80edd2430169b0a9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE3s:qCewdx5tul2Mf0nkxqatgl8bCaiE3s
TLSH
T1C6057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 798KB
SHA256 240c8c6fca984bc82d34ae2d10637100092304404197ea00c2c73e830fd63366
MD5 567a815dbb21f3a8187b1467c60bf82e
SHA1 56623963c5629246e1de9b11ef94fc7fdf2d88de
SHA512 3ac8ddbfa3ba590a884006f9680cb3dbcb4738239f25e8a7a0f6fad058cbf41f5a486c34dafa939bc29b0bddbae216ce53e2c7cef3cdcfc3fd00b1503736c94f
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE4Vc:qCewdx5tul2Mf0nkxqatgl8bCaiEV
TLSH
T1FB057D52BB8580B3D55702318CA763A7ABB9B8521F21934F2398536D5F733C0BB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 778KB
SHA256 c78e89d377a9e44727ca5591186b54988748e584505f0d5a76b9d68d43ae0591
MD5 150c928d4098406c76d7b4f7dbaec7cc
SHA1 32979f535733debb93eeb4064be84fe37dbe705b
SHA512 b5f453586042cd14818f5caae30b3df2e7739dd4176558c657ab546765e8af54d906bf1ac19cf155ce5dc901a2e96282a016ce468a61c495ab5ceb5c26371203
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEeZ:qCewdx5tul2Mf0nkxqatgl8bCaiEeZ
TLSH
T115057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 778KB
SHA256 52d40f0372409541e34ea651e8afd8ae9d75530fdc9dbccbca9dfc30f408db05
MD5 61d1d8a147c78aa6a6a1962093b65ae5
SHA1 c695db11a413ff780805480825a134591548cead
SHA512 3f6e91c5e6583cca9d98f9435fc412d037aec1425d723142aa5dde8a54e8d311c5112896c3ae674f59ca710a04321c017ccaedb2ed5269eb1576988b60ffc264
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE51:qCewdx5tul2Mf0nkxqatgl8bCaiE51
TLSH
T125057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 778KB
SHA256 ebc4b02482ff0cb35f813a8e5748feeb3ab916c1f43853692b105d0024597f33
MD5 267136f0bace76919442aa7f9234e5b3
SHA1 c91d80a7618f1e5e653afacb819f931bd07f872f
SHA512 531e32f17c3510e65f6cc5223c1637806598a6dc1066470a8369557b75c4f863aa557bee0347c8c89b5234ac97d75909b538975066558bb7111955bdf92a94f9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE96:qCewdx5tul2Mf0nkxqatgl8bCaiE96
TLSH
T1CD057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 778KB
SHA256 b1f7fb5cd9a2d4050d4df5562f85439f0251560940229995bde2157f6a9e8b29
MD5 b9e3e20e04b3cf9c40b29fc6cb7c068f
SHA1 7698c79e3979913920aff5a92d8d3c09a6559c9f
SHA512 a1eb65f06a27b50fde875950e284dcf60120393ef7c87c326ae2fcbca0cad35b70adac87d55d47ec2f8cf380895566b02bd9aa08f58056f27421122317266300
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiETN:qCewdx5tul2Mf0nkxqatgl8bCaiETN
TLSH
T19A057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 778KB
SHA256 6c4356e6df6bbb2b828d73a0ea57cf1b9a65669598738120dbeb68a5363d9347
MD5 e5d50578f468deb1f66f623749167165
SHA1 a6bc6db5cf007031afe245dfe078430904db3138
SHA512 9eb6acc9492f71b3c116cd2f6ad8edad22523254c291216d296c899c1f4d2d43710d1ca54cda9dd4a11ca2393d422b8dd85262cd379f1401152ea78fa5ba98ca
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEhf:qCewdx5tul2Mf0nkxqatgl8bCaiEhf
TLSH
T15F057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 916KB
SHA256 5c8467407018c7996454b205d7e8e5835ea2169c42c926012ad6ceaa84c1e432
MD5 14efe4480484eddbdddc250a1f077de9
SHA1 9464f1ddaf2f4f4cdb454dacfbfc921b4217458f
SHA512 737382b064127b0c3d8b2032bdbd9e13fc70268393341dde1f06dba7c715429979c5c04f9606af130ecfe15d325ebe5f1ef3637f0a4958199da4a66a594b4859
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiElyPz5L87:qCewdx5tul2Mf0nkxqatgl8bCaiEszy7
TLSH
T1EE157C53BB8180F2D16702318CA76796ABB5B8621F21934F2398536D5F733C0AF36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 778KB
SHA256 969711e222e1a2654c8e318cebaa6586f420b51a50024bbdcfb09e763cb824fb
MD5 d666884b4c59f1b1fe7598718a69014e
SHA1 b203c8c41fdca82368b4b26d921b6eef6c6ff5f2
SHA512 30ea9c9e3f3f66b7a3a46f2fcddf26056f7787c5158927b47c0ca2061d17e91e0cf1948f31845bf25f9d0ea111fa6c095cb4e8771b1ef1000ba66e0de83ff11e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEDo:qCewdx5tul2Mf0nkxqatgl8bCaiEDo
TLSH
T1A6057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 778KB
SHA256 e3f99e222cfdd4169375aca0a5cce1e21d7b47e03e2a66334b703d1dabc896a5
MD5 767a04b06bfe01c69e2a7868e6d65b94
SHA1 62f280994862ca06673de750b675ba4b45da0c3a
SHA512 663294609bf64f84f65c947e2842ae729c0d75ad4db9ed8308cc2fe758a6355d6962bbc553ed6a8b465b6f2a152abaf330d72b29847ec197f1941c5e601b1a48
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE3u:qCewdx5tul2Mf0nkxqatgl8bCaiE3u
TLSH
T117057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 916KB
SHA256 a3d9bbe3182dae3cff9231f6dd0e155f6c9131936ada0211749fcf27342bef9a
MD5 abddf296671642985f4c72258da45faa
SHA1 4659276ebbc0886cc74381749a5dd5bc876985f0
SHA512 01b42fbb38cec4e0ec5de366af44f6937ecc73ef9b6ca213ef42716aa96ca1635fd2afac2218a812f70ed82c448cf740c9ad0d9bb9d3d7f778851442e6775a44
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEkyPz5L88:qCewdx5tul2Mf0nkxqatgl8bCaiE9zy8
TLSH
T192157C53BB8180F2D16702318CA76796ABB5B8621F21934F2398536D5F733C0AF36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 778KB
SHA256 eb839f49e727bb0c118a2d93d38e2c63b9fb47d5a85c738744069dddd81a384f
MD5 66ec611874a4c1715f2f8e877a591d90
SHA1 756eaa2e4b0686e2dfac3e7fd8b74e809f58ec4b
SHA512 0e3fe559d0f45096cdfc672b343dd679b01e97fdd01dd768c805e5b6f8ede71fceb1e98c9e972ae7ba89868ba3176423c47333c7acf7713bb660aa9776c953dc
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEF9:qCewdx5tul2Mf0nkxqatgl8bCaiEF9
TLSH
T1D1057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 778KB
SHA256 9b807f2b2f8cc8e66d8c232af25e8ba28288211b3c36f883ba2179045c684c36
MD5 1bbc5a9723729ca39e37748b1ea25a1b
SHA1 b62440a8182d1318d8457534742604616839b1c3
SHA512 2c5b4f0c67112279c63139807269c697e8647646992c661271e12366d020b69e52a7b46492d38804e658b76f9883afcf604a840c4ce7d868af33d959f33e0329
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEhc:qCewdx5tul2Mf0nkxqatgl8bCaiEhc
TLSH
T1E7057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 778KB
SHA256 212d0fccf8af04937db1635e0c5768b957982bf0b2f7a6c4a7bdd4ce1a0bd46e
MD5 0cd85d5547a7d079c8af9fb9d8a40786
SHA1 c8831b556772a2818a9b59e138c13e138f1c8e21
SHA512 0f3ec14d485e1c450e34e686311de5ba76c92eccbe1774b61d382e594d532fb84bce277b22738e0a4d75060cbd799cadbb026392f62d0a190f1ec6150ead6e5c
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEKp:qCewdx5tul2Mf0nkxqatgl8bCaiEKp
TLSH
T126057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 778KB
SHA256 8693c64d8c61145d5ae16fc677aa9063ae9ba29813957c1dfa020c684100b145
MD5 6ecce1979f5ff13597732e6697f56e5c
SHA1 10851ff9459db3416c7e134da18a3a4437695080
SHA512 81ed074790c0dec982992dcf5686668d7c07a88469b8906a9ef43e1663431e114b94a94baa38554feaddb1b45d14076490226741e3580a92410c8ca11341a727
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEt0a:qCewdx5tul2Mf0nkxqatgl8bCaiEtN
TLSH
T186057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 778KB
SHA256 849d0901ebf2ffc802a65af3704ee49008d6a482c1bfba3f1f55ee5c1fae68a7
MD5 5349be081cd7b05da8808ea54dd9b63c
SHA1 408075881ffc2a7f7493c0e716a2f6ed7c66e2da
SHA512 d3836987f5d709ed5e1cb96eaec1b6b3ba1a3787b542eae8537a9f7dd5afc1c70a60042325bcd64aa771bd8729c2fa523716a66c01bd108e4b5225272ce7abc4
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEfF:qCewdx5tul2Mf0nkxqatgl8bCaiEfF
TLSH
T109057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 778KB
SHA256 1fbde6b15304ecde29e03c0906da6419e39adad7a83b83200e71598df3e04f5c
MD5 8c18706d0da4900cc4cb6cc1ffe878dd
SHA1 a09c82c9ce86e76a294ce11f7913acb33ffa5a80
SHA512 c5440be7c0a7c48107d45b5c7d2fd7c33b1dfe674125282fed3b4572672a3f25b89ac4372e4a7a78dd89e75ac127c30411771284224bc0a65e15053b8f82f713
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEAC:qCewdx5tul2Mf0nkxqatgl8bCaiEAC
TLSH
T10F057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 778KB
SHA256 e5fe4bf146148e2dad1235d2661019293df2ad8802e3ecf8349a2b3e0f64bd89
MD5 10c0caa4f28af851c01e67e2bc5d93f1
SHA1 be3a64cfd7cbfae3868fb1e1479c003fab508824
SHA512 415829ab46efbae6598d2209678eaf93a6f7d788332f4322470e7d7af8d94ffb4a80ba2ac5508b283a2eea097678f25549028909bb3e0a6bed0179c8531ef8fb
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiETw:qCewdx5tul2Mf0nkxqatgl8bCaiETw
TLSH
T1FB057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 778KB
SHA256 33dc542bcea0d3a9ead6f7d45bb24c91dcf5f9564dbbe9db91a361b07a8ed1b4
MD5 fde2f04667ecfa384d09a54304829b18
SHA1 091377778c730e471d3b499102923a74797c6303
SHA512 97ba60f16c4e82dc3b6d6635230a5f439f237fa37d0e3eec47bfe632dbd59bb3eb613d071fc33b819cf526d4aa0015b0079d17e8ed341f0ed31222ada4815e32
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEaT:qCewdx5tul2Mf0nkxqatgl8bCaiEaT
TLSH
T17F057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 778KB
SHA256 bba9e44171dcc81a374147bc4b9d208c97b9d60fa3969354783ce431f058b911
MD5 e30a57fbe7e9e0bdb0bcb3907fade2b1
SHA1 df527c66a2f7cae753fc42998cf4eff07581877e
SHA512 77f649fffa7f8860eab24f2e27db51d1881bb69421c8ddeefb8e8d5fc492e313deda581a0c918d04f9892768f303d809a6ff06410a29ef6f50e24d1461a7c9c2
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE6u:qCewdx5tul2Mf0nkxqatgl8bCaiE6u
TLSH
T120057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 778KB
SHA256 43563408a8c0ba25bc34b938726f28c86e0845b459e5ebeeaf199de3e985419c
MD5 38d0c7f793d6ae6e46a7bf2bfcd31ec6
SHA1 133e2761828879c4aec31f89f7be2b50ccb772e1
SHA512 848f33778b466b06a657f7dd95dabe0b6ef07dd83c45ad5dd84e575cc2399ff1dd0f1f6422560b8cc154f49eb90f9d355e2a9315afe942723d29e90778bd55e5
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEEb:qCewdx5tul2Mf0nkxqatgl8bCaiEEb
TLSH
T141057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 778KB
SHA256 6a1f988f44d7d0a1108b394e987a9a82136d0b3d173b4200380098f46c2c865b
MD5 6698103c50c9be1f872d0cc6f1dbf51b
SHA1 4733e198662d946ad52006ba36cd53d52200f644
SHA512 ed4ebcbb6c433253d60f62fc78839c297a9dffeef3275acd8282074bc613d5ac3f8414102541346d2527f9bbb042a7d08a6b7c3e43bdbebfad6912401d39ebfa
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEKf:qCewdx5tul2Mf0nkxqatgl8bCaiEKf
TLSH
T1B9057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 778KB
SHA256 1d1bcd9df3b710140e320dc454542240379d4a7f4d773d7dd168a4ab8e270a45
MD5 72b477f888eb96548ba6e00acbf47eb8
SHA1 375660fa7f0a57f73f6df0e7eb1c6f835780b7b1
SHA512 2683e13bd1e73c7060d72368e95168aa61ecfebd1b64c9fc51deff6f2c100ca52cb5be1d1df72f7169a572c48d01bf747d4e8a48716ef14c9a6524434ef1e414
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEXK:qCewdx5tul2Mf0nkxqatgl8bCaiEXK
TLSH
T1FE057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 778KB
SHA256 098a2162644d5a57f98d647de817975e713cf68cdeeee57e17fde34a7768b0f1
MD5 cc6b815b7eb44df9dca01a87714c5fa5
SHA1 a26015ef7d20eb4a3823526459a41876ca0e70c5
SHA512 b91b7c733afd3640bcce26552e08184c25f7f2aba16b78b92c89af7f3594c089d69f0d9d08329ce76b20496eb3874c865cac2b3222ce5d865cfb7bf754f49ee1
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEgk:qCewdx5tul2Mf0nkxqatgl8bCaiEgk
TLSH
T17D057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 778KB
SHA256 d50177a77b12abf688b9466a619acafc56741e4bb0137f086cf103c8e5a4aa87
MD5 5c5a3a0c997d37b1fb32c02fec682498
SHA1 d3e9e66f1ce7f118dc3007a0aaa0999abd1a410c
SHA512 4ff86f8e82410a1809b10e942b4e22e439709203247a866c3579dbef5d798a6a37a4696c75c0456f458f760d3a8a4932186c9ed1713473f7884a7253cd6f4cd2
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiER0:qCewdx5tul2Mf0nkxqatgl8bCaiER0
TLSH
T134057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 778KB
SHA256 fd2711b9c9c6a83412f2419f88735314b3b6c14c8eda6325e3b9f417256f87bf
MD5 ae3cd014225b8150ede8314b1fba5f41
SHA1 7760ee372003af207beeb5aec977e5e1ce8824a9
SHA512 4d8d8d77b21652e25592ae84a296c851c3e448bbc3589fe64bb4d1cdab88369549a455951919a18064177defcdb9f56c61cacac92d4565981d26e18fb7d10774
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEE70:qCewdx5tul2Mf0nkxqatgl8bCaiEEg
TLSH
T19A057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 778KB
SHA256 78125d17791da69deb8c7b9144286704de5fb5da917e8a5fe3bdd251f1dc823c
MD5 e39715868372679e5c4e4000b0fbb7fa
SHA1 40b73f845579febcef4ac900f69ca4be40709dca
SHA512 058dc5fd8cb84bde08e3825671bf8b5d58f5611a48e8c589824dc3c44564c770dbc05fc5828f40a6fbcca96d578f3b41de3f5a1f3960fe144baca1269424f9c8
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEhr:qCewdx5tul2Mf0nkxqatgl8bCaiEhr
TLSH
T173057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 778KB
SHA256 7f0ab367685733f75c1ba7499f23fca2c7b800155ce2b7d3bcc6d8067d8a968b
MD5 b4876f13a3b01d5ee985d119aa210689
SHA1 fa0e9649851e0333adbd6bf6cc9e45adbb2694c4
SHA512 5b4258fd285764e33c63bfda0c4cee84c0a93dfbb7b39d37bfdcc105a8816466880e485b0973e0653cd48e7760b9d82e8aa2fe1cab1f359410608d61ca641bcc
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEjn:qCewdx5tul2Mf0nkxqatgl8bCaiEjn
TLSH
T15C057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 778KB
SHA256 ef91ec801f10022cbe0b1c6921eb9a0adc51abb0aff80dba09352f6c10be2327
MD5 b1bca598b2b60150e896122abe38acf7
SHA1 55cfc3a59cf6da02e9c6db47767e0ea7c1c78427
SHA512 fbe795fa47163de59f01f00d07e6b57a222d840932b668e3d7a201a93ea5a7b4987f81aca7272e6deb66f91bac3aa7c67c5fe5b46834abb42f777bd663221458
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE/x:qCewdx5tul2Mf0nkxqatgl8bCaiE/x
TLSH
T17F057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 778KB
SHA256 a8a623cc9ed83c7995885326c223ee5e39fa9897b432852bddaf0df4599130cc
MD5 ddb233185cdd6269d12519c8d2d2388e
SHA1 230fccf67f425930acaeaeca657e19debb9637a7
SHA512 f9179507951e247ace68d15066910eb4033231319b8c2fb7d1bbd2cc3effaea1fa4f046ff9792d6a2aadbbf71479d55c49753e4cc675ae59490705ef8f4777a6
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiElA:qCewdx5tul2Mf0nkxqatgl8bCaiElA
TLSH
T1AE057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 778KB
SHA256 95add2c8133dc085a71bbd2728e5beee649fed31ea8924a6ca34abd9804e95ba
MD5 17f3e96a599e1171f865257596a5f7c4
SHA1 b1697c2c2f55b285983395feafb3c2a4fe36b10d
SHA512 4f6575d14400204e7562fcc64c05f0a0cd547e0c2ae423193a8e263108e610f9e40339a1a4c93755feb59ee5fe00d994ac484803be6676608695534fd1eab7c4
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEe9Q:qCewdx5tul2Mf0nkxqatgl8bCaiEe9Q
TLSH
T1A0057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 778KB
SHA256 5b776e8320d5713d26c55f008caa437da4e1750821c73a9e2300077522afae04
MD5 812a2b7f4f72dd60bf690bd97631fce8
SHA1 e08779dc5a9de443099e3bc000fe15f815cce48e
SHA512 a6c6da31396ee3fa674c1be092495c5e74f6b5337d0105083f970f6165e1b413d2abddb809c4c7fab0d4cc877a741d758c786e9f86e284f7186d58b52d2d0d6e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEL4:qCewdx5tul2Mf0nkxqatgl8bCaiEL4
TLSH
T147057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 778KB
SHA256 7526a055dd35415bc725cde56e1044221ac5c35794c7d12c735be47e613f3ff2
MD5 df99f3660fcf2a613438c4fe79b8b6fe
SHA1 36f08b39ee9193093ddac8ecf657e8a481f63c99
SHA512 bb47eb5b13994da9e0cd608c7de33ad2376bdbfe6f5fd16ca9933c421abbe36a4597fb7983bef065829419ccf2ae7493f9f768cc44bf12b7a70e634ad0d5ed42
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiECu:qCewdx5tul2Mf0nkxqatgl8bCaiECu
TLSH
T117057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 778KB
SHA256 c693e7e00a3da267485295d58492da9a8c0709b3c370884caaba56286fa59b0c
MD5 a5ef00a54e0271cf7b32016676100181
SHA1 bb41dcf8e2964d8616c5988e4422f5cef999337e
SHA512 3e9e20cc8707df5b5fb66b8d7b7a9cb78b88c55a013058d8a510750b04ffdf86f034079f9a45cfa9eacbd36b2976812acdb68386d86834ea5d56989df40b44a9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiETj:qCewdx5tul2Mf0nkxqatgl8bCaiETj
TLSH
T109057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 778KB
SHA256 bb621bdf9cb6be05c03a2a6883a887d69603e4c54ba0fca278875be6c4fc3685
MD5 5ed8fc70eebb8ed163a98c8f3c03974d
SHA1 3a629c8180a1e6f25c178f7e01c752fe016a42ef
SHA512 387b74bb189b9223b9e59758d1c22cdefac8a6a09938cc04a934f887d1313576234fffd68023805ce8f965c90033c43c2bded75f5a7b86b0f380fd30f0c61227
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEeg:qCewdx5tul2Mf0nkxqatgl8bCaiEeg
TLSH
T114057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 778KB
SHA256 0b87dd797726731e045b5af52830a01066f4d0f74c50b48b054dbc8537d0b3f4
MD5 eb976e3c1677bba60e0ce1ee09c33ffa
SHA1 04f81f30a3e62304e25b7789d8a9d65a57143620
SHA512 c2559519dfe2b5ecd4c841d93c505c096bb872e1c1bfe164b786d4745d5f0c752839a581e268a86dbbb7b72e1c3068b272b307a6442153b96fbbad7a572bd531
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiERI:qCewdx5tul2Mf0nkxqatgl8bCaiERI
TLSH
T1D3057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 778KB
SHA256 21beb4b436d9c7e4d0752dabb30917b17c44402b61341266ef50f93799414330
MD5 1f1d70a9d909e30229f38e6a612a2beb
SHA1 e6d4bae6388d9db8a160fde76f92039d7bf39f80
SHA512 5540f95b8104a8032b0d366f2c32fae5aee3173cdaf882a6c89fad71d3e05a1752ea2459acd604387a41f44a5f886fea2b75c9a700acb575a5bef9dac4307d6a
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiETo:qCewdx5tul2Mf0nkxqatgl8bCaiETo
TLSH
T1F8057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 778KB
SHA256 9daab2de0b80e08a75df00bdaa8d28ec97b2adcb44948e76a577f285c4f2f923
MD5 8cbaaf508942ca3c92ba82699443ba17
SHA1 36c1528e83251df4de5220b93612974db2e00153
SHA512 953f1fa0b188c72043eb437fe9193eee95a8a07d9511d5316e1ea16a51633939ad33f85e11a8eefa5d26b0ae34435ac60d916c0b7f409fb649f609b11197b317
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEY+:qCewdx5tul2Mf0nkxqatgl8bCaiEY+
TLSH
T151057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 778KB
SHA256 49ef6f23592483409256c8c166ccbfec347b0b20244f2213743f2936fef75da3
MD5 123ca87fdffb047f9a5f0157b436fe15
SHA1 bfd5531a2983acec638bd554392d9112249fc370
SHA512 a410a46c2bd8357a7627a2403de032c855763e27c6d3cd56ff4dc827e4363d92d719b732612bba13f81592eda61df749ceb3527bb3751ca5c93765fd619d9542
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEwQ:qCewdx5tul2Mf0nkxqatgl8bCaiEwQ
TLSH
T177057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 778KB
SHA256 d9d18ed8ceee3d82a5c23cf9e82cabdb8a623418563f332a2c75cba7f66ffe2c
MD5 7080e5283b0fa2cc5cccb8fd62de4a30
SHA1 25beed8a82f95c9b27145f7c9c2cc9f4e1eedb7f
SHA512 85709fd4af56ec306f47e0ffe3edeed77681952866ef8070424d7a7604d2a83fab9ea8cfdbb2911778e41fe10457cf60f27173e070d04f8278d3993c7bfab048
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEZX:qCewdx5tul2Mf0nkxqatgl8bCaiEZX
TLSH
T196057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 974KB
SHA256 6bd4937410897cb1cecf79dcf5fef6690660fd4d44781167e1672826b88f2dea
MD5 4b08aac69be4bf12415c8d1b6a4cd215
SHA1 51bd4be7432ee93f40d754c3d54a23b2d20f488d
SHA512 f18302e045d60c61357309ce1c88ac317856e2451b939a9e2188a25f3caaa6d087252534ce1453dc5c0f5ebf505b64c876c2d37a533859bb535ec5f70c7780c7
SSDEEP 24576:qCewdx5tul2Mf0nkxqatgl8bCaiEujCXF7IwZ:QgE2Mf3qatgllC17IwZ
TLSH
T12D257D52BB8084B3D56702318C9767A7ABB5B9511F6193CB2398536D1F333C0B7363AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 778KB
SHA256 a8ff4513d9553d3e3efe0847a33010b36a3b7cd258976baacf68085095b6195c
MD5 0abfaa5f1797cd47ba19409eebb5924a
SHA1 844dda14d81bec158055ecf833a3aa7fce61bbba
SHA512 a857a4269fcae800bd8e0777056c743cce82f38195d253ac7227224f8f0678fb404f8ee30f62025e487d8596170ef0aa980383ed318f96f66ea3704b907cd129
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEzL:qCewdx5tul2Mf0nkxqatgl8bCaiEzL
TLSH
T176057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 778KB
SHA256 5e67a82a57e26a1159ebba0c1aa70ef063c309d1f06551e0ab7173633c800102
MD5 f5c71ab3a176b92d3b45934ceb4d0fd7
SHA1 7cad2e18c4e7c1b3ce14ce7a449e05c70d19ab0d
SHA512 9da9469c35ac29206e41e01c32a81c3fc86f2b03d6feae1d642fa047618db5a9a96bc750fec9cb2688d3558d8a18b54aae812711dfbcaa2eaa8aedc518983b62
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEZFC:qCewdx5tul2Mf0nkxqatgl8bCaiEZM
TLSH
T10D057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 778KB
SHA256 a3b09e4dd0bb248754228322845d52abc0132e205f0d717345f777622703713c
MD5 3f8084c567a963142d56c7a227b73c33
SHA1 450c49a6a0a661e0558112cc8a0d0f5a0bb8b28a
SHA512 e095058cb96b6e352e6fa8d35aaa9243999aa96573864189c0f56721b44f77218e3449e2bd6de2a772fff685a6d8ae06279e451949eda40e520acff8605fe5f9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEih:qCewdx5tul2Mf0nkxqatgl8bCaiEih
TLSH
T14E057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3108-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3108-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads